Kubernetes Security: Attacking and Defending K8s Clusters
summary
Demonstrates exploiting a Drupal CVE-2018-7600 RCE to get a shell in a pod, using the pod’s service account token for internal recon and then launching a privileged pod to escape and deploy crypto miners — attackers find and compromise the exposed app within 24 hours. Uses tools like CubeHunter, cubench and Falco for discovery, hardening checks and runtime detection. Shows concrete defenses: enable RBAC, API access controls and audit logs, apply network policies, use CIS Benchmarks and enable etcd encryption at rest.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 1:30What is Kubernetes
- 5:08Mitre Attack Framework
- 11:04How do you find that
- 14:13CubeHunter
- 14:44Internal Recon
- 17:17Privilege Escalation
- 19:36Defending Kubernetes
- 19:50Protect API Server
- 20:57Kubernetes Benchmark
- 21:49Cubebench
- 23:00Image Scanning
- 24:09Drift Detection
- 26:01Basic Security
- 27:56Linux Kernel Security
- 28:15Pod Security Policy
- 29:12Alternatives
- 30:19Roadbased Access Control
- 31:31Row Binding
- 32:12XD
- 33:03LCD
- 33:50Network Policy
- 34:33Network Interface
- 35:09Audit Logs
- 36:06Final Thoughts
related talks
38mKubernetes Security: Attacking and Defending K8s Clusters
29mKubernetes Security: Attacking and Defending K8s Clusters
49mAttacking and Detecting Attacks on Kubernetes Clusters
43mKubernetes Security: Attacking and Defending Modern Infrastructure
01h 24mTutorial: Attacking and Defending Kube...
45mThe Hacker’s Guide to Kubernetes
35mKubernetes Security - Challenge and Opportunity?
30mSecuring^WAttacking Kubernetes