--- title: "Kubernetes security issues: An examination of major attacks" source: "https://www.tigera.io/blog/kubernetes-security-issues-an-examination-of-major-attacks/" description: "Analysis of TTPs can benefit security operations by providing a description of how threat actors performed their attacks." --- [Technical Blog](https://www.tigera.io/category/technical-blog/) # Kubernetes security issues: An examination of major attacks By [Manoj Ahuje](https://www.tigera.io/blog/author/manoj-ahuje/) on Aug 05, 2021 • 5 min read In a never-ending game of cat and mouse, threat actors are exploiting, controlling and maintaining persistent access in compromised cloud infrastructure. While cloud practitioners are armed with best-in-class knowledge, support, and security practices, it is statistically impossible to have a common security posture for all cloud instances worldwide. Attackers know this, and use it to their advantage. By applying evolved tactics, techniques and procedures (TTPs), attackers are exploiting edge cases. As a result, organizations like [Capital One](http://www.theverge.com/2019/7/31/20748886/capital-one-breach-hack-thompson-security-data), [Jenkins](http://www.csoonline.com/article/3256314/hackers-exploit-jenkins-servers-make-3-million-by-mining-monero.html), [Docker](http://www.eweek.com/security/docker-hub-breached-impacting-190-000-accounts) and many others have experienced high-profile breaches. TTPs are defined as “[patterns of activities or methods associated with a specific threat actor or group of threat actors](http://www.optiv.com/explore-optiv-insights/blog/tactics-techniques-and-procedures-ttps-within-cyber-threat-intelligence).” TTPs describe how threat actors (the bad guys) orchestrate, execute, and manage their operations attacks. Analysis of TTPs can benefit security operations by providing a description of how threat actors performed their attacks. Kubernetes is not immune to TTPs. Let’s examine some recent cases within the Kubernetes ecosystem. ## Case #1: Misconfigured Docker If you’re an attacker looking for misconfigured Docker instances to exploit, it’s as easy as probing open ports 2375, 2376, 2377, 4243, and 4244 on the internet. Vulnerable instances can also be located using search engines like [Shodan](http://www.shodan.io/). Organized threat actors like [TeamTNT](https://www.tigera.io/blog/teamtnt-latest-ttps-targeting-kubernetes/) have been observed using legitimate Kubernetes monitoring tools like Weave Scope to backdoor these Docker instances. In addition, Docker configuration flaws are being exploited by crypto-jacking malwares like [Cetus](http://unit42.paloaltonetworks.com/cetus-cryptojacking-worm/) and Graboid, and orchestrated campaigns exploiting CI/CD tools are a threat. Vulnerable Docker instances have also been targeted by DDoS malwares like [XORDDoS and Kaiji](http://www.trendmicro.com/en_us/research/20/f/xorddos-kaiji-botnet-malware-variants-target-exposed-docker-servers.html), which use those resources to increase their DDoS capacity. For organizations that are using Docker, deploying cloud provider firewalls—like AWS security groups—as a defense is absolutely essential. Consider investing in observability tools to monitor running containers, CPU utilization, and network activity. Security teams can also benefit from embedding threat intelligence into the cloud and monitoring risk thresholds. ## Case #2: Malicious Docker images Public image repositories have become an easy tool for distributing malicious images disguised as custom configurations. An example that illustrates the reach of this attack vector is an [incident with Docker hub](http://arstechnica.com/information-technology/2018/06/backdoored-images-downloaded-5-million-times-finally-removed-from-docker-hub/), where a malicious image was pulled 5 million times before being removed. This underscores the need to check your base image sources, regardless of whether you are creating your own, or using images from a public repository. Forensic analysis tools like [dive](http://github.com/wagoodman/dive) (as well as Docker itself) can help you check image history. ## Case #3: Unintentional cluster misconfiguration A considerable amount of trust is placed in cloud providers to configure, patch, and manage Kubernetes security on our behalf. Sometimes, however, things can fall through the cracks. Even the most highly trusted cloud services can be susceptible to configurations that unwittingly enable privilege escalation and facilitate the takeover of the cluster. A [blog post](http://blog.christophetd.fr/privilege-escalation-in-aws-elastic-kubernetes-service-eks-by-compromising-the-instance-role-of-worker-nodes/) by Christophe Tafani-Dereeper demonstrates the disastrous consequences that compromising a pod in the cluster can have on resources in an AWS account, if access to the Instance Metadata Service (IMDS) is not explicitly blocked. The unlucky author reached the metadata service from a compromised pod to retrieve an Identity and Access Management (IAM) role credential. Unfortunately, by default, the IAM role had too many permissions, resulting in privilege escalation. In hindsight, this could have been preventable through continuous auditing of managed environments and early detection of security gaps. ## Kubernetes vs. Kubernetes Occasionally, Kubernetes can be its own worst enemy. Components like kubelet, controller-manager, and etcd can be exploited