Live Hacking Cloud Architectures
Talkat JCON Europe 2023 · on Tuesday, 2023-06-20· at 13:00· Cinema 5, Im Mediapark 1, 50670 Köln, Germany·
summary
Live attack shows DNS brute forcing and Metasploit-driven HTTP enumeration to find a Jenkins instance, then a rockyou subset brute force yields a working Jenkins login. The Jenkins script console decrypts an encrypted string revealing a GCP service account JSON, gcloud auth imports it, lists two Kubernetes clusters and extracts kubeconfig. A sidecar TCP proxy is injected to capture traffic and exfiltrate data on test, but on prod Tetragon kills sidecar so the injection fails.
AI-written summary · about
chapters (10)
- 0:00Introduction to cloud risks
- 3:13DNS enumeration attack
- 6:28Brute forcing Jenkins login
- 16:38Extracting cloud credentials
- 24:22Gaining cloud access
- 27:06Exploring Kubernetes cluster
- 30:37Data exfiltration via sidecar
- 33:29Detecting and mitigating attacks
- 37:57Security tooling recommendations
- 44:52Q&A and closing
