The Path Less Traveled: Abusing Kubernetes Defaults
Talkat Cloud Native Security Day 2019 · on Monday, 2019-11-18· at 09:20· Marriott Marquis San Diego Marina - San Diego Ballroom A, 333 W Harbor Dr·
summary
Default kubeadm clusters expose real, actionable attack paths: deploy a pod that mounts hostPath & /var/run/docker.sock to control the host Docker daemon; pull etcd TLS files from a pod on the control plane to steal a clusterrole aggregation controller token with wildcard permissions and take over the cluster; create a pod with hostPID + privileged -> nsenter root to escape to the node. Mitigations: enable admission control / PodSecurityPolicies, restrict hostPath, encrypt etcd at rest, and be aware static pods bypass admission control.
AI-written summary · about
chapters (32)
- 0:00Intro
- 0:10Agenda
- 0:20Introductions
- 0:56Check your assumptions
- 1:30Kubernetes defaults
- 3:07What is Kubernetes
- 3:35Whats going on
- 4:57Cluster Roll Aggregation Controller
- 5:30Enumerating Kubernetes Permissions
- 6:04Kubernetes wildcard access
- 6:36Debugging
- 6:57Summary
- 8:10Host Path
- 8:53Doctor
- 9:31Dr Socket
- 10:14Dr Socket Example
- 13:47Docker is a Terrible Idea
- 14:03What Can I Take Away
- 14:49Container Orchestrator Attacks
- 15:31Containers Are Linux Primitives
- 17:04Container Diagram
- 17:19Process Isolation
- 17:52Demonstration
- 18:14AXE Center
- 20:17AXE Center as an attacker
- 22:22What are we taking away
- 22:56Can we fix this
- 24:30Static Pods
- 25:25Securing Kubernetes
- 25:39Kubernetes is complex
- 26:21We need your help
- 27:19Conclusion
related talks
48mThe Path Less Traveled: Abusing Kubernetes Defaults
43mKubernetes Security: Attacking and Defending Modern Infrastructure
31mA Hacker's Guide to Kubernetes and the Cloud
33mTutorial: Hack My Mis-Configured Kubernetes
27mUnsafe Defaults: Deploying Kubernetes Safer(ish)
30mSecuring^WAttacking Kubernetes
50mBeyond the Pod: Privilege Escalation in Kubernetes
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes