CSI Forensics: Unraveling Kubernetes Crime Scenes
summary
Automatic checkpointing captures an ephemeral compromise within seconds and preserves enough state to do real DFIR: Kubernetes checkpoint (v1.25+; beta v1.30) triggers a criu-made tar that includes the rootfs deltas and memory pages, Falco + Falco-sidekick + Argo automate checkpoint creation and pod termination, and a buildup->registry->staging restore recreates the container. The demo restores an IRC bot connection with the same identifier, proving dynamic analysis works, but limitations remain: works reliably on crio only and cross-runtime metadata issues make it immature for broad production use.
AI-written summary · about
chapters (8)
- 0:00CSI Forensics intro
- 3:55Digital Forensics and Incident Response Basics
- 8:33Forensics in ephemeral containers
- 13:31Live demo setup
- 18:28Static analysis of containers
- 25:17Dynamic analysis and restore
- 31:23Key takeaways
- 34:15References
related talks
29mContainer Forensics for Kubernetes: Building an Evidence Pipeline With Open Source…
31mDigital Forensics with Container Checkpointing- 31mDigital Forensics with Container Checkpointing
39mCSI Container: Can You DFIR It?
33mFreeze,Investigate,Recover: Unlocking Forensic Container Checkpoint...
34mContainer Forensics: What to Do When Your Cluster is a Cluster
32mKubeCapture: A Live Hacking Showcase on Kubernetes Security
20mUncovering a Sophisticated Kubernetes Attack in Real-Time