Container code cluster-fact: There's a hole in Kubernetes that lets miscreants cause havoc

guest · Dec 3, 2018

Container code cluster-fact: There's a hole in Kubernetes
Critical bug brings bevy of patches
December 3, 2018
https://www.theregister.co.uk/2018/12/03/container_code_clusterfact_theres_a_hole_in_kubernetes/

In a post to the Kubernetes announcement list on Monday, Google senior staff engineer Jordan Liggitt says Kubernetes verversion v1.10.11, v1.11.5, and v1.12.3 have been made available to fix CVE-2018-1002105, a privilege escalation vulnerability.

The code error in the open source project has been designated severity 9.8 out of 10 because it can be executed remotely, the attack is not complex and no user interaction or special privileges are required .

"This is a big deal," said Ashesh Badani, veep and general manager of OpenShift at Red Hat, in a blog post.
"Not only can [miscreants] steal sensitive data or inject malicious code, but they can also bring down production applications and services from within an organization’s firewall."
Click to expand...

guest · Dec 10, 2018

Exploit Code for the Kubernetes Flaw Is Now Available
December 10, 2018
https://www.bleepingcomputer.com/ne...ode-for-the-kubernetes-flaw-is-now-available/

The recently disclosed critical-impact bug in Kubernetes created strong ripples in the security space of the container-orchestration system. Now, multiple demo exploits exist and come with easy-to-understand explanations.
Although mitigations exist, "none can really be applied without breaking anything else in the cluster," says Twistlock security researcher Ariel Zelivansky.
Multiple PoC exploits available
In a demo video released yesterday, the researcher shows that his exploit "leaks information on pods from all namespaces in the cluster. It can be executed from any pod and should work assuming metrics-server deployed and default configuration."

Another proof-of-concept comes from software-as-a-service company Gravitational who made it available on GitHub on December 5, just two days after the Kubernetes developers announced the vulnerability and the availability of new software versions to mitigate it.
Exploit for unauthenticated users
Over the weekend, the developer created code for exploiting the flaw to allow privilege escalation without authentication. [...] Vincent announced that the exploit was ready and pointed to his GitHub.
Click to expand...

guest · Apr 1, 2019

Serious Path Traversal Flaw Found in Kubernetes
April 1, 2019
https://www.securityweek.com/serious-path-traversal-flaw-found-kubernetes

Last year, developers of Kubernetes and OpenShift, a Red Hat-made container application platform that uses Kubernetes, patched a directory traversal vulnerability (CVE-2018-1002100) [...]
Researchers at container security firm Twistlock discovered that the fix was incomplete and demonstrated that attacks were still possible.

Twistlock researchers explained that an attacker can exploit this directory traversal to steal potentially sensitive information from the devices of Kubectl users, which are typically developers, administrators or members of DevOps teams.
It may also be possible to execute arbitrary code on the system, but that depends on the level of permissions Kubectl has.

“This vulnerability can be dangerous in one of two scenarios: 1) A user unknowingly downloads a malicious container image with a bad tar. The attacker can push such an image to any registry (e.g. Docker Hub) for a popular image he has control of or rely on typosquatting. 2) An attacker compromises a running container by exploiting another vulnerability or in some cases he may have legitimate access to a container. The attacker then plants a malicious tar replacing the original tar of the image,” said Twistlock researcher Ariel Zelivansky.
Click to expand...

guest · Jun 24, 2019

Incomplete Fix Leads to New Kubernetes Bug
June 24, 2019
https://www.infosecurity-magazine.com/news/incomplete-fix-leads-to-new-1/

A new high-severity Kubernetes vulnerability has been discovered, according to security announcement on Securelists.org.

As part of the ongoing Kubernetes security audit sponsored by the Cloud NativeComputing Foundation, the Kubernetes product security team announced a new high-severity vulnerability (CVE-2019-11246) that impacts kubectl, the command line interface used to run commands against Kubernetes clusters.

“Another security issue was discovered with the Kubernetes kubectl cp command that could enable a directory traversal such that a malicious container could replace or create files on a user’s workstation. The vulnerability is a client-side defect and requires user interaction to be exploited [...]" wrote Joel Smith.
“This vulnerability stems from incomplete fixes for a previously disclosed vulnerability (CVE-2019-1002101). [...]

