Prepare to Be Boarded! A Tale of Kubernetes, Plunder, and Cryptobooty
Talkat KubeCon + CloudNativeCon North America 2019 · on Thursday, 2019-11-21· at 15:20· Room 14AB - San Diego Convention Center, Mezzanine Level·
summary
A Kubernetes honeypot exposed via dashboard and insecure API takes 31 days to compromise despite constant internet scanning. Daily scans show about 500 exposed dashboards and 678 API servers on the insecure port. Analysis of 10,743 pods finds 4,450 mining pods using CentOS images and repeated curl chains that fetch XMRig from hard‑coded IPs over TCP 8020, matching tactics attributed to the 8220 mining group and yielding concrete IOCs and mitigation steps.
AI-written summary · about
chapters (30)
- 0:00Introduction
- 0:40Cryptobooty
- 1:58Goals
- 2:40Misconfigurations
- 3:56How to discover open dashboards
- 5:53What we found
- 7:22The next step
- 7:52Key questions
- 8:39Background
- 10:49Setup
- 11:25Expectations
- 12:03Wireshark
- 12:19New User Agent
- 12:39Post Request
- 13:21XM reg
- 14:07Configuration file
- 14:21IP addresses
- 14:48Thread Actor Groups
- 15:54Criminal Actor Groups
- 17:36The 8220 Gang
- 18:34TCP Port 8028
- 19:16WhatMiner
- 19:44Rock
- 20:42Cloud Security Tools
- 21:51In Azure
- 23:04Revisiting Research
- 23:34Insecure APIs
- 27:11Final thoughts
- 28:47Resources
- 29:04Questions
related talks
35mInsights into Unsecured Kubernetes in the Wild
38mKubernetes Security: Attacking and Defending K8s Clusters
29mKubernetes Security: Attacking and Defending K8s Clusters
11mLets secure our Kubernetes cluster
38mKubernetes Security: Attacking and Defending K8s Clusters
32mContainer Security: Exploits, Vulnerabilities and Defense
49mAttacking and Detecting Attacks on Kubernetes Clusters
28mHow We Stopped a Crypto-mining Attack in Kubernetes Caused...