https://www.aquasec.com/tag/container-vulnerability/ Cloud Native Security, Container Security & Serverless Security Sun, 14 Jul 2024 08:00:36 +0000 en-US hourly 1 https://wordpress.org/?v=6.5.5 https://www.aquasec.com/blog/thoughtworks-cloud-security-vulnerability-scanning/ Fri, 24 Sep 2021 09:15:00 +0000 https://www.aquasec.com/?p=15143 Many companies, in an effort to modernize their software and cloud tech stacks, are beginning to confront the challenges of managing security across multiple cross-functional, yet independent, teams – each with diverse tech stacks. One such example is Thoughtworks, a leading global technology consultancy that works with enterprises to enable them to keep pace with …]]> https://www.aquasec.com/blog/supply-chain-threats-using-container-images/ Wed, 11 Aug 2021 10:00:00 +0000 https://www.aquasec.com/?p=15192 Team Nautilus, Aqua Security’s threat research team, has uncovered several supply chain attacks that use malicious container images to compromise their victim. These five container images were found on Docker Hub, which we scan daily for signs of malicious activity. The images hijack organizations’ resources to mine cryptocurrency and can be used as part of …]]> https://www.aquasec.com/blog/aqua-vulnerability-scanner-tools/ Tue, 18 May 2021 09:57:17 +0000 https://www.aquasec.com/?p=15257 https://www.aquasec.com/blog/cve-2020-15157-containerd-container-vulnerability/ Thu, 22 Oct 2020 09:57:13 +0000 https://www.aquasec.com/?p=15462 A new vulnerability was found in containerd, located in the container image-pulling process. The new CVE includes manipulation of the image manifest, allowing attackers to craft an image that can leak the host’s registry or cloud credentials when pulled from a registry. This leak occurs even before the image is running any code on your …]]> https://www.aquasec.com/blog/container-attacks-on-redis-servers/ Wed, 30 Sep 2020 11:30:35 +0000 https://www.aquasec.com/?p=15486 Over the past few weeks, TeamTNT grabbed headlines after launching several novel attacks against cloud native infrastructure. In response, Docker Hub decided to remove TeamTNT’s malicious images from its community and deleted the user ‘Hildeteamtnt.’ But just a few days later, TeamTNT reemerged with a catchy logo “Still alive” embedded in their scripts (although “still …]]> https://www.aquasec.com/blog/container-vulnerability-management/ Tue, 14 Jul 2020 12:26:26 +0000 https://www.aquasec.com/?p=15542 There’s an overwhelming number of vulnerabilities in container images – and the security of your deployments is probably suffering because of it. No matter the size of your organization, it’s a significant challenge to identify the biggest risks to your business and know what to tackle first. Merely classifying and filtering CVEs by the highest …]]> https://www.aquasec.com/blog/trivy-open-source-vulnerability-scanner-vs-code/ Mon, 29 Jun 2020 10:29:31 +0000 https://www.aquasec.com/?p=15549 For most of us developers, our container security protocol involves some sort of static image scan for vulnerabilities. Unfortunately, to do this usually involves jumping out of one type of software program, like a code editor, to open a completely separate tool to perform the scanning. Well, the open source team at Aqua recognized the …]]> https://www.aquasec.com/blog/threat-alert-kinsing-malware-container-vulnerability/ Fri, 03 Apr 2020 09:00:00 +0000 https://www.aquasec.com/?p=15609 Lately we’ve been witnessing a rise in the number of attacks that target container environments. We’ve been tracking an organized attack campaign that targets misconfigured open Docker Daemon API ports. This persistent campaign has been going on for months, with thousands of attempts taking place nearly on a daily basis. These are the highest numbers …]]> https://www.aquasec.com/blog/trivy-open-source-vulnerability-scanner-apache2-0-license/ Mon, 23 Mar 2020 10:33:00 +0000 https://www.aquasec.com/?p=15617 In our view, making security tools easy to use is one of the best ways to increase adoption and help end users improve the security of their deployments. One of the strengths of our open source vulnerability scanner for container images, Trivy, is that it’s very easy to install and to integrate into different workflows. That’s …]]> https://www.aquasec.com/blog/ebpf-tracing-containers/ Wed, 06 Nov 2019 07:33:46 +0000 https://www.aquasec.com/?p=15716 This week at Velocity Berlin, I’ll be giving a talk called A Beginner’s Guide to eBPF. To coincide with it, we’re opening up a new Aqua Security open source project called Tracee, which uses eBPF to trace events in containers. This isn’t something that most developers need to do on a day-to-day basis, but for those …]]>