A Wander Through the World of Container Security
summary
Slides and live demos show concrete failures not high-level platitudes: containers are just Linux processes demonstrated via /proc and Docker exec, a Docker run with --privileged plus host mounts proves anyone with Docker rights can become root, kubectl create a privileged pod shows the same on nodes, research notes ~1.2 million public Kubernetes hosts, a demo of CVE-2022-23648 exposes kubelet key, a service IP hijack demo (CVE-2020-8554), and token examples showing non‑expiring service account JWTs versus bounded tokens.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:13About Rory
- 8:31Turning a process into a contained process
- 12:40Docker == Command Execution As A Service
- 15:07So, What is Kubernetes?
- 23:22Container Stack - A Layer Cake
- 25:34Container Breakout CVES Kubernetes Control Plane
- 27:56Kubernetes Networking Fun
- 28:43Cluster nodes are routers
- 32:57CVE-2020-8554 - Attack of the services
- 37:30The Future for network attacks
- 39:42Kubernetes - Where's my users?
- 46:30RBAC - The restless verbs
- 46:53Conclusion
related talks
57mWhat vulnerabilities? Live hacking of containers and orchestrators
30mSecuring^WAttacking Kubernetes
50mBeyond the Pod: Privilege Escalation in Kubernetes
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
40mHacking and Hardening Kubernetes Clusters by Example [I]
38mEverything you don't want to know about privileged containers
38mA Treasure Map of Hacking (and Defending) Kubernetes
45mThe Hacker’s Guide to Kubernetes