Attacking and Defending Kubernetes
83Many companies have deployed Kubernetes, but few infosec folks have experience attacking it. We aim to address that shortage, culminating in an audience-directed Choose Your Own Adventure, movie-themed demo against an intentionally-vulnerable cluster named Bust-a-Kube. You'll see how to attack Kubernetes clusters and learn what hardening techniques and freely available tools can break those attacks. We'll review the components of a Kubernetes cluster, then show how a threat actor can chain configuration vulnerabilities to pivot and escalate privilege, pilfer data and take over clusters. You will also gain exposure to a new open source Kubernetes attack tool called Peirates.
EVENT:
Def Con 27 - 2019
SPEAKER:
Jay Beale
PUBLICATION PERMISSIONS:
Original video was published with the Creative Commons Attribution license (reuse allowed)
ATTRIBUTION CREDITS:
Original video source: https://www.youtube.com/watch?v=2fmAuR3rnBo