<![CDATA[I’ve mentioned this before: this is one of the oncoming trains for corp-security.]]>I’ve mentioned this before: this is one of the oncoming trains for corp-security. We’ve long failed at least-privilege, but weren’t often punished for it.

Helen in HR (or Bob in accounts) didn’t know what to do with the extra perms they didn’t know they had.

Their agents will.

]]>https://board.circlewithadot.net/topic/622ec5c4-71f2-4778-b9c2-9b167e5252ee/i-ve-mentioned-this-before-this-is-one-of-the-oncoming-trains-for-corp-security.RSS for NodeSat, 06 Jun 2026 05:13:56 GMTSun, 31 May 2026 20:02:53 GMT60<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Mon, 01 Jun 2026 15:45:07 GMT]]>@webhat @haroonmeer also add: "don't say anything about goblins"

]]>https://board.circlewithadot.net/post/https://techhub.social/ap/users/116070070148560601/statuses/116675622159516438https://board.circlewithadot.net/post/https://techhub.social/ap/users/116070070148560601/statuses/116675622159516438Mon, 01 Jun 2026 15:45:07 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Mon, 01 Jun 2026 15:05:52 GMT]]>@haroonmeer Will this still work if docker is not run as root but as an unprivileged user?

]]>https://board.circlewithadot.net/post/https://mastodon.sandwich.net/users/shadur/statuses/116675467861435268https://board.circlewithadot.net/post/https://mastodon.sandwich.net/users/shadur/statuses/116675467861435268Mon, 01 Jun 2026 15:05:52 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Mon, 01 Jun 2026 14:41:12 GMT]]>@feld @haroonmeer Why are we so worried about agents using this when the user had the rights in the first place? Agents/LLMs should change nothing in that equation.]]>https://board.circlewithadot.net/post/https://fluffytail.org/objects/3a35d744-235e-4952-b23d-9506491b0e55https://board.circlewithadot.net/post/https://fluffytail.org/objects/3a35d744-235e-4952-b23d-9506491b0e55Mon, 01 Jun 2026 14:41:12 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Mon, 01 Jun 2026 14:39:11 GMT]]>@haroonmeer why are we so worried about agents using this when this was already the first thing any attacker would do?

Pop a shell on Linux, check for docker group access. That makes life very easy.]]>https://board.circlewithadot.net/post/https://friedcheese.us/objects/9fe0c17e-1f5e-4910-bfa1-c6abbe8e1ac6https://board.circlewithadot.net/post/https://friedcheese.us/objects/9fe0c17e-1f5e-4910-bfa1-c6abbe8e1ac6Mon, 01 Jun 2026 14:39:11 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Mon, 01 Jun 2026 13:58:57 GMT]]>@mdione @haroonmeer Honestly, I can see the appeal of docker as a sort of web services oriented package manager; but it's terrifying to see people treating it as though it's a VM-tier isolation tool or security boundary. It's certainly not impossible to use it in ways that provide at least some protection from container contents; but the overall intent is much closer to easing dependency wrangling and keeping configs contained than to hard isolation.

]]>https://board.circlewithadot.net/post/https://cyberplace.social/users/fuzzyfuzzyfungus/statuses/116675204679570882https://board.circlewithadot.net/post/https://cyberplace.social/users/fuzzyfuzzyfungus/statuses/116675204679570882Mon, 01 Jun 2026 13:58:57 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Mon, 01 Jun 2026 13:40:57 GMT]]>@mdione @haroonmeer Docker can map to a user other than root; but it leaves whether or not it does so up to you. I'm not sure if there's some specialty lockdown config that tightens this; but by default docker doesn't even seem to intend to protect the host from the user; and leaves it up to the user whether they want any actual protection from container contents or not.

