SlideShare a Scribd company logo
Letting Hackers
Into Your
Kubernetes Cluster
Muhammad Yuga Nugraha
Sr. DevSecOps Engineer
AT Practical DevSecOps
KUBERNETES COMMUNITY DAYS INDONESIA 2024 2
• YAML engineer
• Infrastructure engineer focused on product security (mostly cloud)
• Co-author of product security certifications (CDP, CCSE, CCNSE, CSSE)
• Speaker at: PyCon APAC 2024, AWS Community Day Indonesia 2024
• CCSKv4, eJPT, CKA & CKS (has already expired 😆 )
Who Am I?
KUBERNETES COMMUNITY DAYS INDONESIA 2024 3
Agenda
Introduction
How to Get Hacked
Demo
Lessons Learned
KUBERNETES COMMUNITY DAYS INDONESIA 2024
Introduction
Discover the fundamentals of the Cloud
Native ecosystem
4
KUBERNETES COMMUNITY DAYS INDONESIA 2024 5
“An approach to building applications using cloud-based models”
“An approach that uses technologies such as containers,
Kubernetes, immutable infrastructure, and microservices to develop
scalable applications”
What is Cloud Native
KUBERNETES COMMUNITY DAYS INDONESIA 2024 6
30
Do we need to remember the entire Cloud
Native technology stack?
KUBERNETES COMMUNITY DAYS INDONESIA 2024 7
KUBERNETES COMMUNITY DAYS INDONESIA 2024 8
Kubernetes is the one and only platform we love
KUBERNETES COMMUNITY DAYS INDONESIA 2024
Kubernetes Architecture
9
KUBERNETES COMMUNITY DAYS INDONESIA 2024
Managed Kubernetes
10
KUBERNETES COMMUNITY DAYS INDONESIA 2024
Google Kubernetes Engine
11
KUBERNETES COMMUNITY DAYS INDONESIA 2024
DigitalOcean
12
KUBERNETES COMMUNITY DAYS INDONESIA 2024
Self-Managed Kubernetes
13
KUBERNETES COMMUNITY DAYS INDONESIA 2024
kubeadm
14
KUBERNETES COMMUNITY DAYS INDONESIA 2024
Kubernetes-free???
15
KUBERNETES COMMUNITY DAYS INDONESIA 2024 16
30
Which one do you think is better?
KUBERNETES COMMUNITY DAYS INDONESIA 2024
The 4C’s of Kubernetes Security
17
KUBERNETES COMMUNITY DAYS INDONESIA 2024
It always starts with the application/code
18
KUBERNETES COMMUNITY DAYS INDONESIA 2024
How to Get Hacked
Make our cluster vulnerable to attacker 😈
19
KUBERNETES COMMUNITY DAYS INDONESIA 2024
Didn’t {care} about security
20
KUBERNETES COMMUNITY DAYS INDONESIA 2024
In{secure} configuration by default
21
KUBERNETES COMMUNITY DAYS INDONESIA 2024 22
KUBERNETES COMMUNITY DAYS INDONESIA 2024 23
Scenario: Compromised pod
• Initial Access
• The application is vulnerable
• Execution
• The attacker gained access inside the pod
• Privilege Escalation
• Pod is running with the securityContext.privileged
mode set to true
• Pod escape to node and take over the cluster
KUBERNETES COMMUNITY DAYS INDONESIA 2024
Use un{trusted} container image
24
KUBERNETES COMMUNITY DAYS INDONESIA 2024 25
Scenario: Compromised container registry
• Initial Access
• Container registry is compromised
• Persistence
• Container image being backdoor by attacker
• Discovery
• Backdoor container performing scanning for known
vulnerabilities
KUBERNETES COMMUNITY DAYS INDONESIA 2024 26
KUBERNETES COMMUNITY DAYS INDONESIA 2024 27
KUBERNETES COMMUNITY DAYS INDONESIA 2024
Give full access to the user
28
KUBERNETES COMMUNITY DAYS INDONESIA 2024 29
👨💻 (Developer) : “I want to test something within the cluster”
👨💻 (DevOps/SRE) : “Here's your access. I've set you up with full access so
you can just play around and run your tests without bothering me”
Dilemma
KUBERNETES COMMUNITY DAYS INDONESIA 2024 30
Asterisk (*) is the way 😎
KUBERNETES COMMUNITY DAYS INDONESIA 2024 31
KUBERNETES COMMUNITY DAYS INDONESIA 2024 32
Scenario: Permissive RBAC
• Initial Access
• kubeconfig file is exposed and has cluster admin access.
• Persistence
• Privilege Escalation
• …….
• Impact
• Take over a cluster
KUBERNETES COMMUNITY DAYS INDONESIA 2024 33
Guess, what’s wrong?
KUBERNETES COMMUNITY DAYS INDONESIA 2024 34
What can pod/exec do?
• Execution
• Access into the pod
• Lateral Movement
• Use the service account to talk with Kubernetes API
• Privilege Escalation??
KUBERNETES COMMUNITY DAYS INDONESIA 2024 35
How about this?
KUBERNETES COMMUNITY DAYS INDONESIA 2024
Allow all images to be pulled
