KUBERNETES GOAT - INTERACTIVE KUBERNETES SECURITY LEARNING PLAYGROUND

Kubernetes Goat is “vulnerable by design” Kubernetes Cluster environment to practice and learn about Kubernetes Security. In this session, Madhu Akula will present how to get started with Kubernetes Goat by exploring different vulnerabilities in Kubernetes Cluster and Containerised environments. Also, he demonstrates the real-world vulnerabilities and maps the Kubernetes Goat scenarios with them. Also, we will see the complete documentation and instruction to practice Kubernetes Security for performing security assessments. As a defender you will see how we can learn these attacks, misconfigurations to understand and improve your Cloud Native infrastructure security posture.

Transcript

1. Kubernetes Goat Interactive Kubernetes Security Learning Playground Madhu Akula
2. About Me • Security Engineering @ Miro • Creator of Kubernetes Goat, Hacker Container, tools.tldr.run, many other OSS projects. • Speaker & Trainer at Blackhat, DEFCON, GitHub, USENIX, OWASP, All Day DevOps, DevSecCon, CNCF, c0c0n, Nullcon, SACON, null, many others. • Author of Security Automation with Ansible2, OWASP KSTG, DevSecOps whitepaper, etc. • Technical reviewer (multiple books) & Review board member of multiple conferences, organizations, communities, etc. • Found security vulnerabilities in 200+ organizations and products including Google, Microsoft, AT&T, Adobe, WordPress, Ntop, etc. • Certified Kubernetes Administrator & Offensive Security Certified Professional, etc. • Never ending learner!
3. Kubernetes Goat is designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security. What is Kubernetes Goat?
4. Kubernetes Goat creates intentionally vulnerable resources into your cluster. DO NOT deploy Kubernetes Goat in a production environment or alongside any sensitive cluster resources. ⚠ Disclaimer
5. 1. Sensitive keys in code bases 2. DIND (docker-in-docker) exploitation 3. SSRF in K8S world 4. Container escape to access host system 5. Docker CIS Benchmarks analysis 6. Kubernetes CIS Benchmarks analysis 7. Attacking private registry 8. NodePort exposed services 9. Helm v2 tiller to PwN the cluster 10. Analysing crypto miner container 11. Kubernetes Namespaces bypass Current Scenarios in Kubernetes Goat 12. Gaining environment information 13. DoS the memory/cpu resources 14. Hacker Container preview 15. Hidden in layers 16. RBAC Least Privileges Misconfiguration 17. KubeAudit - Audit Kubernetes Clusters 18. Sysdig Falco - Runtime Security Monitoring & Detection 19. Popeye - A Kubernetes Cluster Sanitizer 20. Secure network boundaries using NSP More coming soon….
6. Setting up Kubernetes Goat • Ensure you have admin access to the Kubernetes cluster ◦ Refer to kubectl releases for binaries https://kubernetes.io/docs/tasks/tools/install-kubectl/ • Verify by running kubectl version • Ensure you have helm version 2 setup in your path as helm2 ◦ Refer to helm version 2 releases for binaries https://github.com/helm/helm/releases ◦ Verify by running helm2 version • To set up the Kubernetes Goat resources in your cluster, run the following commands git clone https://github.com/madhuakula/kubernetes-goat.git cd kubernetes-goat bash setup-kubernetes-goat.sh
7. Setting up Kubernetes Goat - Without Setup 😎 https://katacoda.com/madhuakula/scenarios/kubernetes-goat
8. Demo 🐐 Time
9. Key Takeaways! • Attackers/Red Teams ◦ Learning how to attack/find security issues with in containers, Kubernetes and similar environments and workloads to exploit and gain access • Defenders/Blue Teams ◦ Understanding best practices, learning how attackers works to apply defense, practicing the attacks, misconfigurations to apply defense and detection • Security Vendors ◦ Using Kubernetes Goat to showcase the effectiveness of the tools/product, helping educate the customers and sharing their knowledge in an interactive hands-on way • Architects/Engineers/Consultants/Developers/Users/etc… ◦ Learning and Practicing • Share it with your friends, colleagues, everyone. Provide your valuable feedback, contributions, and suggestions
10. Cloud Native Security Playground Coming soon with new updates and much bigger landscape!
11. Thank you! @madhuakula https://madhuakula.com