Kubernetes Attack and Defense: Inception-Style
Talkat Cloud Native Security Day Europe 2020 · on Monday, 2020-08-17· at 18:10· InXpo, https://onlinexperiences.com/Launch/Event.htm?ShowKey=99259·
summary
Demo shows a compromise starting from a typo-squatted Python package that adds a reverse-interpreter to container images, which phones home via a Metasploit Docker image and yields a pod with a mounted service account token. That token plus a monkey-in-the-middle pod (matching service labels in the same namespace) lets the attacker obtain an admin token, escalate via GCP buckets using Paradise automation, bypass pod security policies by creating PV/PVC host mounts, and achieve root on a node; defense uses OPA/Gatekeeper and workload identity; scenario ships in Bustakube.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:45Overview
- 4:48Demo
- 8:50Attack
- 14:30Flag
- 16:00CheckPosition
- 18:08Stage
- 19:58Service Count Token
- 24:23Cloud Attack
related talks
49mAttacking and Detecting Attacks on Kubernetes Clusters
19mHacking Kubernetes
43mKubernetes Security: Attacking and Defending Modern Infrastructure
38mKubernetes Security: Attacking and Defending K8s Clusters
29mKubernetes Security: Attacking and Defending K8s Clusters
01h 24mTutorial: Attacking and Defending Kube...
20mUncovering a Sophisticated Kubernetes Attack in Real-Time
01h 13mTutorial: Hands-on Hacking Kubernetes and Ways to Prevent It