The COW - Container On Windows Who Escaped the Silo

Explore the security implications of Windows process-isolated containers in this Black Hat conference talk. Delve into the foundations of cloud services, focusing on virtualization and container isolation. Examine how Windows isolates container processes and filesystems, and prevents containers from executing potentially harmful syscalls. Investigate the implementation of Ntoskrnl using server silos and job objects. Discover answers to critical questions about container isolation and potential attacker capabilities. Learn about past vulnerabilities, anti-system debugging techniques, UEFI, and NVM. Conclude with a demonstration and discussion of mitigation strategies for enhanced container security.