Attacking Kubernetes Clusters Through Your Network Plumbing
summary
Demonstrates concrete attacks: ARP/MAC spoofing via flannel lets a compromised pod intercept DNS replies despite kube‑proxy DNAT; dropping NET_RAW or strict iptables reduces risk but VXLAN‑encapsulated payload on UDP 8472 lets a non‑RAW pod craft an outer packet so the overlay unwraps an inner spoofed packet and bypasses those controls. On layer‑3, BGP Graceful Restart RFC exploitation enables persistent Calico route injection to steer cluster traffic through an attacker. Fixes: drop NET_RAW, block pod‑sent encapsulation, harden routing daemons (auth, upgrades — Calico fixed in 3.17).
AI-written summary · about
chapters (6)
- 0:00Start
- 5:32Layer 2 Network Plugins
- 12:16Using the Overlay Network to overcome Obstacles
- 21:55Routing Daemons
- 22:25BGP Hijacking
- 23:57BGP RFC Security Issue
related talks
33mCAP_NET_RAW And ARP Spoofing in Your Cluster: It's Going Downhill From Here
33mThree Surprising K8s Networking “Features” and How to Defend Against Them
49mAttacking and Detecting Attacks on Kubernetes Clusters
51mHow Kubernetes Networking Really Works: A Packet’s Journey Across Pods and Nodes
55mThe Hacker's Guide to Kubernetes
32mUnderstand and Troubleshoot the “Magic” of Kubernetes Networking - Minhan Xia & Rohit Ramkumar
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
19mHacking Kubernetes