6 ms·

Attack Matrix for Kubernetes

272 points by based2 7y ago

Legogris 7y ago
Duplicate of https://news.ycombinator.com/item?id=22772179 https://news.ycombinator.com/item?id=22772179 https://news.ycombinator.com/item?id=22784713 https://news.ycombinator.com/item?id=22784713 https://news.ycombinator.com/item?id=22834195 https://news.ycombinator.com/item?id=22834195 (Reposting is all good when things get buried, but this is the third time I see this on the top front page with no comments)
- empath75 7y ago
  It all the other kubernetes admins are like me, they immediately had a panic attack and started writing up Jira tickets instead of commenting.
- rvz 7y ago
  Well now this lucky poster finally has a discussion around it and all the duplicates you posted still have no comments. Only links to the same article with no discussion which isn't useful as a 'duplicate'.
- merricksb 7y ago
  All the submissions are by different people, all of whom have a very solid history on HN. So it doesn't count as self-promotion or manipulation. It just seems to be an article that multiple users found interesting, but that has fallen through the cracks so far.
  - Legogris 7y ago
    Seems like it - when i posted my comment the post had 3 points and mine was the only comment. Good to see that it eventually sparked some interesting conversation!
freehunter 7y ago
We use the MITRE ATT&CK framework at my infosec consulting company quite heavily. It's the structure we use to define security content, allowing us to use the same language with our clients that auditors do, and allowing us to use the same language between customers to assess client- or industry-specific threats across all of our customers. Having a high level framework to discuss threat helps, but so does the process of laying out all the possible threats. It's a kind of checklist, have I secured this properly? Have I thought about all the attack vectors? I hope these MITRE-style attack matrices catch on more.
- jsty 7y ago
  > the MITRE ATT&CK framework This looks incredibly useful, thanks for pointing it out For anyone else who's curious: https://attack.mitre.org/ https://attack.mitre.org/
  - wronglebowski 7y ago
    I was planning to do a “Show HN” but this seems like an appropriate time. I work on a free product called VECTR which is built to use the MITRE framework. https://github.com/SecurityRiskAdvisors/VECTR https://github.com/SecurityRiskAdvisors/VECTR If you have an interest in being able to track your purple team results I highly recommend it.
    - unixhero 7y ago
      Post it as a "Show HN" as well, this project needs the proper publicity and stimulated discussions from HN.
      - wronglebowski 6y ago
        Posted. https://news.ycombinator.com/item?id=22856765 https://news.ycombinator.com/item?id=22856765
  - whycombagator 7y ago
    MITRE ATT&CK is mentioned in the article 4x and the article itself is about Microsoft developing a similar matrix for K8s.
jrockway 7y ago
Another thing to be mindful of is the service account token that each pod gets. While these rarely have access to the entire cluster, it is relatively easy to configure an application to bridge HTTP requests to the API server, which would be a minor disaster. (I noticed this while writing a small Envoy control plane. Everything exists in my config format to pick up the TLS certificates that the Envoy pod already has to create a backend that points to your API server, automatically giving any HTTP requests routed to that backend the credentials of the Envoy pod itself. Add a route in the route table, and now you have a publicly-available route to your API server. You would have to go out of your way to do this, but it's something to keep in mind -- pods have more privileges than just "run the program in the container".)
Alukart 7y ago
thewayofmph@gmail.com
Svip 7y ago
Is it Hacker News that re-edits the headlines? At first I thought the headline meant "attack Matrix", i.e. matrix.org, for the purpose of helping Kubernetes. Like a call to arms. But then it made little sense to me that the origin domain was microsoft.com. Man, capitalisation really matters, I guess.
chvid 7y ago
Openshift sells itself as a more secure Kubernetes ... anyone knows how much of this it mitigates?
- meddlepal 7y ago
  OpenShift has way more scope (read: surface area) than Kubernetes... I'm skeptical.
  - pat2man 7y ago
    Sure but a lot of that scope is regularly added on to kubernetes clusters (metrics, logging, etc) so unless you keep your cluster super lean you will end up with a large attach surface anyway.
    - jrockway 7y ago
      Logging agents don't need to talk to the control plane, so shouldn't be able to compromise it. In the case of a per-machine log collector ("DaemonSet"), it just reads files in a particular location that your container runtime writes. In the case of per-pod log collectors ("sidecars"), no special privileges are needed. (Your application just opens a network connection inside the pod network; the 127.0.0.1 address that you write log data to doesn't even exist outside the pod.) Prometheus does talk to the control plane, but via a service account that only has read and list permissions, so shouldn't be able to compromise it. The truly paranoid could have static configurations (scrape foo.bar.svc.cluster.local:1234, not "foreach pod, scape $POD_ID:1234"), but if reading/listing pods can compromise the control plane, that would probably be a P0 security bug in Kubernetes. Obviously, anything running in your cluster has the potential to exploit a kernel bug to read files on the node that it shouldn't have access to, including other service accounts. The guidance there should be to be careful about what permissions you grant any application.
      - smarterclayton 7y ago
        A lot of extensions ask for “read all secrets” which is effectively root on the cluster - especially ingress controllers - because service account tokens for controllers are in secrets. Once we turn off service account tokens (they will he generated for pods on demand on each host) then that attack gets much smaller, although at that point is an extension that reads secrets is still as privileged as any pod on the cluster. Being able to create a pod in a namespace makes you also able to read any secret in that namespace.
deleted 7y ago
[deleted]

