A Hacker's Guide to Kubernetes and the Cloud
summary
Attack paths and fixes framed from an attacker’s view: unauthenticated etcd and kubelet access lets an attacker download cluster secrets (the presenter finds 1874 exposed etcd servers), service-account tokens mounted in every pod yield immediate kubectl/RBAC escalation, and cloud compromise via the instance metadata endpoint (169.254.169.254 metadata abuse) enables spinning up resources. Demonstrations use curl/sed against the API and etcd, and recommendations include disabling insecure ports, locking kubelets, restricting tokens, enabling RBAC/PodSecurityPolicy and network policy, and regular upgrades (turn defaults into hardened config).
AI-written summary · about
chapters (20)
- 0:00A Hackers Guide To Kubernetes and the cloud
- 1:24ABOUT ME
- 10:19CLOUDY CLUSTERS
- 13:05External Attackers
- 13:52ATTACKING THE API SERVER
- 18:31ATTACKING THE KUBELET
- 20:18Malicious Contain
- 20:52INCREASED ATTACK SURFACE
- 21:35ATTACKING SERVICE ACCOUNT TOKENS
- 22:30LEVERAGING ACCESS IN THE CLOUD
- 23:45THE IMPORTANCE OF SECURE DEFAULTS!
- 25:17INSECURE PORT
- 25:27CONTROL ACCESS TO THE KUBELET
- 25:51CONTROL ACCESS TO ETCD
- 26:02RESTRICT SERVICE TOKEN USE
- 26:325. RESTRICT PRIVILEGED CONTAINERS
- 28:56HONOURABLE MENTION- CLOUD RIGHTS
- 29:15RESOURCES
- 29:54CONCLUSION
- 30:45QUESTIONS
related talks
45mThe Hacker’s Guide to Kubernetes
40mHacking and Hardening Kubernetes Clusters by Example [I]
43mKubernetes Security: Attacking and Defending Modern Infrastructure
50mThe Hacker’s Guide to Kubernetes Reloaded
46mThe Hacker's Guide to Kubernetes
29mKubernetes Security: Attacking and Defending K8s Clusters
19mKeynote: Hello From the Other Side: Dispatches From a Kubernetes Attacker
54mThe Hacker’s Guide to Kubernetes