Attacking and Defending Kubernetes

Many companies have deployed Kubernetes, but few infosec folks have experience attacking it. We aim to address that shortage, culminating in an audience-directed Choose Your Own Adventure, movie-themed demo against an intentionally-vulnerable cluster named Bust-a-Kube. You'll see how to attack Kubernetes clusters and learn what hardening techniques and freely available tools can break those attacks. We'll review the components of a Kubernetes cluster, then show how a threat actor can chain configuration vulnerabilities to pivot and escalate privilege, pilfer data and take over clusters. You will also gain exposure to a new open source Kubernetes attack tool called Peirates. EVENT: Def Con 27 – 2019 SPEAKER: Jay Beale PUBLICATION PERMISSIONS: Original video was published with the Creative Commons Attribution license (reuse allowed) ATTRIBUTION CREDITS: Original video source: https://www.youtube.com/watch?v=2fmAuR3rnBo https://www.youtube.com/watch?v=0nZvBMmbsGs