How Attackers Use Exposed Prometheus Server to Exploit...
summary
Exposed Prometheus servers let attackers enumerate cloud provider, AZ, VPC, node MACs, kernel versions, container image names/tags and registries, ingress→service→pod mappings, and secret annotations that sometimes contain full secret payloads; these facts let attackers pick exploits or craft supply‑chain attacks. Demonstrated techniques include PromQL scraping, using ksm and node_exporter labels, prometheus_exporter metrics leak node and pod metadata, and common tools like sqlmap or image spamming for supply‑chain compromise. Note that prometheus_engine_query_log_enable = 0 hides reconnaissance and three real scenarios—data exfiltration, cryptomining, ransomware pivoting—are shown.
AI-written summary · about
chapters (5)
- 0:00Start
- 1:25Disclaimer
- 2:03Why Someone Likes To Do Coronary Fingerprinting
- 19:39Ransomware
- 20:40Summary
related talks
49mAttacking and Detecting Attacks on Kubernetes Clusters
38mKubernetes Security: Attacking and Defending K8s Clusters
28mWhere Are All of the Container Breaches?
50mInsights into New Supply Chain and Cloud-Identity Attacks
29mKubernetes Exposed: One Yaml Away from Disaster
50mThe Anatomy of Cloud Attacks
29mKubernetes Security: Attacking and Defending K8s Clusters
57mWhat vulnerabilities? Live hacking of containers and orchestrators