“This type of exploit shows how a client-side vulnerability could be used to potentially compromise production environments, especially since we have observed that best practices to mitigate against this type of threat vector are not always followed. [...]"
Click to expand...

guest · Aug 6, 2019

CNCF Open Sources Security Audit of Core Kubernetes Components
August 6, 2019
https://thenewstack.io/cncf-open-sources-security-audit-of-core-kubernetes-components

This week, the Cloud Native Computing Foundation (CNCF) has released the final results of a two-month-long, third-party security audit of eight core Kubernetes components, uncovering a variety of vulnerabilities.
CVEs have already been created for the vulnerabilities, which have been addressed already, according to the CNCF. In addition, the analysis found a number of issues found in many Kubernetes deployments

“I don’t think there are many security audits out there that are done in an open community way. It was an open RFP with a Kubernetes governance structure behind it with a working group. We’re open sourcing all the results and the paper, which generally doesn’t happen with security audits,” said Aniszczyk.

In addition to finding numerous vulnerabilities, the security audits resulted in a number of recommendations for both Kubernetes developers and cluster administrators.
“I envision something like this maybe happening on a once every couple of years, but it’s really for the security audit working group to come up with a decision since they’re the experts.”
Click to expand...

guest · Aug 12, 2019

Kubernetes security matures: Inside the project’s first audit
August 12, 2019
https://www.helpnetsecurity.com/2019/08/12/kubernetes-security-matures/

Auditing 1.5 million lines of code is a heroic undertaking.
From the start, we knew that no matter how many person-months we allocated to this initiative, or how many dollars were provided, we would be unable to perform a completely comprehensive review of Kubernetes in one go.

The research yielded 37 findings, five of which were considered “high severity.” All of these findings have been officially reported to the Kubernetes Product Security Committee and will be, and have already begun to be addressed in the open.
The findings spanned the breadth of security control families from authentication and authorization to cryptography and timing attacks. They also spanned severity from bypassing critical security controls like Pod Security Policy, to “I’d-prefer-it-didn’t” issues like supporting older and less secure TLS ciphers.

Despite many important findings, we did not see fundamental architectural design flaws, or critical vulnerabilities that should cause pause when adopting Kubernetes for high-security workloads or critical business functions.
Click to expand...

guest · Aug 20, 2019

Severe Flaws in Kubernetes Expose All Servers to DoS Attacks
August 20, 2019
https://www.bleepingcomputer.com/ne...kubernetes-expose-all-servers-to-dos-attacks/

Two high severity vulnerabilities impacting all versions of the Kubernetes open-source system for handling containerized apps can allow an unauthorized attacker to trigger a denial-of-service (DoS) state.

Kubernetes' development team has already released patched versions to address these newly found security flaws and block potential attackers from exploiting them.
Security flaws impact all Kubernetes versions
"A security issue has been found in the net/http library of the Go language that affects all versions and all components of Kubernetes," disclosed Kubernetes Product Security Committee's Micah Hausler on the announcement list for Kubernetes security issues.
"The vulnerabilities can result in a DoS against any process with an HTTP or HTTPS listener," with all versions of Kubernetes being affected.
Click to expand...

guest · Aug 22, 2019

Aqua Security Open Sources Container Pen Test
August 24, 2019
https://containerjournal.com/features/aqua-security-open-sources-container-pen-test/

Aqua Security is trying to level the container security playing field by making available an open source edition of a penetration testing tool designed specifically for container clusters.
The kube-hunter project augments the validation for Kubernetes deployments based on specifications developed by the Center for Internet Security (CIS) that are already provided via Aqua Security’s kube-bench project. Aqua Security is hoping that other organizations will contribute additional penetration tests to the project, Osnat says.

The company is aware that cybercriminals might use this tool to probe for cybersecurity weaknesses as well. But most cybercriminals already have access to a plethora of penetration testing tools. By making kube-hunter widely available, Aqua Security is attempting to provide organizations access to a tool that makes it easier for them to discover container vulnerabilities before cybercriminals can exploit them.
Click to expand...

guest · Aug 23, 2019

Kubernetes Patches Recent HTTP/2 Vulnerabilities
August 23, 2019
https://www.securityweek.com/kubernetes-patches-recent-http2-vulnerabilities

Software updates released by Kubernetes this week address HTTP/2 implementation vulnerabilities that were disclosed earlier this month.
Abuse of these vulnerabilities could exhaust server resources such as CPU or memory, or both, this leading to DoS. Each implementation, the researchers said, might be affected by at least one of the flaws.

