Securing^WAttacking Kubernetes
summary
Live demos show obtaining a shell via exposed APIs and command injection, then using kubectl exec to create a pod with privileged:true and a hostPath mount of /, yielding a guest-to-host escape and root shell on the node. Service account tokens and kubeconfig files in mounted pods allow cluster API access; unsecured dashboard and unauthenticated kube-apiserver/kubelet ports (reported thousands on Shodan, ~109k 10250 hits) enable lateral takeover. Recommendations: disable privilege, avoid mounting service accounts, lock API ports, use PodSecurityPolicies and kube-bench audits.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:30What is Kubernetes
- 3:37Kubernetes components
- 5:20Interacting with clusters
- 7:05Common security pitfalls
- 9:32Gaining access inside pods
- 11:23Demo: Privilege escalation
- 14:54Demo: Exposed dashboard
- 17:32Demo: Web-based shell
- 18:38Exposed API ports
- 20:22Finding vulnerable clusters
- 21:26Bug bounty case study
- 23:13Securing Kubernetes clusters
- 27:27Q&A
related talks
40mHacking and Hardening Kubernetes Clusters by Example [I]
50mBeyond the Pod: Privilege Escalation in Kubernetes
34mHijack a Kubernetes Cluster - a Walkthrough
33mTutorial: Hack My Mis-Configured Kubernetes
01h 13mTutorial: Hands-on Hacking Kubernetes and Ways to Prevent It
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
33mSecuring Kubernetes in the Cloud
43mKubernetes Security: Attacking and Defending Modern Infrastructure