Insights into Unsecured Kubernetes in the Wild
Talkat KubeCon + CloudNativeCon North America 2021 · on Thursday, 2021-10-14· at 11:00· Petree Hall C + Online·
summary
Internet scans and honeypot logging find 2,100 unsecured clusters (about 5,300 nodes, 31,340 CPUs, 75,270 pods) leaking secrets and images; attackers deploy crypto‑miners and a kubelet‑targeting worm named Hildegard that harvests service tokens, steals cloud creds, moves laterally and uses LD_PRELOAD evasion plus encrypted ELF payloads. Misconfigurations include exposed kubelet/local API ports and overly permissive RBAC. Fix by closing public control ports, enforce least privilege, patch frequently, use managed control planes, design ephemeral workloads and run continuous config and behavior monitoring.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 4:15About Graboid
- 13:07Research Methods
- 20:42Reactive Research
- 28:42Conclusion
- 28:59How can we protect ourselves
- 30:16Best practices
- 30:38Layer of defense
- 31:36Community Services
- 32:42ephemeral workload design
- 34:20Outro
related talks
38mKubernetes Security: Attacking and Defending K8s Clusters
29mKubernetes Security: Attacking and Defending K8s Clusters
33mKubernetes Security: Horror Stories to Help Secure Your Cluster
38mKubernetes Security: Attacking and Defending K8s Clusters
31mPrepare to Be Boarded! A Tale of Kubernetes, Plunder, and Cryptobooty
11mLets secure our Kubernetes cluster
58mTop Secret Cloud Native Security Lessons
43mKubernetes Security: Attacking and Defending Modern Infrastructure