Kubernetes components that allow for HTTP/2 connections may still be vulnerable in all previously released versions. While no exploits have been publicly observed, the liveness probe and healthz were all identified as vulnerable.
Click to expand...

guest · Oct 17, 2019

Dangerous Kubernetes Bugs Allow Authentication Bypass, DoS
The flaws in the container technology, CVE-2019-16276 and CVE-2019-11253, are simple to exploit
October 17, 2019
https://threatpost.com/kubernetes-bugs-authentication-bypass-dos/149265/

A pair of bugs in the Kubernetes open-source cloud container software can be “highly dangerous” under some Kubernetes configurations, according to researchers.
The flaws, CVE-2019-16276 and CVE-2019-11253, have been patched in Kubernetes builds 1.14.8, 1.15.5 and 1.16.2.

Exploitation of the first issue, CVE-2019-16276, is “very simple,” according to Ariel Zelivansky and Aviv Sasson at Palo Alto Networks – and could allow an attacker to bypass authentication controls to access a container.
According to the bug report, the high-severity flaw, is a HTTP protocol violation in the Go language’s standard HTTP library, which is called net/http. The library is used for parsing HTTP requests.
The second vulnerability, CVE-2019-11253, renders the Kubernetes API server vulnerable to a denial-of-service attack, according to the bug report.

Connor Gilbert, senior product manager at StackRox, told Threatpost that the discovery of more vulnerabilities underscores the need to pay particular attention to securing this threat surface.

"[...] Recent vulnerabilities in Kubernetes highlight just how important it is to have a multi-layered security approach, including authentication, authorization, network firewalls and ongoing monitoring.”
Click to expand...

Palo Alto: Analysis of Two Newly Patched Kubernetes Vulnerabilities

guest · Feb 19, 2020

Security concerns hampering adoption of containers and Kubernetes
February 19, 2020
https://www.techrepublic.com/articl...pering-adoption-of-containers-and-kubernetes/

Enterprises are having significant problems with security when it comes to Kubernetes and container deployments, according to a new survey from security company StackRox.

In the winter 2020 edition of its State of Container and Kubernetes Security Report, StackRox researchers found that 94% of respondents experienced a security incident in their Kubernetes and container environments during the last 12 months.
This very high number of security incidents led to about 44% of organizations delaying or outright halting application deployment into production.

"Our survey data affirms what we hear anecdotally from customers, that security has become a high priority as customers seek to deploy containers and Kubernetes applications in production," said Kamal Shah, CEO of StackRox.
Misconfiguration incidents were particularly high because of how challenging it can be to find the kind of tech talent that can deal with the intricate knobs and dials in containers and Kubernetes.
Click to expand...

StackRox: 5 Surprising Findings from StackRox’s Latest Kubernetes Security Report

Today, StackRox published its State of Kubernetes and Container Security Report, Winter 2020 edition (download your full copy here) - a first of its kind. Based on responses from more than 540 Kubernetes and container users across IT security, DevOps, engineering, and product roles, the report provides insights into how organizations are adopting containers and Kubernetes and its security impact.
Click to expand...

"The State of Container and Kubernetes Security" (PDF - 2.01 MB): https://security.stackrox.com/rs/219-UEH-533/images/State_of_Container_and_Kubernetes_Report.pdf

guest · Jul 29, 2020

Kubernetes Vulnerability Puts Clusters at Risk of Takeover (CVE-2020-8558)
July 27, 2020
https://unit42.paloaltonetworks.com/cve-2020-8558/

Executive Summary
A security issue assigned CVE-2020-8558 was recently discovered in the kube-proxy, a networking component running on Kubernetes nodes. The issue exposed internal services of Kubernetes nodes, often run without authentication. On certain Kubernetes deployments, this could have exposed the api-server, allowing an unauthenticated attacker to gain complete control over the cluster. An attacker with this sort of access could steal information, deploy crypto miners or remove existing services altogether.

The vulnerability exposed nodes’ localhost services – services meant to be accessible only from the node itself – to hosts on the local network and to pods running on the node.
The issue details were made public on April 18, 2020, and a patch released on June 1, 2020.
Click to expand...

Conclusion
CVE-2020-8558 can have some serious consequences. You should patch your clusters as soon as possible. CVE-2020-8558 also serves as a reminder that security best practices do work and significantly reduce attack surface.
You should disable the api-server insecure-port, and if your pods don’t require CAP_NET_RAW, there’s no reason they should have that capability. While not related to this specific issue, we recommend implementing other security recommendations such as RBAC or running containers as a non-root user.
Click to expand...

CVE-2020-8558: Node setting allows for neighboring hosts to bypass localhost boundary #92315
CVSS Rating:
In typical clusters: medium (5.4)
In clusters where API server insecure port has not been disabled: high (8.8)
Click to expand...

guest · Sep 22, 2020

Why misconfigurations are such an issue in your containers and Kubernetes
September 22, 2020
https://cybersecurity.att.com/blogs...ch-an-issue-in-your-containers-and-kubernetes

Organizations are increasingly incorporating containers and Kubernetes into their IT infrastructure. As reported by ZDNet, Flexera’s “2020 State of the Cloud Report” found that about two-thirds (65%) of organizations were using Docker and that another 14% intended to begin using it at some point.

