Hacking Kubernetes
summary
Covers concrete attack chains: a malicious npm package using npm preinstall hooks to exfiltrate SSH and kubeconfig, automated CI/CD deployments that create a reverse shell, container escapes using nsenter container breakout or kernel bugs like dirty pipe kernel exploit to root the host, and harvesting service account secrets from the kubelet to pivot into cloud accounts. Defenses demonstrated include outbound firewall monitoring, intrusion detection, and deployment of Canary tokens and honeypots to detect stolen credentials early.
AI-written summary · about
chapters (8)
- 0:00Kubernetes security intro
- 1:04Threat models and attackers
- 4:33Supply chain attacks
- 8:24Reverse shells & C2
- 10:10Container breakout
- 13:44Kubelet secrets & host
- 15:48Cloud account takeover
- 17:37Intrusion detection & hardening
related talks
38mA Treasure Map of Hacking (and Defending) Kubernetes
49mAttacking and Detecting Attacks on Kubernetes Clusters
45mThe Hacker’s Guide to Kubernetes
40mHacking and Hardening Kubernetes Clusters by Example [I]
46mThe Hacker's Guide to Kubernetes
43mKubernetes Security: Attacking and Defending Modern Infrastructure
29mKubernetes Security: Attacking and Defending K8s Clusters
50mThe Hacker’s Guide to Kubernetes Reloaded