RBACdoors: How Cryptominers Are Exploiting RBAC Misconfigs - Greg Castle & Vinayak Goyal, Google

Don't miss out! Join us at our next Flagship Conference: KubeCon + CloudNativeCon Europe in Paris from March 19-22, 2024. Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at kubecon.io
RBACdoors: How Cryptominers Are Exploiting RBAC Misconfigs - Greg Castle & Vinayak Goyal, Google
Earlier this year you may have read news articles about cryptomining attacks using RBAC to backdoor clusters. We’ll talk about an attack of this type we observed on a cluster in March this year and demonstrate the attack step by step. We’ll cover how RBAC was misconfigured by the cluster owner to accidentally grant privileged access, how we detected the attack, and how we reconstructed the attacker's actions from the logs. The attack techniques were interesting: the attacker masqueraded as K8s system components and used the certificates API to create new powerful access. We’ll discuss prevention and detection techniques for this kind of attack. We’ll also share some results of measuring similar RBAC misconfigurations across clusters to get a feel for how widespread these types of misconfigurations are in the industry.