How We Stopped a Crypto-mining Attack in Kubernetes Caused...
summary
A publicly disclosed Next.js RCE is shown escalating into cluster compromise by spawning a crypto‑mining process inside a pod; the demo deploys a vulnerable app, sends a crafted POST payload that drops an executable and spawns a shell, and causes a measurable CPU spike. Detection uses Falco rules (exec and file drop hits), automated response via Falco Talon to label or kill pods, and policy enforcement with Kyverno plus syscap capture for post‑incident forensics.
AI-written summary · about
chapters (18)
- 0:00Kubernetes security threats
- 1:05Crypto-mining attack importance
- 2:32Shell vulnerability explained
- 3:59Demo and attack simulation
- 6:10Deploying vulnerable app
- 7:25Simulating crypto-mining attack
- 9:10Detecting attack with Falco
- 10:36Falco rules and alerts
- 12:44Automated response with Taloon
- 14:31Forensic analysis with syscalls
- 17:19Architecture and performance
- 18:21Hardening Kubernetes
- 19:25Key learnings
- 21:10Best practices
- 22:57Security-first cloud-native
- 24:03Falco response engine underused
- 25:06Runtime detection tools
- 26:31Q&A
related talks
38mKubernetes Security: Attacking and Defending K8s Clusters
38mKubernetes Security: Attacking and Defending K8s Clusters
29mKubernetes Security: Attacking and Defending K8s Clusters
31mPrepare to Be Boarded! A Tale of Kubernetes, Plunder, and Cryptobooty
49mAttacking and Detecting Attacks on Kubernetes Clusters
01h 24mTutorial: Attacking and Defending Kube...
28mKubernetes Runtime Security: What Happens if a Container Goes Bad?
38mMy Kubernetes Mines Bitcoins!