Even so, misconfigurations with both containers and Kubernetes are posing a problem. StackRox’s “State of Kubernetes and Container Security Winter 2020” report found that nearly all (94%) of respondents had experienced a security incident in their container environments over the past 12 months, per Security magazine’s coverage.
These findings beg the question: why are misconfigurations such an issue for organizations’ Kubernetes and container environments?
Click to expand...

This blog post will answer this question by first defining containers and Kubernetes and explaining the benefits of each technology. It will then explore how misconfigurations open the door for attacks from malicious actors. Finally, it will briefly provide a few recommendations on how organizations can reduce the probability of suffering a misconfiguration incident.
Click to expand...

guest · Oct 28, 2020

StackRox Tool Prevents Kubernetes Misconfigurations
October 28, 2020
https://containerjournal.com/topics...x-tool-prevents-kubernetes-misconfigurations/

StackRox today unveiled an open source static analysis tool dubbed Kubelinter that analyzes YAML files and Helm Charts to identify misconfigurations in Kubernetes deployments prior to deployment.

Viswa Venugopal, staff software engineer at StackRox, says given the prevalence of misconfigured Kubernetes clusters it’s apparent there is a need for a security tool that IT teams can employ before a Kubernetes cluster is deployed. Written on the Go programming language, Kubelintr accomplishes that goal in a single binary file that IT teams can run in a command line, he says.
Longer term, StackRox plans to add auto-remediation capabilities to Kubelinter that IT teams can employ as they best see fit depending on the impact those changes might have on their applications.

Configuration issues among early adopter of Kubernetes clusters have become an issue because of the complexity of the platform. Most developers who have spun up Kubernetes clusters are primarily focused on simply getting the platform to run.
Click to expand...

KubeLinter provides an automated means to carry out configuration checks as part of a continuous integration (CI) workflow that makes it easier to track how changes are proposed and made to YAML files and Helm charts, he adds.
Click to expand...

StackRox: Introducing KubeLinter - an open source linter for Kubernetes

Today, I’m excited to announce the launch of KubeLinter , a new open source project from StackRox!

KubeLinter analyzes Kubernetes YAML files and Helm charts, and checks them against a variety of best practices, with a focus on production readiness and security. Scroll down to watch a video overview of KubeLinter.
KubeLinter is written in Go and packaged as a static, self-contained binary, so it installs in seconds. Once you point it to your Helm charts and YAML files, you should see results near-instantaneously.
Click to expand...

guest · Dec 8, 2020

All Kubernetes versions affected by unpatched MiTM vulnerability
December 8, 2020
https://www.bleepingcomputer.com/ne...ons-affected-by-unpatched-mitm-vulnerability/

The Kubernetes Product Security Committee has provided advice on how to temporarily block attackers from exploiting a vulnerability that could enable them to intercept traffic from other pods in multi-tenant Kubernetes clusters in man-in-the-middle (MiTM) attacks.

Kubernetes (aka K8s), originally developed by Google and now maintained by the Cloud Native Computing Foundation, is an open-source system designed to help automate the deployment, scaling, and management of containerized workloads, services, and applications over clusters of hosts.
Affected services not widely deployed
The medium severity security issue is being tracked as CVE-2020-8554 and it was reported by Etienne Champetier of Anevia.
Click to expand...

CVE-2020-8554 is a design flaw that impacts all Kubernetes versions, with multi-tenant clusters that allow tenants to create and update services and pods being the most vulnerable to attacks.

"If a potential attacker can already create or edit services and pods, then they may be able to intercept traffic from other pods (or nodes) in the cluster," as Tim Allclair, a software engineer working on Kubernetes security at Apple, explained in a security advisory published on Monday.
"If you create a service with an arbitrary external IP, then traffic to that external IP from within the cluster will be routed to that service," Allclair added.
Click to expand...

guest · Jul 23, 2021

Kubernetes Cloud Clusters Face Cyberattacks via Argo Workflows
Misconfigured permissions for Argo’s web-facing dashboard allow unauthenticated attackers to run code on Kubernetes targets, including cryptomining containers
July 21, 2021
https://threatpost.com/kubernetes-cyberattacks-argo-workflows/167997/

Kubernetes clusters are being attacked via misconfigured Argo Workflows instances, security researchers are warning.

