"PIVOT!" — Bouncing between your app, your cluster and your cloud
summary
Live demos show attackers using RCE and SSRF to curl the instance metadata service and steal worker node AWS creds, then use those creds to pull images (about 8% of images contain secrets), create service account tokens and escalate to cluster admin. Differences per cloud matter — GCP and Azure require headers or different flows — and mitigations are concrete: enforce IMDSv2 enforced and block pod access with network policies or workload identity. A published tool manage-kubernetes-auditing-toolkit scans service accounts, IAM roles and finds hardcoded cloud secrets and verifies IMDS blocks.
AI-written summary · about
chapters (17)
- 0:00Cloud pivoting risks
- 1:04Managed Kubernetes overview
- 2:05Instance metadata service
- 3:49Exploiting pod access to IMDS
- 5:15Server-side request forgery risks
- 6:19Live demo stealing credentials
- 8:05Pivoting to AWS resources
- 10:14Compromising service accounts
- 12:45Live demo privilege escalation
- 13:47Summary of attack vectors
- 15:32Mitigating IMDS access
- 17:17Local file read vulnerabilities
- 18:46Live demo token trading
- 20:38Complete attack flow
- 21:42Checklist for cloud security
- 22:46Kubernetes auditing toolkit
- 24:10Additional resources
