1

I am a junior web developer. All I know is mostly about web development. I have no skills and knowledge about system security and know little about Linux.

I work in a company which is developing some embedded product. In the R&D department, some developers built a build-server for development. They make our own Docker image and run Docker, including CI/CD and Gitlab service, in this server.

This build-server connects with our AD server. Our developer could add his own public Key to this server and then remotely log in to this server with SSH and doing development in this server. We call it DevOps.

This server only works in our company's intranet or VPN, not open for public Internet.

The above is all background information.


A few months ago I read some IT security blogs about Docker security issues. It says that because the architecture of Docker is different from traditional VM, if the Docker image is backdoored, then the whole system will be easily hacked.

If I suppose that the person who built this build-server is not a good guy, and he backdoored the Docker images, is it possible that my account in this build-server could be hacked or usurped?

I mean even I use the public key and SSH login, without typing the password manually. Does this risk still exist?

Second question: if the first question above is TRUE, what could I do to protect my self?

I mean, if the bad guy usurped my account and did something bad thing (for example, leaking development codebase of company using my account or doing other attacks using my account), how could I prove I am innocent?

I can not discuss these suspicions thinking with my colleague because I have no evidence about those things. I just worry about these becoming true, so I want to do something to prevent, just in case. I also have no authorization to check or validate the server.

What could I do? Backup my login logs of my laptop periodically? (But it seems irrelevant to the build-server.)

  • If someone were to steal your public key from that server, they can't do anything with it. They would need your private key, which never gets sent to that server. – Ghedipunk Jan 7 at 17:55
0

If I suppose that the person who built this build-server is not a good guy, and he backdoored the Docker images, (...)

If the administrator of the server is malicious, he could have backdoored it so that he knows every interaction you do with its service (including passwords entered there).

I mean even I use the public key and SSH login, without typing the password manually. Does this risk still exist?

A public key SSH login cannot be man-in-the-middled. There is no password that can ve reused. The server knows the public part of your ssh keys, and verifies that you have knowledge of the private one.

if the bad guy usurped my account and did something bad thing (for example, leaking development codebase of company using my account or doing other attacks using my account), how could I prove I am innocent?

Note that in your scenario he would only have access to your account in that server.


Please note that it is highly unlikely that this is going on. On every company there are system administrators (someone needs to make sure that thinks work!), and they could theoretically backdoor the systems. But this doesn't mean they do. It would in fact be quite risky for them should they be caught. Your company should provide you a safe environment to work, and if they considered that it is safe to give access to X guy, and that turned out to be a bad idea, it's really your company's fault. If you showed that other people had access to your account (not by your fault, though!), that should show that it is not necessarily you who did "that very wrong thing" (an actual case would probably require a lot more detail than just looking at the account user, probably requiring a forensic analysis, etc.).

Also note that it is also possible that guy X is doing things they are not supposed to, or even breaking some internal company rules, such as storing passwords of other employees. In that case, if you found out, there should be some high-level position (an internal security team? the CISO?) to which it could (should) be reported.

Obviously, if a system may be controlled by other users, don't store anything confidential there, avoid entering your credentials on it, etc.

| improve this answer | |
  • Hi , angel ,thanks for your answering , these analysis and explanation makes me calm down , and I need one further assistance. does you mean that I am secure if I keep use ssh and public key to login the server , even if that system be controlled by bad guys ?? because of the ssh and public key mechanism ,they can not forge or doing impersonation, right? but if I doing some personally thing in that controlled server , (for example , just typing something or store something personal information) then the security is not be guaranteed , Do I understand this correctly?? thanks again. – airbound Jan 8 at 4:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.