with the goal of obtaining a higher level of privilege and persistence in the cluster. Remote code execution inside a container can be accomplished using [kubelet’s unauthenticated, undocumented API](http://securityboulevard.com/2020/08/using-kubelet-client-to-attack-the-kubernetes-cluster/). Kubernetes threat actor TeamTNT is seen exploiting this flaw in the wild. Rhino Security Labs showed how an [attacker can join as a fake worker node](http://rhinosecuritylabs.com/cloud-security/kubelet-tls-bootstrap-privilege-escalation/). Here are some other ways that Kubernetes can be used against itself… - A second kubelet can be run on a node so that the same node will be part of two different clusters, one of which will be attacker controlled. - Privileged pods can escape containers and provide root access to the host by abusing Linux functionality like CGROUPs. - If a hostnetwork enabled pod is present, it can attack an underlay network on Kubernetes. - A malicious webhook can intercept and modify requests made to the Kubernetes API. This is evasive and hard to detect in production clusters. - The pod network can be used to exploit VXLAN and IPIP networks in the Kubernetes cluster. - Using insecure root mounts, the host filesystem can be accessed inside a pod. - Kubernetes CronJobs/jobs can be used to backdoor the cluster. - Pod default tokens can be used to get access to privileged resources, if misconfigured. - Kubernetes ExternalIPs can be used in MITM attacks. ## Summary Constant vigilance is required to ensure that cloud infrastructure is locked down, and that DevSecOps teams have the right tools for the job. Cloud adds a new dimension and increases an organization’s attack surface. Even a classic CVE can become a greater threat when cloud is factored into the equation. To effectively respond to this new security paradigm, it’s critical for cloud security teams to understand the impact of each of these CVEs and be prepared to apply mitigation when they are detected. Threat actors are using evolved TTPs to exploit, control and maintain persistent access in compromised cloud infrastructure. Early detection of anomalous behavior is paramount, and can go a long way in speeding detection, investigation and mitigation of threats. Using the most recent advances in data science and machine learning techniques, organizations must bolster their cloud observability capabilities, regularly audit their environment, and apply the latest security patches as they become available.   ***Want to learn more about cyber threat protection strategies and tactics for Kubernetes? Read about the [latest eBPF vulnerability, its impact on Kubernetes, and how to mitigate it](https://www.tigera.io/blog/cve-2021-31440-kubernetes-container-escape-using-ebpf/).***   [Kubernetes Vulnerabilities](https://www.tigera.io/tags/kubernetes-vulnerabilities/) ## Related posts [![Cybernews Expert Interview with Tigera President and CEO, Ratan Tipirneni](https://www.tigera.io/app/uploads/2023/07/Cybernews-Expert-Interview-with-Tigera-President-and-CEO-Ratan-Tipirneni.png)](https://www.tigera.io/blog/cybernews-expert-interview-with-tigera-president-and-ceo-ratan-tipirneni/) [Company Blog](https://www.tigera.io/category/company-blog/) #### [Cybernews Expert Interview with Tigera President and CEO, Ratan Tipirneni](https://www.tigera.io/blog/cybernews-expert-interview-with-tigera-president-and-ceo-ratan-tipirneni/) By [Laura Ferguson](https://www.tigera.io/blog/author/laura-ferguson/) on Jul 27, 2023 The challenges companies face regarding private and professional data protection are more important today than ever. In the modern enterprise, cloud computing and the use of cloud-native architectures enable unmatched performance, flexibility, velocity, and innovation.... [Read more](https://www.tigera.io/blog/cybernews-expert-interview-with-tigera-president-and-ceo-ratan-tipirneni/) [![How to Detect and Stop Ddos Attacks in a Kubernetes Environment](https://www.tigera.io/app/uploads/2023/06/How-to-detect-and-stop-DDoS-attacks-in-a-Kubernetes-environment.png)](https://www.tigera.io/blog/how-to-detect-and-stop-ddos-attacks-in-a-kubernetes-environment/) #### [How to Detect and Stop Ddos Attacks in a Kubernetes Environment](https://www.tigera.io/blog/how-to-detect-and-stop-ddos-attacks-in-a-kubernetes-environment/) By [Giri Radhakrishnan](https://www.tigera.io/blog/author/giri-radhakrishnan/) on Jun 22, 2023 DDoS or Distributed Denial of Service attacks have been around for a while and are notorious and painful to deal with (as with any other attack). As the name suggests, a DDoS attack causes an... [Read more](https://www.tigera.io/blog/how-to-detect-and-stop-ddos-attacks-in-a-kubernetes-environment/) [![Encryption in container environments](https://www.tigera.io/app/uploads/2023/05/Encryption-in-container-environments.png)](https://www.tigera.io/blog/encryption-in-container-environments/) #### [Encryption in container environments](https://www.tigera.io/blog/encryption-in-container-environments/) By [Chris Man](https://www.tigera.io/blog/author/chris-man/) on Jun 1, 2023 Kubernetes has become the de facto standard for container orchestration, providing a powerful platform for deploying and managing containerized applications at scale. As more organizations adopt Kubernetes for their production workloads, ensuring the security and... [Read more](https://www.tigera.io/blog/encryption-in-container-environments/)