Vanquishing Vulnerabilities in Valencia
summary
A live Log4Shell RCE demo shows a crafted JNDI/LDAP payload giving a reverse shell into a Tomcat pod (netcat listener), exposing Kubernetes env vars and a service account token, and demonstrating root inside a writable container with curl and nmap available. Recommended defenses are concrete: use smaller images (jib/ko), drop root and capabilities, make filesystems read‑only, enforce network policy deny-all then allow minimal egress/ingress, use admission controllers (Gatekeeper/Kyverno/PSA), and run Falco + Falco plugins for runtime detection and prioritizing fixes.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:15Demo
- 7:35Mitigation
- 15:45Application Security
- 16:53Productivity Security
- 18:44Containerized Applications
- 20:58Falco
- 22:01Falco Plugins
- 24:47Open Source Libraries
related talks
02h 38mJava application security the hard way - a workshop for the serious developer
30mSecuring^WAttacking Kubernetes
52mDevSecOps
41mIdentifying and Mitigating Cloud and Container Threats
46mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
38mA Treasure Map of Hacking (and Defending) Kubernetes
52mSecuring Your Java Containers by Breaking In
50mRuntime Security for Containers