Link Preview Image
Understanding the Docker USER Instruction | Docker

Discover best practices and common pitfalls associated with the Docker USER instruction. Also get a hands-on demo to learn the importance of these practices.

favicon

Docker (www.docker.com)

]]>https://board.circlewithadot.net/post/https://cyberplace.social/users/fuzzyfuzzyfungus/statuses/116675133930152264https://board.circlewithadot.net/post/https://cyberplace.social/users/fuzzyfuzzyfungus/statuses/116675133930152264Mon, 01 Jun 2026 13:40:57 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Mon, 01 Jun 2026 13:08:02 GMT]]>@haroonmeer @jackeric agents are very clever. I’ve seen them try all kinds of things like this just to “get the task done.” I’ve only noticed because I put them in sandbox-exec.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/kumarvibe/statuses/116675004483206172https://board.circlewithadot.net/post/https://mastodon.social/users/kumarvibe/statuses/116675004483206172Mon, 01 Jun 2026 13:08:02 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Mon, 01 Jun 2026 08:54:10 GMT]]>@mdione @stux @haroonmeer

Feels like sabotage

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/expertenkommision_cyberunfall/statuses/116674006221647473https://board.circlewithadot.net/post/https://mastodon.social/users/expertenkommision_cyberunfall/statuses/116674006221647473Mon, 01 Jun 2026 08:54:10 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Mon, 01 Jun 2026 08:51:45 GMT]]>@haroonmeer but isn't the docker's `root` user mapped to a host's transient normal user?

]]>https://board.circlewithadot.net/post/https://en.osm.town/users/mdione/statuses/116673996746592401https://board.circlewithadot.net/post/https://en.osm.town/users/mdione/statuses/116673996746592401Mon, 01 Jun 2026 08:51:45 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Mon, 01 Jun 2026 08:50:30 GMT]]>@expertenkommision_cyberunfall @stux @haroonmeer and some corps forces us to do it.

]]>https://board.circlewithadot.net/post/https://en.osm.town/users/mdione/statuses/116673991851133331https://board.circlewithadot.net/post/https://en.osm.town/users/mdione/statuses/116673991851133331Mon, 01 Jun 2026 08:50:30 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Mon, 01 Jun 2026 05:49:56 GMT]]>@stux @haroonmeer

And corp encourages them to do do.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/expertenkommision_cyberunfall/statuses/116673281793028639https://board.circlewithadot.net/post/https://mastodon.social/users/expertenkommision_cyberunfall/statuses/116673281793028639Mon, 01 Jun 2026 05:49:56 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Mon, 01 Jun 2026 05:12:08 GMT]]>@haroonmeer As a last resort it would have probably tried running the copyfail exploit.

]]>https://board.circlewithadot.net/post/https://social.tchncs.de/users/cgudrian/statuses/116673133182341768https://board.circlewithadot.net/post/https://social.tchncs.de/users/cgudrian/statuses/116673133182341768Mon, 01 Jun 2026 05:12:08 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Mon, 01 Jun 2026 03:56:37 GMT]]>@haroonmeer at least it didn't use the latest linux exploit

]]>https://board.circlewithadot.net/post/https://mamot.fr/users/tdelmas/statuses/116672836270784157https://board.circlewithadot.net/post/https://mamot.fr/users/tdelmas/statuses/116672836270784157Mon, 01 Jun 2026 03:56:37 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Mon, 01 Jun 2026 00:33:47 GMT]]>@haroonmeer feeling less stupid for being paranoid enough to not add my user to the docker group.

]]>https://board.circlewithadot.net/post/https://mastodon.social/ap/users/116660985003036425/statuses/116672038675977990https://board.circlewithadot.net/post/https://mastodon.social/ap/users/116660985003036425/statuses/116672038675977990Mon, 01 Jun 2026 00:33:47 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Sun, 31 May 2026 23:57:37 GMT]]>@haroonmeer People are willingly installing malware now, heck.. they’re even paying for it

]]>https://board.circlewithadot.net/post/https://mstdn.social/users/stux/statuses/116671896482893341https://board.circlewithadot.net/post/https://mstdn.social/users/stux/statuses/116671896482893341Sun, 31 May 2026 23:57:37 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Sun, 31 May 2026 23:05:47 GMT]]>@haroonmeer

Yeah it's like Cliff Stoll and sendmail all over anew (yes I'm that old). Docker frequently writes root owned files to the FS. We are a dumb species.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/megatronicthronbanks/statuses/116671692624312808https://board.circlewithadot.net/post/https://mastodon.social/users/megatronicthronbanks/statuses/116671692624312808Sun, 31 May 2026 23:05:47 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Sun, 31 May 2026 22:41:12 GMT]]>@webhat @haroonmeer
ha ha ha
Uninstalling the Agent is the only solution.

