A BRIEF DEEP DIVE INTO ATTACKING AND DEFENDING KUBERNETES

Summary from the TLDR InfoSec newsletter

Kubernetes vulnerabilities can be divided into four key categories: pod weaknesses, identity and access mechanisms, cluster configuration components, and control plane entry points. This post provides a deep dive into several specific attack areas, including overly permissive RBAC, service account token abuse, malicious admissions controllers, writable volume mounts, unauthorized access to ETCD, and Kubernetes golden tickets. Each section includes an explanation of the attack vector, possible defenses, and a Falco rule to detect the attack.