Protecting software and sensitive data from theft or misuse is unlikely to succeed if attackers gain administrative or physical access to devices that process information in unencrypted form - even for a fraction of a second. We've created asminject.py, a tool that demonstrates an attack on Linux processes and containers using compromised administrative access to the host. Asminject.py was inspired by an environment where container-level endpoint security was part of a larger strategy to protect information within the containers from users with administrator access to the Linux systems that hosted the containers.

Use asminject.py to tamper with trusted processes by injecting arbitrary code via the Linux process filesystem (procfs) interface to capture sensitive data. Without intrusive monitoring at the host level, asminject.py keeps compromise attempts under the radar with minimal detection or response from existing defenses.