36
KUBERNETES COMMUNITY DAYS INDONESIA 2024
Do not use NetworkPolicy
37
KUBERNETES COMMUNITY DAYS INDONESIA 2024 38
KUBERNETES COMMUNITY DAYS INDONESIA 2024 39
KUBERNETES COMMUNITY DAYS INDONESIA 2024 40
Without NetworkPolicy
KUBERNETES COMMUNITY DAYS INDONESIA 2024 41
With NetworkPolicy
KUBERNETES COMMUNITY DAYS INDONESIA 2024 42
Threat Matrix for Kubernetes
KUBERNETES COMMUNITY DAYS INDONESIA 2024 43
OWASP Kubernetes Top 10
KUBERNETES COMMUNITY DAYS INDONESIA 2024
Have you heard this term before?
44
KUBERNETES COMMUNITY DAYS INDONESIA 2024 45
Advanced Persistent Threat (APT)
KUBERNETES COMMUNITY DAYS INDONESIA 2024 46
30
“Is a sophisticated, sustained cyberattack where an intruder establishes an
undetected presence in a network to steal sensitive data over a prolonged
period. In short, it's a cyberattack targeting a specific organization.”
KUBERNETES COMMUNITY DAYS INDONESIA 2024 47
KUBERNETES COMMUNITY DAYS INDONESIA 2024
It doesn’t stop here, many more ……
48
KUBERNETES COMMUNITY DAYS INDONESIA 2024 49
Business loss 💰
Securing has become complex 😵💫
Hiring has become hard 🤦
New division? 🛡
Challenges???
KUBERNETES COMMUNITY DAYS INDONESIA 2024 50
30
“Securing a system is challenging, while making a system
vulnerable is easy”
KUBERNETES COMMUNITY DAYS INDONESIA 2024
Demo
A scenario in which an attacker can take
over the cluster 💥
51
KUBERNETES COMMUNITY DAYS INDONESIA 2024 52
NetSpy Solutions has a product named LookDNS. The team at NetSpy comprises
of 4 members- a founder, two sales and marketing personnel, and one engineer.
It’s interesting to note that it's solely this one engineer who is responsible for
building and deploying the product on Kubernetes. Named Michael, this
engineer, however, is not aware of security.
A Short Story
KUBERNETES COMMUNITY DAYS INDONESIA 2024 53
KUBERNETES COMMUNITY DAYS INDONESIA 2024 54
KUBERNETES COMMUNITY DAYS INDONESIA 2024
It’s Showtime!!! 🎬
55
KUBERNETES COMMUNITY DAYS INDONESIA 2024 56
Workflow
KUBERNETES COMMUNITY DAYS INDONESIA 2024 57
Obfuscated Shell Script
KUBERNETES COMMUNITY DAYS INDONESIA 2024 58
What does this good evil script do?
KUBERNETES COMMUNITY DAYS INDONESIA 2024 59
KUBERNETES COMMUNITY DAYS INDONESIA 2024 60
Download kubectl and configure the
context
KUBERNETES COMMUNITY DAYS INDONESIA 2024 61
Generate SSH keys
KUBERNETES COMMUNITY DAYS INDONESIA 2024 62
Create Kubernetes Job
KUBERNETES COMMUNITY DAYS INDONESIA 2024 63
Pod Naming
KUBERNETES COMMUNITY DAYS INDONESIA 2024 64
Job Naming
KUBERNETES COMMUNITY DAYS INDONESIA 2024 65
It doesn’t looks malicious 😏
KUBERNETES COMMUNITY DAYS INDONESIA 2024
Sounds legit!!!
66
KUBERNETES COMMUNITY DAYS INDONESIA 2024
Are there any differences when deploying in the
cloud?
67
KUBERNETES COMMUNITY DAYS INDONESIA 2024
Cloud Instance Metadata Attack ⚔
68
KUBERNETES COMMUNITY DAYS INDONESIA 2024
Lesson Learned
What are the key takeaways?
69
KUBERNETES COMMUNITY DAYS INDONESIA 2024 70
• Engineer must be aware of security
• Understand security framework (OWASP, NIST, etc)
• Adopt shift-left in the SDLC
• Hire a dedicated person (👮 )
• The Principle Of Least Privilege (POLP) is a must!
• Do not trust outsourced applications (always check & verify)
• Automation is the key
In General
KUBERNETES COMMUNITY DAYS INDONESIA 2024 71
• Threat Modeling
• Securing the supply chain (package)
• Runtime Security
• Security Monitoring
• Compliance
• …
Etc
KUBERNETES COMMUNITY DAYS INDONESIA 2024 72
Thanks to Cloud Native Ecosystem!
KUBERNETES COMMUNITY DAYS INDONESIA 2024 73
• Keep Hackers Out of Your Cluster with These 5 Simple Tricks -
Christophe Tafani-Dereeper & Frederic Beguiler
• Hacking & Defending Kubernetes Clusters: We'll Do It LIVE!! - Fabian
Kammel & James Cleverley-Prance
• Threat Modelling Kubernetes: A Lightspeed Introduction - Lewis
Denham-Parry, Control Plane
• Kubernetes Supply Chain Security: The Software Factory - Andrew
Martin, Control Plane
• ………
A good talk must be watched
KUBERNETES COMMUNITY DAYS INDONESIA 2024
THANK
YOU
74

