Beyond Kubernetes Security
Talkat KubeCon + CloudNativeCon North America 2021 · on Friday, 2021-10-15· at 11:55· Petree Hall C + Online·
summary
A staged red team vs blue demo shows multiple attack paths and which actually succeed: local kernel exploit needs CAP_NET_ADMIN and is blocked by setcomp default and restricted user namespaces, direct CI commit tampering fails when mandatory commit signing is enforced, image overwrite via docker tag/push trips an admission webhook and image signature validation (sigstore/tough style) and is rejected, while a creative time‑rollback into 1997 lets an attacker modify legacy code and trigger the kill switch for two minutes.
AI-written summary · about
chapters (22)
- 0:00Intro
- 1:40Tabitha
- 4:47Tabitha Sable
- 17:30Set Comp Default
- 18:45Finding a different vulnerability
- 19:42What can you do
- 20:13Old times
- 21:50Open SSH 23
- 22:37Open SSH 22
- 25:17Testing
- 25:57zag spike
- 26:22who are these people
- 26:48mailcat
- 27:43mandatory commit signing
- 28:39hijacking the images
- 29:41congratulations
- 29:57devopsy
- 35:22Transformation
- 36:54Math
- 37:35Call me
- 38:30Im ready
- 41:22Wrap up
related talks
22mSecurity Showdown: The Overconfident Operator Vs the Nefarious...
26mHacking into Kubernetes Security for Beginners
38mA Treasure Map of Hacking (and Defending) Kubernetes
19mHacking Kubernetes
32mKubernetes Attack and Defense: Inception-Style
35mKubernetes Security - Challenge and Opportunity?
32mKubeCapture: A Live Hacking Showcase on Kubernetes Security
46mThe Hacker's Guide to Kubernetes