All Your Containers Are Belong to Us
summary
Scans using Census and Shodan find concrete exposures: about 21,000 Kubernetes API endpoints (mostly on AWS), roughly 500 web Kubernetes Dashboard instances and ~2,400 accessible etcd stores, with over 800 API servers answering on the insecure port. Demos show unauthenticated listing of secrets and cluster admin access via curl and kubectl; findings drive clear fixes: disable the insecure port, restrict network access, enable RBAC/TLS and encrypt etcd.
AI-written summary · about
chapters (23)
- 0:00Introduction to talk
- 0:20Background and agenda
- 1:07Speaker's background
- 2:11Why orchestrators and Kubernetes
- 3:59Kubernetes security features
- 4:41Research disclaimers
- 5:24Kubernetes dashboard overview
- 7:13Demo: Finding dashboards with Census
- 9:44Dashboard exposure findings
- 10:49Dashboard security recommendations
- 11:29API server overview and risks
- 12:53Demo: Finding API servers
- 14:37API server exposure findings
- 15:42Insecure API server port risks
- 16:24API server security recommendations
- 17:29ETCD overview and risks
- 18:33Demo: Finding ETCD clusters
- 19:58ETCD exposure findings
- 20:42ETCD security recommendations
- 21:25Final thoughts on research
- 22:08Broader Kubernetes security
- 23:11Resources and contact info
- 23:58Q&A session
related talks
32mContainer Security: Exploits, Vulnerabilities and Defense
11mLets secure our Kubernetes cluster
35mInsights into Unsecured Kubernetes in the Wild
29mKubernetes Exposed: One Yaml Away from Disaster
31mA Hacker's Guide to Kubernetes and the Cloud
30mWhat We've Learned from Scanning 10K+ Kubernetes Clusters - Gal Gibli
49mCluster Wrangling: How to make Kubernetes clusters secure and usable
30mBelow the Radar: Identifying Hidden Threats Within the Development Ecosystem