Kubernetes Security: Attacking and Defending K8s Clusters
summary
A live exploit of a vulnerable Drupal site (Drupalgeddon2 (CVE-2018-7600)) yields a shell in a pod and attackers spin up crypto‑miners within 24 hours. Internal reconnaissance uses service account tokens and env vars to query the API (port 6443) and perform privilege escalation via a privileged pod (hostPID + mount namespace escape). Detection and hardening shown with kube-hunter, kube-bench, image scanners (Trivy/Snyk/Docker scan) and runtime alerts via Falco, plus RBAC, network policies, resource limits and API/audit protections.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 1:29What is Kubernetes
- 5:09Attacking Kubernetes clusters
- 17:35Privilege escalation in K8s
- 19:42Defending Kubernetes clusters
- 37:28Q&A
related talks
38mKubernetes Security: Attacking and Defending K8s Clusters
29mKubernetes Security: Attacking and Defending K8s Clusters
49mAttacking and Detecting Attacks on Kubernetes Clusters
35mInsights into Unsecured Kubernetes in the Wild
43mKubernetes Security: Attacking and Defending Modern Infrastructure
30mSecuring^WAttacking Kubernetes
45mThe Hacker’s Guide to Kubernetes
33mKubernetes Security: Horror Stories to Help Secure Your Cluster