CAP_NET_RAW And ARP Spoofing in Your Cluster: It's Going Downhill From Here
Talkat KubeCon + CloudNativeCon North America 2019 · on Tuesday, 2019-11-19· at 11:50· Room 11AB - San Diego Convention Center, Upper Level·
summary
A demonstration shows a compromised pod using CAP_NET_RAW to open raw sockets and perform ARP spoofing on the node’s bridge to hijack CoreDNS lookups, redirecting traffic from a victim pod to a fake backend (demo uses one CoreDNS instance, three pods, and a Python exploit repo). Mitigations that actually stop it are dropping the capability via pod securityContext or PSP, using a layer‑3 CNI like Calico, or running DNS over TLS; detection includes kube-hunter tests and an eBPF tracer (Tracy) used in the demo.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:21Demo
- 9:30Pod Networking
- 14:10DNS
- 15:42Preventing CAPNETRAW
- 19:00Pod Security Policy
- 19:22Gatekeeper
- 20:39Network Layer
- 20:52Layer 3 Plugins
- 22:37TLS Configuration
- 23:06Summary
- 23:39Cube Hunter
related talks
40mAttacking Kubernetes Clusters Through Your Network Plumbing
49mAttacking and Detecting Attacks on Kubernetes Clusters
33mThree Surprising K8s Networking “Features” and How to Defend Against Them
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
50mBeyond the Pod: Privilege Escalation in Kubernetes
55mThe Hacker's Guide to Kubernetes
32mKubernetes Attack and Defense: Inception-Style
19mHacking Kubernetes