Argo Workflows is an open-source, container-native workflow engine for orchestrating parallel jobs on Kubernetes – to speed up processing time for compute-intensive jobs like machine learning and big-data processing. It’s also used to simplify container deployments in general. Kubernetes, meanwhile, is a popular container-orchestration engine for managing cloud deployments.
Click to expand...

Malware operators are dropping cryptominers into the cloud via Argo thanks to some instances being publicly available via dashboards that don’t require authentication for outside users, according to an analysis from Intezer. These misconfigured permissions thus can allow threat actors to run unauthorized code in the victim’s environment.

“In many instances, permissions are configured which allow any visiting user to deploy workflows,” according to the Intezer analysis, published Tuesday. “In instances when permissions are misconfigured, it is possible for an attacker to access an open Argo dashboard and submit their own workflow.”
Click to expand...

“Kubernetes … is one of the most popular repositories on GitHub, with over 100,000 commits and over 3,000 contributors,” Intezer researchers noted. “Each year there is a steady increase in enterprises using Kubernetes and the number of clusters they deploy. With these challenges that enterprises face using containers and Kubernetes clusters, there has never been a greater opportunity for attackers to exploit weaknesses in security…there is still always the possibility of misconfiguration or exploitation.”
Click to expand...

Intezer: New Attacks on Kubernetes via Misconfigured Argo Workflows

Key Points

Intezer has detected a new attack vector against Kubernetes (K8s) clusters via misconfigured Argo Workflows instances.

Attackers are already taking advantage of this vector as we detected operators dropping cryptominers using this method in the wild.

We have identified infected nodes and there is the potential for larger scale attacks due to hundreds of misconfigured deployments. We have detected exposed instances of Argo Workflows that belong to companies from different sectors including technology, finance and logistics.

Argo Workflows is an open-source, container-native workflow engine designed to run on K8s clusters.

Argo Workflows instances with misconfigured permissions allow threat actors to run unauthorized code on the victim’s environment.

Click to expand...

guest · Aug 24, 2021

Kubescape helps admins manage Kubernetes securely
August 24, 2021
https://www.helpnetsecurity.com/2021/08/24/kubescape-manage-kubernetes-securely/

Kubescape is an open-source tool for testing if Kubernetes is deployed securely, as defined in the recently released Kubernetes Hardening Guidance by NSA and CISA.
About Kubernetes (“K8s”)
Kubernetes is an open-source platform for automating the deployment, scaling, and management of application containers across clusters of hosts.

“We decided to OPA so the users can easily extend the tools with their own tests. We are currently running only the tests that are related to NSA and CISA recommendations and we focus on the most critical ones,” he told Help Net Security.
Click to expand...

Jonathan Kaftzan, VP Marketing & Business Development, ARMO, says their hope is to see Kubescape become a well-known and widely used tool by the DevOps and Kubernetes community.

“Our vision is to help the community with a simple but useful tool for scanning Kubernetes clusters to find security issues. We want to add more features like finding weak secrets and scanning containers for problems in the future,” he said.
Click to expand...

guest · Nov 1, 2021

Suse acquires NeuVector to bolster Kubernetes security
November 1, 2021
https://venturebeat.com/2021/11/01/suse-acquires-neuvector-to-bolster-kubernetes-security/

Enterprise-grade open source infrastructure software provider Suse has acquired NeuVector, a container security platform that helps companies secure their apps on any infrastructure.
Suse said the deal constitutes both cash and stock to a total valuation of $130 million.

The news comes as companies across the spectrum turn to the cloud as part of their broader digital transformation programs, with open source technologies such as Kubernetes pivotal to their efforts.
Click to expand...

Containers are software packages that “contain” all the components needed to run companies’ applications in any environment — across public clouds or private datacenters.
However, security remains a core concern for companies transitioning to the cloud, which is where Suse’s latest acquisition comes into play.

“With open source NeuVector, deploying NeuVector will be the premier choice to secure Kubernetes clusters, whether they are on premises, in the cloud, or in edge environments,” Liang wrote in a blog post.
Click to expand...

Suse: Accelerating Security Innovation at SUSE

Today, we are very excited to announce the acquisition of NeuVector, a leader in full lifecycle container security that delivers end-to-end security, from DevOps pipeline vulnerability protection to automated security and compliance in production. With this acquisition, NeuVector significantly enhances the enterprise-grade security capabilities in the SUSE Rancher container management platform.
Click to expand...

Log in or Sign up

Container code cluster-fact: There's a hole in Kubernetes that lets miscreants cause havoc

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Container code cluster-fact: There's a hole in Kubernetes that lets miscreants cause havoc

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches