From the Cluster to the Cloud: Lateral Movements in Kubernetes
summary
Shows concrete exploit paths and fixes: Kubernetes RBAC that lets a pod update its own Deployment can spawn privileged pods with nodeSelectors to seize node identities, secrets creation or token-creation APIs let attackers steal service account tokens, and IMDS access (e.g. IMDS) or legacy node-stored SPN files give cloud creds. Demonstrates AAD Pod Identity/NMI interception and OIDC federation into cloud identities, highlights GKE default editor role risk, and validates detection with Kubernetes audit log plus cloud audit services and the Microsoft threat matrix v3 mitigations.
AI-written summary · about
chapters (8)
- 0:00Start
- 0:11Agenda
- 0:33Identity types in Kubernetes
- 3:22Inner-cluster lateral movement
- 9:40Cluster-to-cloud lateral movement
- 28:11Detections & mitigations
- 31:25Threat Matrix for Kubernetes
- 33:47Key takeaways
related talks
46mLateral Movements in Kubernetes
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
33mSecuring Kubernetes in the Cloud
37mKubernetes to Cloud Attack Vectors: Demos Inside
13mBreaching the sky’s limit on your cloud: privilege escalation in Kubernetes
43mKubernetes Security: Attacking and Defending Modern Infrastructure
28m"PIVOT!" — Bouncing between your app, your cluster and your cloud
53mFlying Above the Clouds: Securing Kubernetes