Security Showdown: The Overconfident Operator Vs the Nefarious...
summary
Demo shows a USB rubber ducky stealing kubeconfig and SSH keys, enabling forged Git commits that replace a message queue with Nova’s image and exfiltrate data; attacker escapes a privileged build container via nsenter to gain host root, tries eBPF backdoors with BoopKit. Fixes proven effective: private kube API + least-privilege RBAC, GitOps (Argo/Flux) with repo MFA and signed commits (git-sign), admission policies (OPA/Kubernetes), network policies and service-mesh mTLS, plus runtime eBPF monitoring (Falco) — cluster is rebuilt and traffic restored.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 3:15Overconfident operator
- 6:23Nefarious USB attack
- 9:37Unauthorized Git commits
- 11:42Securing message queue
- 13:26Image registry policies
- 15:35Runtime security with eBPF
- 18:23Cluster quarantine and forensics
- 19:06New cluster security features
- 20:49Onion layer security
- 21:31Q&A
related talks
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
38mA Treasure Map of Hacking (and Defending) Kubernetes
42mBeyond Kubernetes Security
19mHacking Kubernetes
04mTalk Deep Dive
01h 24mTutorial: Attacking and Defending Kube...
50mBeyond the Pod: Privilege Escalation in Kubernetes
26mHacking into Kubernetes Security for Beginners