More Related Content

PDF
ДБН В.1.1 7-2002 Пожежна безпека
PDF
Moving a Monolith to Kubernetes
PDF
Keeping your Kubernetes Cluster Secure
PDF
Microservices Training | Microservices Docker Example | Microservices Tutoria...
PPTX
Working on a Skyscraper in the Early Years of the XX Century
PDF
How to Accelerate Your Application Delivery Process on Top of Kubernetes Usin...
PDF
Why Kubernetes? Cloud Native and Developer Experience at Zalando - Enterprise...
PDF
Running and Managing Kubernetes on OpenStack
ДБН В.1.1 7-2002 Пожежна безпека
Moving a Monolith to Kubernetes
Keeping your Kubernetes Cluster Secure
Microservices Training | Microservices Docker Example | Microservices Tutoria...
Working on a Skyscraper in the Early Years of the XX Century
How to Accelerate Your Application Delivery Process on Top of Kubernetes Usin...
Why Kubernetes? Cloud Native and Developer Experience at Zalando - Enterprise...
Running and Managing Kubernetes on OpenStack

Similar to KCD Indonesia 2024 - Letting Hacker Into Your Kubernetes Cluster (20)

PDF
Applied Security for Containers, OW2con'18, June 7-8, 2018, Paris
 
PDF
Securing your Kubernetes cluster_ a step-by-step guide to success !
PDF
TechDays Finland 2020: Best practices of securing web applications running on...
PPTX
Secure Your Containers: What Network Admins Should Know When Moving Into Prod...
PPTX
Hybrid cloud openstack meetup
PDF
Containers, OCI, CNCF, Magnum, Kuryr, and You!
PDF
Devcon3 : iExec Allowing Scalable, Efficient, and Virtualized Off-chain Execu...
PPTX
Pulling Back the Curtain – CloudStack in Private and Community Clouds
PDF
Kubernetes Administration Certification Cost-Register Now(7262008866)
PDF
20220406 - SDAN_Presentation1_SDANOverview.pdf
PDF
KubeCon NA 2019 "Introduction to Telepresence: Fast Development (and Debuggin...
PPTX
Executive Briefing: The Why, What, and Where of Containers
PDF
Perception of Security Issues in the Development of Cloud-IoT Systems by a No...
PDF
Docker in Production, Look No Hands! by Scott Coulton
PDF
The Future of Cloud Networking is VMware NSX (Danish VMUG edition)
PDF
Shift Right Security for EKS Webinar Slides
PPTX
Kubernetes Security
PDF
Open Container Technologies and OpenStack - Sorting Through Kubernetes, the O...
PDF
What Is Kubernetes | Kubernetes Introduction | Kubernetes Tutorial For Beginn...
PDF
LJC 4/21"Easy Debugging of Java Microservices Running on Kubernetes with Tele...
Applied Security for Containers, OW2con'18, June 7-8, 2018, Paris
 
