What vulnerabilities? Live hacking of containers and orchestrators
summary
Live demos exploit a real PHP CVE to get a webshell, pivot from container to a cloud jump box, download tooling with Python, and then steal a Kubernetes service-account token and mount /var/run/docker.sock to enumerate containers. Using docker client, curl to the API, kube-hunter and kube-bench checks, and image scanning advice (Microscanner/Aqua), the chain escalates to root on a worker node and adding an SSH key — the Hail‑Mary demo succeeds despite minor connectivity hiccups.
AI-written summary · about
chapters (53)
- 0:00Intro
- 2:19MENTAL HEALTH
- 3:21COMMUNITY
- 3:50CLIMATE CHANGE
- 4:32NOT A SECURITY EXPERT
- 5:47KUBERNETES DASHBOARD
- 6:33POP QUIZ
- 7:22FIRST REACTION
- 7:50LETS GET STARTED
- 11:39LETS REVIEW
- 11:53HAS ANYONE KNOWINGLY CREATED A VULNERABILITY
- 12:22OWASP
- 12:36WHAT IS A VULNERABILITY?
- 13:15JUMP INTO THE BOX
- 16:55IMAGE SCANNING
- 17:23STATIC TOKENS AND PASSWORDS
- 18:46TIP: SCHEDULED BUILDS
- 19:40FOCUS ON CI/CD
- 19:57DON'T SSH TO PATCH
- 20:19REDUCE THE ATTACK VECTOR
- 21:11PRIVATE CONTAINER REGISTRIES
- 22:12PULL LATEST
- 22:24IMAGE TRUST AND SUPPLY CHAIN
- 23:30ESCAPE THE CONTAINER
- 28:08RUNNING CONTAINERS ON KUBERNETES
- 28:47WHAT COULD POSSIBLY GO WRONG?
- 29:12ELEVATE PRIVILEGES INSIDE KUBERNETES TO ACCESS ALL WORKLOADS
- 29:34POTENTIALLY GAIN ROOT ACCESS TO THE KUBERNETES WORKER NODES
- 29:51PERFORM LATERAL NETWORK MOVEMENT OUTSIDE THE CLUSTER
- 31:12FEATURE DRIVEN
- 31:45SECURITY FOLLOWS
- 32:12REDUCE HOST MOUNTS
- 32:41DON'T USE ROOT
- 33:12USER COMMAND IN DOCKERFILE
- 33:36ROLE ASSIGNMENT
- 33:50PERMISSION AUTHORISATION
- 34:22CONTROL PLANE
- 34:37ADMISSION CONTROLLER
- 35:01ALWAYSPULLIMAGES
- 35:11DENYESCALATINGEXEC
- 35:22PODSECURITYPOLICY
- 35:56LIMITRANGE RESOURCEQUOTA
- 36:18CAN WE SEE WHATS RUNNING
- 42:42NAMESPACE
- 43:03NETWORKPOLICIES
- 43:54PASSING SECRETS TO CONTAINERS
- 44:04TOOLS
- 44:41HAIL MARY
- 53:28RUNTIMES
- 53:53SERVICE MESHES
- 54:08RELEASE OFTEN / FAST
- 55:04CHAOS ENGINEERING
- 55:24SECURITY UPDATES
related talks
37mSecuring Containers by Breaking In
19mHacking Kubernetes
45mThe Hacker’s Guide to Kubernetes
01h 01mHow hacking works - Web edition
38mA Treasure Map of Hacking (and Defending) Kubernetes
52mA Wander Through the World of Container Security
32mKubeCapture: A Live Hacking Showcase on Kubernetes Security
47mSecuring Containers By Breaking In