Tutorial: Attacking and Defending Kube...
summary
Hands-on lab shows a real GKE cluster compromise: an exposed dashboard web shell gives a foothold, kubectl and curl enumerate the environment, then nsenter breakout and host access retrieve kubelet credentials to expose the API and run a Bitcoin Arrow miner (deployment and Docker-run). Defenses demonstrate Falco alerts surfacing privileged-container and shell activity and applying OPA Gatekeeper policies to deny privileged pods and unapproved registries. Bonus CTF covers chroot/node forensics, extracting Helm/Tiller configmaps and using dive to inspect a backdoor image.
AI-written summary · about
chapters (30)
- 0:00Introduction
- 5:15Cloud Shell Setup
- 9:20Attack Scenario 1
- 14:53Commands
- 17:53Get Version
- 18:33API Server
- 18:48CubeControl
- 19:28Test Permissions
- 21:08Bitcoin Mining Deployment
- 23:18Life of a sysadmin
- 24:03Switching gears
- 24:28Coop control
- 25:08Coop top
- 27:28Stress ng
- 29:03Get Pods
- 29:33Stackdriver Filter
- 30:33Default Service Account
- 31:08Recent Attack
- 32:03Deployment
- 32:48Logs
- 33:43Falco Rules
- 34:23Dark Red
- 37:28User Dashboard
- 38:28Getting Lucky
- 39:18InfoSec Twitter
- 41:58Exploring Kube
- 42:48Running the Miner
- 49:48Basic Checks
- 51:08Falco
- 52:38Alpine
related talks
01h 37mLines of Defence – Securing Your Kubernetes Clusters
38mKubernetes Security: Attacking and Defending K8s Clusters
29mKubernetes Security: Attacking and Defending K8s Clusters
38mA Treasure Map of Hacking (and Defending) Kubernetes
49mAttacking and Detecting Attacks on Kubernetes Clusters
01h 07mTutorial: Bullet-Proof Kubernetes: Learn by Hacking
45mThe Hacker’s Guide to Kubernetes
43mKubernetes Security: Attacking and Defending Modern Infrastructure