272 points by based2 7y ago

Duplicate of https://news.ycombinator.com/item?id=22772179 https://news.ycombinator.com/item?id=22772179 https://news.ycombinator.com/item?id=22784713 https://news.ycombinator.com/item?id=22784713 https://news.ycombinator.com/item?id=22834195 https://news.ycombinator.com/item?id=22834195 (Reposting is all good when things get buried, but this is the third time I see this on the top front page with no comments)

empath75 7y ago
It all the other kubernetes admins are like me, they immediately had a panic attack and started writing up Jira tickets instead of commenting.
rvz 7y ago
Well now this lucky poster finally has a discussion around it and all the duplicates you posted still have no comments. Only links to the same article with no discussion which isn't useful as a 'duplicate'.
merricksb 7y ago
All the submissions are by different people, all of whom have a very solid history on HN. So it doesn't count as self-promotion or manipulation. It just seems to be an article that multiple users found interesting, but that has fallen through the cracks so far.
- Legogris 7y ago
  Seems like it - when i posted my comment the post had 3 points and mine was the only comment. Good to see that it eventually sparked some interesting conversation!

freehunter 7y ago

We use the MITRE ATT&CK framework at my infosec consulting company quite heavily. It's the structure we use to define security content, allowing us to use the same language with our clients that auditors do, and allowing us to use the same language between customers to assess client- or industry-specific threats across all of our customers. Having a high level framework to discuss threat helps, but so does the process of laying out all the possible threats. It's a kind of checklist, have I secured this properly? Have I thought about all the attack vectors? I hope these MITRE-style attack matrices catch on more.

jsty 7y ago
> the MITRE ATT&CK framework This looks incredibly useful, thanks for pointing it out For anyone else who's curious: https://attack.mitre.org/ https://attack.mitre.org/
- wronglebowski 7y ago
  I was planning to do a “Show HN” but this seems like an appropriate time. I work on a free product called VECTR which is built to use the MITRE framework. https://github.com/SecurityRiskAdvisors/VECTR https://github.com/SecurityRiskAdvisors/VECTR If you have an interest in being able to track your purple team results I highly recommend it.
  - unixhero 7y ago
    Post it as a "Show HN" as well, this project needs the proper publicity and stimulated discussions from HN.
    - wronglebowski 6y ago
      Posted. https://news.ycombinator.com/item?id=22856765 https://news.ycombinator.com/item?id=22856765
- whycombagator 7y ago
  MITRE ATT&CK is mentioned in the article 4x and the article itself is about Microsoft developing a similar matrix for K8s.

jrockway 7y ago

Another thing to be mindful of is the service account token that each pod gets. While these rarely have access to the entire cluster, it is relatively easy to configure an application to bridge HTTP requests to the API server, which would be a minor disaster. (I noticed this while writing a small Envoy control plane. Everything exists in my config format to pick up the TLS certificates that the Envoy pod already has to create a backend that points to your API server, automatically giving any HTTP requests routed to that backend the credentials of the Envoy pod itself. Add a route in the route table, and now you have a publicly-available route to your API server. You would have to go out of your way to do this, but it's something to keep in mind -- pods have more privileges than just "run the program in the container".)

Alukart 7y ago

thewayofmph@gmail.com

Svip 7y ago

Is it Hacker News that re-edits the headlines? At first I thought the headline meant "attack Matrix", i.e. matrix.org, for the purpose of helping Kubernetes. Like a call to arms. But then it made little sense to me that the origin domain was microsoft.com. Man, capitalisation really matters, I guess.

chvid 7y ago

Openshift sells itself as a more secure Kubernetes ... anyone knows how much of this it mitigates?

meddlepal 7y ago
OpenShift has way more scope (read: surface area) than Kubernetes... I'm skeptical.
- pat2man 7y ago
  Sure but a lot of that scope is regularly added on to kubernetes clusters (metrics, logging, etc) so unless you keep your cluster super lean you will end up with a large attach surface anyway.
  - jrockway 7y ago
    Logging agents don't need to talk to the control plane, so shouldn't be able to compromise it. In the case of a per-machine log collector ("DaemonSet"), it just reads files in a particular location that your container runtime writes. In the case of per-pod log collectors ("sidecars"), no special privileges are needed. (Your application just opens a network connection inside the pod network; the 127.0.0.1 address that you write log data to doesn't even exist outside the pod.) Prometheus does talk to the control plane, but via a service account that only has read and list permissions, so shouldn't be able to compromise it. The truly paranoid could have static configurations (scrape foo.bar.svc.cluster.local:1234, not "foreach pod, scape $POD_ID:1234"), but if reading/listing pods can compromise the control plane, that would probably be a P0 security bug in Kubernetes. Obviously, anything running in your cluster has the potential to exploit a kernel bug to read files on the node that it shouldn't have access to, including other service accounts. The guidance there should be to be careful about what permissions you grant any application.
    - smarterclayton 7y ago
      A lot of extensions ask for “read all secrets” which is effectively root on the cluster - especially ingress controllers - because service account tokens for controllers are in secrets. Once we turn off service account tokens (they will he generated for pods on demand on each host) then that attack gets much smaller, although at that point is an extension that reads secrets is still as privileged as any pod on the cluster. Being able to create a pod in a namespace makes you also able to read any secret in that namespace.

deleted 7y ago

[deleted]