]]>https://board.circlewithadot.net/post/https://mastodon.ie/users/raymaccarthy/statuses/116671595997484325https://board.circlewithadot.net/post/https://mastodon.ie/users/raymaccarthy/statuses/116671595997484325Sun, 31 May 2026 22:41:12 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Sun, 31 May 2026 22:32:32 GMT]]>@haroonmeer I had a problem with corporate security theatre getting in the way of something I needed to do.

So I asked the corporate provided AI how to get round the corporate security theatre.

And instead of reporting me to security it gave me some code. (Which, in the nature of AI generated code, didn't actually work, but it did give me the clue necessary to write my own code which did work.)

]]>https://board.circlewithadot.net/post/https://c.im/users/TimWardCam/statuses/116671561872321448https://board.circlewithadot.net/post/https://c.im/users/TimWardCam/statuses/116671561872321448Sun, 31 May 2026 22:32:32 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Sun, 31 May 2026 21:41:33 GMT]]>@rickf @haroonmeer @TindrasGrove

Still no use case for and apparently are useless...

(I should start a file of these)

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/n_dimension/statuses/116671361386767652https://board.circlewithadot.net/post/https://infosec.exchange/users/n_dimension/statuses/116671361386767652Sun, 31 May 2026 21:41:33 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Sun, 31 May 2026 21:26:50 GMT]]>@haroonmeer I mean, right away the solution would be podman, not docker. Podman doesn't require root level privs to run.

]]>https://board.circlewithadot.net/post/https://social.linux.pizza/users/wydamn/statuses/116671303562850304https://board.circlewithadot.net/post/https://social.linux.pizza/users/wydamn/statuses/116671303562850304Sun, 31 May 2026 21:26:50 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Sun, 31 May 2026 21:05:40 GMT]]>@haroonmeer I wasn't even aware codex ran locally? I thought it was just in the browser with shitty github connections.

]]>https://board.circlewithadot.net/post/https://hear-me.social/ap/users/115696907373093865/statuses/116671220335496103https://board.circlewithadot.net/post/https://hear-me.social/ap/users/115696907373093865/statuses/116671220335496103Sun, 31 May 2026 21:05:40 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Sun, 31 May 2026 20:41:13 GMT]]>@haroonmeer @TindrasGrove

I am so glad I’m no longer in the operational security world anymore ….. these problems are going to grow exponentially* and so will the corresponding burnout.

* on top of the ongoing usual problems that should’ve been fixed / addressed 20 years ago but still haven’t.

]]>https://board.circlewithadot.net/post/https://indieweb.social/users/rickf/statuses/116671124149419981https://board.circlewithadot.net/post/https://indieweb.social/users/rickf/statuses/116671124149419981Sun, 31 May 2026 20:41:13 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Sun, 31 May 2026 20:26:27 GMT]]>@haroonmeer @temptoetiam that’s also the end of parental control, I guess.

]]>https://board.circlewithadot.net/post/https://piaille.fr/users/nholzschuch/statuses/116671066104291696https://board.circlewithadot.net/post/https://piaille.fr/users/nholzschuch/statuses/116671066104291696Sun, 31 May 2026 20:26:27 GMT<![CDATA[Reply to I’ve mentioned this before: this is one of the oncoming trains for corp-security. on Sun, 31 May 2026 20:14:22 GMT]]>@haroonmeer they need to add: "Don't hack stuff" to the prompt, that will protect them

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/webhat/statuses/116671018630617370https://board.circlewithadot.net/post/https://infosec.exchange/users/webhat/statuses/116671018630617370Sun, 31 May 2026 20:14:22 GMT