Attacking (and Defending) Apache Kafka
summary
Clear, concrete attack scenarios and specific defenses: explains abusing consumer group membership to halve notifications, forcing rebalances from a single node at ~70% utilization to spike remaining nodes, and using tiered storage plus retention to hide fraudulent messages. Walks through tooling and mitigations—Kafka Connect credential risks, ACLs, encryption, schemas, monitoring message size/distribution, and infra as code with Terraform/Kubernetes plus Grafana alerts. Watch if you want actionable setups and example exploits and fixes; skip if we want CVE proofs or ready-to-run exploit code.
AI-written summary · about
chapters (18)
- 0:00Kafka security research intro
- 1:14Why we love Kafka
- 3:20Kafka features and benefits
- 6:11Hacker view on Kafka vulnerabilities
- 9:03Attacker abuse scenarios
- 12:13Network and node attacks
- 15:24Sniffing Kafka traffic
- 16:47Producer access exploits
- 19:18Consumer group attacks
- 23:13Risks of unvalidated data
- 26:43Broker compromise and Kafka Connect
- 27:26Mitigating Kafka risks
- 31:26Security basics for Kafka
- 35:05Monitoring Kafka
- 37:54Testing Kafka security
- 39:00Refining Kafka security
- 41:06Tools to secure Kafka
- 43:16Q&A
related talks
45mDeep Dive into Data Streaming Security
56mDeep dive into data streaming security
29mKubernetes Security: Attacking and Defending K8s Clusters
32mKubernetes Attack and Defense: Inception-Style
01h 37mLines of Defence – Securing Your Kubernetes Clusters
49mAttacking and Detecting Attacks on Kubernetes Clusters
26mBoost your security and resiliency in Kubernetes
38mA Tale of a Meshi Kafka: Securing Kafka Deployment When Istio Is Used