Live Hacking Cloud Architectures - Thorsten Jakoby and Mirna Alaisami
summary
Attackers brute force a Jenkins instance using the rockyou password list, extract an encrypted credential blob from the Jenkins credentials plugin by asking Jenkins to decrypt it, and turn that into a Google Cloud service account JSON that lists two Kubernetes clusters and yields a kubeconfig. The attacker injects a sidecar to mirror TCP traffic, exfiltrates backups and secrets, and the blue team responds with Ingress logging plus Tetragon/eBPF tracing policies that kill offending processes and block the sidecar—observability works but is not a silver bullet.
AI-written summary · about
chapters (13)
- 0:00Introduction to live hacking
- 1:26Reconnaissance on Never Victim Consult
- 2:30Brute forcing subdomains
- 4:17Exploiting Jenkins access
- 8:23Stealing Google Cloud credentials
- 13:10Accessing Kubernetes cluster
- 15:25Injecting sidecar container
- 16:51Red team attack recap
- 18:40Head of security response
- 19:25Deploying Tetragon policies
- 21:33Blocking attack with Tetragon
- 25:57Production environment defense
- 27:23Q&A session
