Shipping in Pirate-Infested Waters: Practical Attack and Defense in Kubernetes [A]
summary
Three live demos show an attacker exploiting a shell injection to download a backdoor and use Metasploit and nmap to probe the cluster then steal a stolen service-account token to call the API, list pods and pull a payments API secret, then exec into the payments pod. Enabling RBAC and namespace segregation prevents the stolen service account from doing anything, removing hostPath mounts stops access to kubelet files, and network policies stop lateral calls to the payment service.
AI-written summary · about
chapters (7)
- 0:00Introduction and setup
- 2:16Scenario app overview
- 5:04Attack on insecure cluster
- 12:04Hardened cluster and attack
- 20:40Advanced threats and defense
- 27:06Summary and best practices
- 31:25Q&A session
related talks
01h 13mTutorial: Hands-on Hacking Kubernetes and Ways to Prevent It
19mHacking Kubernetes
32mKubernetes Attack and Defense: Inception-Style
30mSecuring^WAttacking Kubernetes
38mKubernetes Security: Attacking and Defending K8s Clusters
49mAttacking and Detecting Attacks on Kubernetes Clusters
38mA Treasure Map of Hacking (and Defending) Kubernetes
26mHacking into Kubernetes Security for Beginners