Attacking Kubernetes – Part 3 – Tec-Bite IT-Security Blog

About the job

In spring 2020, Microsoft presented a list of various attack scenarios for Kubernetes environments. The list displays 9 different tactics (horizontal) along with the relevant techniques (vertical). In the first part of this blog series, we looked at the three tactics Initial Access, Execution, and Persistence (here is part 1: www.tec-bite.ch/attacking-kubernetes-container-umgebungen-teil-1/). The second part of the blog series was dedicated to the next five tactics on the list: Privilege Escalation, Defense Evasion, Credential Access, Discovery, and Lateral Movement (part 2: www.tec-bite.ch/attacking-kubernetes-container-umgebungen-teil-2/). Today, in the third part of the series, we will address the Impact tactic and show what else should be considered. Source: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/, accessed on 29.07.20 The list is designed like the ATT&CK(1) matrix from MITRE (link: attack.mitre.org) and lists 9 different tactics (horizontal) with the relevant techniques (vertical)(2). (1) ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. (2) MITRE also offers a more general ATT&CK matrix for the cloud (link: attack.mitre.org/matrices/enterprise/cloud/) Tactics 1-8 The tactics 1-3 can be read in the first part of the blog series: Attacking Kubernetes (Container Environments) – Part 1 And tactics 4-8 are discussed in the second part of the blog series: Attacking Kubernetes (Container Environments) – Part 2 Finally, the last batch of techniques remaining from the first two entries: 9. Impact The so-called "Impact tactic" consists of techniques used by attackers to disrupt, misuse, or even destroy the normal behaviour of the environment. 9.1 Data destruction Attackers can attempt to destroy data and resources in the cluster. This includes deleting deployments, configurations, storage, and compute resources. 9.2 Resource hijacking Attackers can misuse a compromised resource to execute their own tasks. A common misuse is using compromised resources for mining digital currencies. Attackers who have access to a container in the cluster or permission to create new containers can use these for such activities. 9.3 Denial of service Attackers can also attempt to carry out a Denial-of-Service attack (DoS), making the service unavailable to legitimate users. In container clusters, this includes attempts to impair the availability of containers, cluster nodes, or the API server. Microsoft offers more information on container security here: docs.microsoft.com/en-us/azure/security-center/container-security Similarly from AWS (for ECS): docs.aws.amazon.com/AmazonECS/latest/developerguide/security.html And from Google (GCP): cloud.google.com/container-registry/docs/container-analysis What have we forgotten? Quite a bit. The Microsoft-adapted Mitre ATT&CK tool for Kubernetes is a valuable and interesting document. You can learn a lot from it, and it clearly shows that many techniques are similar in container environments as in normal cloud or on-premises environments. It becomes interesting when you consider what runs differently in a Kubernetes cluster compared to on-premises environments. These points could then represent additional vulnerabilities. On the one hand, you should always consider whether the platform itself shows or could show vulnerabilities. Within a K8s platform, many different services run (from monitoring to controllers to service mesh, etc.) that can have vulnerabilities and could be exploited. Such so-called supply-chain attacks are not uncommon, and the recent Solarwinds hack clearly demonstrated how dangerous they can be. The entire CI/CD pipeline is also an ideal attack vector, from the CI/CD tools themselves to the automation tools and, of course, the repositories. Image scanning of containers in the repository should actually be implemented in every container environment. You should also not forget the human component. Kubernetes environments are quite complex, and when you add the CI/CD pipeline, there are many opportunities to misconfigure something (especially, but not only, /etcd and kubelet). Therefore, there are increasingly more CSPM (Cloud Security Posture Management) solutions that can verify the configuration of container environments (and specifically Kubernetes) and compare them against standards. It is no surprise that the APIs of container environments are often seen as a clear attack target. In a Kubernetes cluster, there is hardly a better attack vector, because if you find even one API vulnerability, it is often trivial to exploit it and perform privilege escalation. There are many other points to watch out for; the list is quite long. Much depends again on the container environment itself. We recommend creating clear visibility of the cluster and the CI/CD pipeline and all suppliers from the start and keeping this continuously up to date and regularly reviewing it. Conclusion So, is it enough to take these 9 tactics as a basis to secure a Kubernetes environment? As always with security, it strongly depends on other circumstances. Where is your container environment located (on-premises or in the cloud)? How do you operate the containers (Openshift, Kubernetes, via a managed environment like ECS, GKE, or AKS)? Have you built an isolated environment, or are your clusters part of a development chain (with your own repositories and CI/CD)? etc. You do not have to operate your Kubernetes cluster completely isolated in the data centre as a black box, but you should not just start ECS/GKE or AKS and think that the cloud providers will take care of all security (tip: they do not). And finally, a bit of self-promotion: we are happy to help you build your container environment securely and have solutions in our portfolio that are specifically built for Kubernetes and containers. Links ATT&CK(1) matrix from MITRE: attack.mitre.org Microsoft blog – Threat matrix for Kubernetes: www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ Cloud security from AVANTEC: www.avantec.ch/themen/cloud-security/ The article Attacking Kubernetes (Container Environments) – Part 3 first appeared on Tec-Bite.