Codemotion Milan 2023

1. Patrycja Wegrzynowicz
The Hacker’s Guide to Kubernetes:
Reloaded
Lead Engineer, Form3
@yonlabs

2. Hello! !
• 20+ professional experience
software engineer, architect, researcher, head of R&D
• Author and speaker
JavaOne, CodeOne, Devoxx, JFokus, JavaZone, and more
• Top 10 Women in Tech in Poland
• Oracle Groundbreaker Ambassador, Oracle ACE
• Form3, Financial Cloud
Lead SRE Engineer
• Founder at Yon Labs
Automated tools for detection and refactoring of software defects.
Performance, security, concurrency.
Intro to Patrycja

3. Form3, Financial Cloud
Business Model
• Provides a payment platform for financial institution
• Integrates across multiple payment schemes
• Makes integration easier and quicker
Work Model
• Fully remote
• Pair programming
• Only senior engineers
Technology
• Multi-cloud platform: AWS, GCP, Azure
• Microservices: (mostly) Go and (little) Java
• Infrastructure as Code: Terraform
Why is Security Important?

4. Introduction to Kubernetes Architecture
Introduction to OWASP Kubernetes Top 10 &
MITRE ATT&K ® Threat Matrix for Kubernetes
Demos
Summary
01
02
03
04
Agenda

5. Introduction to Kubernetes Architecture

6. Kubernetes Components
Kubernetes Architecture
Source: https://medium.com, Kubernetes - Architecture Overview by Ashish Patel

7. Kubernetes Components
Kubernetes Architecture
Source: https://medium.com, Kubernetes - Architecture Overview by Ashish Patel
CNI

8. Introduction to OWASP Kubernetes Top 10

9. OWASP Kubernetes Top 10 2022
K01 Insecure Workload Configuration
K02 Supply Chain Vulnerabilities
K03 Overly Permissive RBAC Configurations
K04 Lack of Centralized Policy Enforcement
K05 Inadequate Logging and Monitoring
K06 Broken Authentication Mechanisms
K07 Missing Network Segmentation Controls
K08 Secrets Management Failures
K09 Misconfigured Cluster Components
K10 Outdated and Vulnerable Kubernetes Components

10. MITRE ATT&K ® – Threat Matrix for Kubernetes
Source: https://www.microsoft.com/en-us/security/blog/2021/03/23/secure-
containerized-environments-with-updated-threat-matrix-for-kubernetes/

11. Demos – 101 Kubernetes hacking

12. Demo Fun Time – Overview
• Demo application
https://codemotion.yonlabs.com
(or checkout X-Twitter: https://twitter.com/yonlabs)
register a new account
each account has a secret data
log in
wait to be hacked :D
• Objective
to hack your accounts and learn your secrets
hacking 101
Let the fun begin!

13. Bad Pods: Kubernetes Pod Privilege Escalation
• https://bishopfox.com/blog/kubernetes-pod-
privilege-escalation
• By: Seth Art, Principal Security Consultant
Demos

14. Demo #1

15. Problems
• K01 Insecure Workload Configuration
root
privileged
hostPID
hostPath
hostNetwork
hostIPC
• K04 Lack of Centralized Policy Enforcement
able to create insecure workload
• K08 Secrets Management Failure
demo-secret not encrypted
Demo #1

16. Demo #2

17. Problems
• K01 Insecure Workload Configuration
root
privileged
hostPID
• K04 Lack of Centralized Policy Enforcement
able to create insecure workload
• Networking
unencrypted traffic
Demo #2

18. Summary

19. Kubernetes Security

20. Bad Pods: Kubernetes Pod Privilege Escalation
• Bad Pod #1: Everything allowed
• Bad Pod #2: Privileged and hostPid
• Bad Pod #3: Privileged only
• Bad Pod #4: hostPath only
• Bad Pod #5: hostPID only
• Bad Pod #6: hostNetwork only
• Bad Pod #7: hostIPC only
• Bad Pod #8: Nothing allowed
Source: https://bishopfox.com/blog/kubernetes-pod-privilege-escalation

21. Swiss Cheese Security Model

22. A fool with a tool is only a fool

23. Continuous Learning

24. Thank you!
@yonlabs