Live Hacking Cloud Architectures
summary
Live attack scans public DNS, brute forces a Jenkins instance and extracts a stolen Google service account JSON, uses gcloud to enumerate two GKE clusters and download database backups. On a test namespace the attacker successfully injects a sidecar to capture TCP traffic; on production eBPF-based defenses (Tetragon/Cilium, with Falco-style detection) detect the injection and kill the process before exfiltration. Demos use Metasploit, kubectl, octant and standard CI credentials abuse; result: test compromised, prod stopped.
AI-written summary · about
chapters (14)
- 0:00Cloud security threats
- 4:03Cloud data breaches
- 5:32Attack on Never Victim Consult
- 13:01Jenkins brute force access
- 17:54Google Cloud credentials stolen
- 19:51Kubernetes sidecar attack
- 23:04Red team attack summary
- 24:54Security team response
- 25:37Tetragon runtime security
- 27:48Block brute force with logs
- 30:22Prevent sidecar injection
- 31:51Attack on production
- 32:13Observability defense
- 32:35Q&A
related talks
45mLive Hacking Cloud Architectures
45mLive Hacking Cloud Architectures
33mLive Hacking Cloud Architectures - Thorsten Jakoby and Mirna Alaisami
19mHacking Kubernetes
49mAttacking and Detecting Attacks on Kubernetes Clusters
45mThe Hacker’s Guide to Kubernetes
55mThe Hacker's Guide to Kubernetes
20mUncovering a Sophisticated Kubernetes Attack in Real-Time