Securing your Kubernetes cluster_ a step-by-step guide to success !
TechDays Finland 2020: Best practices of securing web applications running on...
Secure Your Containers: What Network Admins Should Know When Moving Into Prod...
Hybrid cloud openstack meetup
Containers, OCI, CNCF, Magnum, Kuryr, and You!
Devcon3 : iExec Allowing Scalable, Efficient, and Virtualized Off-chain Execu...
Pulling Back the Curtain – CloudStack in Private and Community Clouds
Kubernetes Administration Certification Cost-Register Now(7262008866)
20220406 - SDAN_Presentation1_SDANOverview.pdf
KubeCon NA 2019 "Introduction to Telepresence: Fast Development (and Debuggin...
Executive Briefing: The Why, What, and Where of Containers
Perception of Security Issues in the Development of Cloud-IoT Systems by a No...
Docker in Production, Look No Hands! by Scott Coulton
The Future of Cloud Networking is VMware NSX (Danish VMUG edition)
Shift Right Security for EKS Webinar Slides
Kubernetes Security
Open Container Technologies and OpenStack - Sorting Through Kubernetes, the O...
What Is Kubernetes | Kubernetes Introduction | Kubernetes Tutorial For Beginn...
LJC 4/21"Easy Debugging of Java Microservices Running on Kubernetes with Tele...

Recently uploaded (20)

PPT
CRASH COURSE IN ALTERNATIVE PLUMBING CLASS
PDF
PRIZ Academy - 9 Windows Thinking Where to Invest Today to Win Tomorrow.pdf
DOCX
573137875-Attendance-Management-System-original
PPTX
bas. eng. economics group 4 presentation 1.pptx
PDF
TFEC-4-2020-Design-Guide-for-Timber-Roof-Trusses.pdf
PPTX
Lecture Notes Electrical Wiring System Components
PPTX
OOP with Java - Java Introduction (Basics)
PDF
Enhancing Cyber Defense Against Zero-Day Attacks using Ensemble Neural Networks
PPTX
Foundation to blockchain - A guide to Blockchain Tech
PDF
Embodied AI: Ushering in the Next Era of Intelligent Systems
PPTX
M Tech Sem 1 Civil Engineering Environmental Sciences.pptx
PPT
Mechanical Engineering MATERIALS Selection
PDF
PPT on Performance Review to get promotions
PPTX
UNIT-1 - COAL BASED THERMAL POWER PLANTS
PPTX
MET 305 2019 SCHEME MODULE 2 COMPLETE.pptx
PDF
Digital Logic Computer Design lecture notes
PPTX
Engineering Ethics, Safety and Environment [Autosaved] (1).pptx
PPTX
additive manufacturing of ss316l using mig welding
PDF
July 2025 - Top 10 Read Articles in International Journal of Software Enginee...
PPTX
Internet of Things (IOT) - A guide to understanding
CRASH COURSE IN ALTERNATIVE PLUMBING CLASS
PRIZ Academy - 9 Windows Thinking Where to Invest Today to Win Tomorrow.pdf
573137875-Attendance-Management-System-original
bas. eng. economics group 4 presentation 1.pptx
TFEC-4-2020-Design-Guide-for-Timber-Roof-Trusses.pdf
Lecture Notes Electrical Wiring System Components
OOP with Java - Java Introduction (Basics)
Enhancing Cyber Defense Against Zero-Day Attacks using Ensemble Neural Networks
Foundation to blockchain - A guide to Blockchain Tech
Embodied AI: Ushering in the Next Era of Intelligent Systems
M Tech Sem 1 Civil Engineering Environmental Sciences.pptx
Mechanical Engineering MATERIALS Selection
PPT on Performance Review to get promotions
UNIT-1 - COAL BASED THERMAL POWER PLANTS
MET 305 2019 SCHEME MODULE 2 COMPLETE.pptx
Digital Logic Computer Design lecture notes
Engineering Ethics, Safety and Environment [Autosaved] (1).pptx
additive manufacturing of ss316l using mig welding
July 2025 - Top 10 Read Articles in International Journal of Software Enginee...
Internet of Things (IOT) - A guide to understanding

KCD Indonesia 2024 - Letting Hacker Into Your Kubernetes Cluster