Walls Within Walls: What if Your Attacker Knows Parkour?
Talkat KubeCon + CloudNativeCon North America 2019 · on Tuesday, 2019-11-19· at 15:20· Room 6F - San Diego Convention Center, Upper Level·
summary
A live exploit shows a compromised node using kubelet credentials to talk to the API then delete and recreate its node object to add a payments label and remove taints, create a mirror static pod, patch its ready timestamp and add a label so the payments ReplicaSet adopts it, then delete the real pod so the payment pod reschedules onto the attacker node and reads the secret; the demo succeeds often (roughly >50% per run) and SIG‑Auth hardening later narrows but does not eliminate these paths.
AI-written summary · about
chapters (9)
- 0:00Introduction to node security
- 1:04Limits of container security
- 5:06Node isolation strategies
- 8:27Attacking the node setup
- 13:08Escalating privileges via pods
- 19:41Fixes and limitations
- 21:04Pod-based security models
- 25:12Best practices and conclusions
- 27:22Question and answer session
related talks
38mShipping in Pirate-Infested Waters: Practical Attack and Defense in Kubernetes [A]
32mKubernetes Attack and Defense: Inception-Style
49mAttacking and Detecting Attacks on Kubernetes Clusters
19mHacking Kubernetes
50mBeyond the Pod: Privilege Escalation in Kubernetes
45mThe Hacker’s Guide to Kubernetes
30mSecuring^WAttacking Kubernetes
29mKubernetes Security: Attacking and Defending K8s Clusters