The Art of Hiding Yourself
summary
Demonstrates a working hide-and-persist technique: an init container drops an LD_PRELOAD library into the host via /proc/<pid>/root and overrides libc directory reads to filter a ping process; a controller repeatedly deletes the pod key from etcd so kubectl get pods never shows it while the container runs; persistence comes from running a pod that respawns itself. Demo hides ping to Cloudflare (1.1.1.1) from ps/top yet Falco catches writes to /etc/ld.so.preload and API/audit activity, proving detection and mitigation paths.
AI-written summary · about
chapters (13)
- 0:00Start
- 0:10Lorenzo Fontana
- 0:22We always think about closing the door
- 2:13It gets worse, of course
- 3:07Detection Evasion 101: How?
- 4:42Environment Awareness: Linux
- 5:23Let's start... but first some assumptions
- 9:05Hiding Network Activity • The same technique as for Hiding Processes can be used for things
- 10:02Hiding files
- 11:08Environment Awareness: Kubernetes
- 11:31Kubernetes: Hiding pods and their processes • We can reuse the process hiding technique for hiding processes
- 12:24Mitigations
- 13:15Detecting Detection Evasion
related talks
26mThe Hitchhikers Guide to Container Security
28mFileless Attack - Detecting the Undetectable
55mThe Hacker's Guide to Kubernetes
28mClosing the Loop: Applying Least Privilege and Ensuring We Did It Well
50mThe Hacker’s Guide to Kubernetes Reloaded
14mOrchestrate This! Kubernetes Rootkit
17mPod-to-Pod Ping: The Hidden Wiring of Kubernetes
35mThe Art of Debugging Inside K8s Environment