Uncovering a Sophisticated Kubernetes Attack in Real-Time
summary
Shows real detections of two live GKE attacks: a privileged pod that mounts the host filesystem and achieves a container escape, and a compromised app that exfiltrates a sensitive S3 object using env credentials. Uses Cilium + eBPF to capture syscalls, process and network events, emit JSON to user space, and a Python consumer to flag sensitive commands and host mounts. Demonstrates verification of runtime protections and alerting for immutable image violations.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:36Meet Jed and Natlia
- 0:54What is observability
- 2:14How do we secure Kubernetes
- 3:07What can we do
- 4:08Making security look more like SRE
- 5:09Trust but verify
- 7:30Why BPF
- 10:10Overview
- 11:00Demonstration
- 16:49Immutability
- 18:45Conclusion
related talks
49mAttacking and Detecting Attacks on Kubernetes Clusters
43mKubernetes Security: Attacking and Defending Modern Infrastructure
32mKubernetes Attack and Defense: Inception-Style
01h 24mTutorial: Attacking and Defending Kube...
38mKubernetes Security: Attacking and Defending K8s Clusters
29mKubernetes Security: Attacking and Defending K8s Clusters
38mKubernetes Security: Attacking and Defending K8s Clusters
32mKubeCapture: A Live Hacking Showcase on Kubernetes Security