GhostImage: A Method to Fool Container Image Vulnerability Scanners

NCU Institutional Repository > 資訊電機學院 > 資訊工程研究所 > 博碩士論文 > Item 987654321/98228

請使用永久網址來引用或連結此文件: https://ir.lib.ncu.edu.tw/handle/987654321/98228

題名:	GhostImage: A Method to Fool Container Image Vulnerability Scanners
作者:	莊姝禎;SHU-CHEN, CHUANG
貢獻者:	資訊工程學系
關鍵詞:	容器安全;容器映像;靜態掃描器;繞過技術;映像安全;漏洞隱藏;Container;Docker Image;Container Security;Scanner Bypassing;Static Scanner;Container Security
日期:	2025-07-14
上傳時間:	2025-10-17 12:31:15 (UTC+8)
出版者:	國立中央大學
摘要:	隨著 DevOps 與雲端技術的普及，容器映像檔成為軟體供應鏈的重要環節。然而，若映像中包含已知漏洞或惡意程式，將對系統安全構成威脅。現有映像掃描工具如 Trivy [1] 和 Docker Hub [2] Scanner 雖可進行漏洞檢測，但依賴固定 metadata 與檔案結構，存在被繞過的風險。本研究提出多種映像檔操控技術，包含刪除 metadata、重命名檔案及結構混淆，成功繞過主流靜態掃描器，並於實驗中證實可隱匿漏洞映像，揭示靜態掃描技術的防護侷限，並為未來防禦機制提供改進依據。;In the context of the widespread adoption of DevOps and cloud environments, container technology provides strong isolation and flexibility, making software development and deployment more efficient. A Docker Image serves as the foundation for container execution, containing an application and all its dependencies, allowing users to quickly build and deploy applications. However, if an image contains security vulnerabilities, it may pose significant risks to automated deployment environments. For instance, attackers can exploit vulnerable dependencies (CVE) or inject malicious backdoors to launch attacks on the system, potentially leading to the leakage of confidential information. This highlights the inseparable relationship between container security and image integrity. Currently, many organizations rely on official or third-party image scanners to assess image security and mitigate potential risks. However, our research reveals that existing scanners still have limitations—attackers can craft specially designed images to bypass scanning mechanisms, thereby introducing vulnerable dependencies into containers and creating new attack vectors. This study aims to explore methods for bypassing current image scanner detection mechanisms and analyze their potential impact on containerized environments, with the goal of developing more effective defense strategies.
顯示於類別:	[資訊工程研究所] 博碩士論文

文件中的檔案:

檔案	描述	大小	格式	瀏覽次數
index.html		0Kb	HTML	12	檢視/開啟

在NCUIR中所有的資料項目都受到原著作權保護.

社群 sharing

資料載入中.....