Kubernetes Exposed: One Yaml Away from Disaster
summary
Evidence shows 1.1 million clusters are reachable from the internet and a three‑month scan links misconfigurations to 350 impacted companies across sectors. Two simple YAML mistakes dominate: anonymousAuth=true on API servers lets system:anonymous reach authorization checks, and running kubectl proxy with address=0.0.0.0 plus accept‑host exposes developers’ workstation credentials. Real outcomes include listing pods, reading secrets, retrieving AWS keys, GitLab repos and DB dumps; attackers deploy daemonsets (SSWW, Arabic Buster) for persistence and crypto miners. Detections use qbender, Aqua Trivy and Tracy (eBPF); remediation requires network restrictions, admission controls and full key rotation.
AI-written summary · about
chapters (19)
- 0:00Kubernetes security research intro
- 1:05Kubernetes attack surface
- 2:28Why Kubernetes is targeted
- 4:18API server vulnerabilities
- 5:44One YAML away disaster
- 6:05Anonymous authentication flaw
- 8:53Exposed kubectl proxy risk
- 11:19Real-world impact findings
- 13:46MiniCube cluster compromise
- 14:31Large cluster exposure risks
- 16:01Honeypot attacker behaviors
- 17:50SSWW crypto mining campaign
- 20:00Arabic Buster malicious roles
- 22:30Attacker evasion tactics
- 23:11Malware detection challenge
- 24:55Detecting Kubernetes threats
- 25:17Kubernetes security tools
- 27:27Defense in depth strategies
- 28:10Summary and mitigation
related talks
35mInsights into Unsecured Kubernetes in the Wild
33mTutorial: Hack My Mis-Configured Kubernetes
49mCluster Wrangling: How to make Kubernetes clusters secure and usable
27mWhat Doesn’t Kill You Makes You Stronger: The Vulnerabilities Th...
31mA Hacker's Guide to Kubernetes and the Cloud
29mKubernetes Exposed! Seven of Nine Hidden Secrets That Will Give You Pause
33mKubernetes Security: Horror Stories to Help Secure Your Cluster
49mAttacking and Detecting Attacks on Kubernetes Clusters