Orchestrate This! Kubernetes Rootkit
summary
A container-focused rootkit called Cube kit is built as a loadable kernel module plus a user-space JSON handler that hides pods across the control plane and removes containers from Docker management by break-pointing and editing API responses; it conceals files, processes and a virtual device and can cleanly remove itself at runtime while the cluster stays running. Demonstrations show it works against Docker and Kubernetes API servers; detection guidance points to Falco/response tooling and avoiding privileged containers.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:50Overview
- 1:00What is a Rootkit
- 2:23What is Kubernetes
- 3:26Our Rootkit
- 4:12Kubernetes Modes
- 4:47Kubernetes API
- 5:52Docker
- 7:28Kubernetes
- 8:31Demo
- 10:45Unload Rootkit
- 11:10Prevention
- 12:20Example
related talks
32mKubernetes Attack and Defense: Inception-Style
38mEverything you don't want to know about privileged containers
20mUncovering a Sophisticated Kubernetes Attack in Real-Time
01h 24mTutorial: Attacking and Defending Kube...
14mcontainerd: Rootless Containers 2020
32mKubeCapture: A Live Hacking Showcase on Kubernetes Security
19mHacking Kubernetes
38mA Treasure Map of Hacking (and Defending) Kubernetes