Kubernetes Privilege Escalation: Container Escape == Cluster Admin?

An exploration of how attackers can abuse system pods in popular Kubernetes platforms to escalate privileges.

In this talk, Yuval and Shaul will reveal the powerful system pods quietly installed by popular Kubernetes platforms. They'll show how attackers may abuse these pods, and demo new privilege escalation techniques. Covering managed Kubernetes services and common open-source add-ons, they'll demonstrate how on the most popular platforms today - a single container escape is often enough to take over the entire cluster. Looking ahead, they'll present tools that flush out powerful pods and identify privilege escalation paths in a cluster, alongside mitigations that can detect and prevent such attacks. Join them as they embark on the journey of ensuring container escape != cluster admin. Presented by Yuval Avrahami & Shaul Ben Hai Full Abstract & Presentation Materials: blackhat.com/us-22/briefings/schedule/#kubernetes-privilege-…