How to Escape Clusters in a Managed Kubernetes Cluster?

Cloud Security Podcast

Innhold levert av Cloud Security Podcast Team. Alt podcastinnhold, inkludert episoder, grafikk og podcastbeskrivelser, lastes opp og leveres direkte av Cloud Security Podcast Team eller deres podcastplattformpartner. Hvis du tror at noen bruker det opphavsrettsbeskyttede verket ditt uten din tillatelse, kan du følge prosessen skissert her https://no.player.fm/legal.

12M ago 59:01

MP3•Episoder hjem

Not Escaping Containers but escaping Clusters - Managed Kubernetes distributions such as Amazon EKS, Google Kubernetes Engine (GKE) and Azure Kubernetes Service (AKS) attack vectors can allow you to reach the underlying AWS Account etc. In conversation with Christophe Tafani-Dereeper & Nick Frichette, from Datadog on how this is possible in Amazon EKS and achieving potentially the same in GKE & AKS too.

Thank you to our episode sponsor Sagetap

Guest Socials: Nick's and Christophe's Linkedin (⁠⁠⁠⁠⁠⁠⁠⁠⁠Nick Frichette + Christophe Tafani-Dereeper)

Podcast Twitter - ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@CloudSecPod⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security Newsletter ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security BootCamp Questions asked: (00:00) Introduction

(04:11) A bit about Christophe

(04:37) A bit about Nick

(05:03) What is managed Kubernetes?

(06:26) Security of managed Kubernetes

(09:02) Comparison between different managed Kubernetes

(10:41) Service accounts and managed Kubernetes

(14:22) What is container escape?

(18:20) IMDSv2 for EKS

(19:51) IMDSv2 in EKS vs AKES and GKE

(22:01) Benchmark compliance for Kubernetes architecture

(24:49) Low hanging fruits for container escape

(27:17) Shared responsibility for managed Kubernetes

(29:34) Fargate for Managed Kubernetes

(32:00) Different ways to run containers

(33:37) Escaping Managed Kubernetes cluster

(38:39) Find more about this attack path

(42:38) Escalation priviledge in EKS cluster

(44:19) Reducing the Kubernetes attack service

(44:58) MKAT for Kubernetes Security

(48:23) Preventing AWS AuthConfig

(50:11) Propagation Security

(54:55) The fun section

(57:47) Resources for latest Kubernetes updates

Resources spoken about during the episode

Nick Frichette's Blog - Hacking the Cloud

Christophe Tafani-Dereeper' Blog

Corey Quinn's - 17 ways to run containers on AWS

MKAT

cloudseclist newsletter

280 episoder

#Tech #Kaizenteq Team