> Markdown version of [/videos/488-hacking-kubernetes-live-demo-marathon?t=2635](https://www.wearedevelopers.com/videos/488-hacking-kubernetes-live-demo-marathon?t=2635). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Hacking Kubernetes: Live Demo Marathon

How fast can a single npm dependency compromise your Kubernetes cluster? Watch this live demonstration break container isolation to prove why active intrusion tripwires are your only failsafe.

- **Speakers:** Andrew Martin
- **Event:** World Congress 2022
- **Published:** June 15, 2022
- **Duration:** 46:36
- **URL:** https://www.wearedevelopers.com/videos/488-hacking-kubernetes-live-demo-marathon

## Summary

Kubernetes environments often suffer from developer-led migrations where continuous security lags behind deployment velocity. This security gap leaves clusters vulnerable to a wide range of threat actors, from automated scripts to organized crime syndicates. Because "attackers think in graphs while defenders think in lists," malicious actors only need to identify one compromised pivot point to unravel a cluster system's entire architecture. By mapping the "four seasons" of Kubernetes security across code, containers, clusters, and the cloud, engineering teams can implement targeted threat models that adequately balance development speed with essential risk mitigation.

Live penetration testing demonstrations reveal just how quickly seemingly isolated environments can be compromised. The attack path often begins in the software supply chain, exploiting an NPM dependency's `preinstall` hook to force an unprivileged pod to exfiltrate data and spawn a reverse TCP shell out of context. From there, the attack escalates by abusing a misconfigured container sharing the host's PID namespace, enabling the attacker to break out onto the host machine. A separate, structural attack vector utilizes the "Dirty Pipe" kernel vulnerability to overwrite the host's `runc` binary via the `/proc/self/exe` symlink. Crucially, because Kubernetes and Docker disable username namespaces by default, gaining root access inside the container's microcosm effectively translates to establishing root dominance on the host runtime.

Once the container abstraction is shattered and the underlying Kubelet is rooted, attackers can easily enumerate overlapping node secrets—such as traversing into `/var/lib/kubelet/pods` to harvest mounted volumes and tokens. Although these extracted AWS keys could theoretically facilitate a complete cloud account takeover, they are revealed in the demonstration to be Canary Tokens. This final twist highlights the ultimate security takeaway: since preventative configurations and kernel-level abstractions will inevitably experience zero-day failures, deploying active intrusion detection tripwires is a non-negotiable failsafe for catching breaches before they escalate into systemic compromise.

**Keywords:** kubernetes security, threat modeling strategies, software supply chain attacks, npm preinstall hooks, reverse shell deployments, container breakout exploits, dirty pipe kernel vulnerability, runc binary overwrite, namespace misconfigurations, host pid unmasking, username namespaces, kubelet node secrets, cloud account takeover, aws canary tokens, intrusion detection tripwires, privilege escalation paths

## Chapters

1. **Mapping the attack surface of a Kubernetes cluster** (00:05) — Starting a penetration test requires understanding how Linux container namespaces and orchestrator abstractions interact.
1. **Threat modeling techniques for cloud native infrastructure** (04:24) — Modeling adversaries from script kiddies to organized crime helps build proportionate and cost-effective security controls.
1. **Executing a software supply chain attack with dependencies** (10:35) — Abusing execution hooks in package managers allows attackers to steal context and establish reverse shells.
1. **Breaking out of overprivileged pods using host mapping** (16:47) — Misconfigured security policies that share the host process ID space allow attackers to manipulate root namespaces.
1. **Escaping unprivileged containers using the Dirty Pipe exploit** (25:10) — Overwriting out-of-bounds executable memory via execution symlinks allows an attacker to gain a root shell directly on the underlying host node.
1. **Pivoting from a compromised kubelet to cloud accounts** (35:08) — Enumerating orchestrator-injected secrets mapped on host volumes reveals credentials that can escalate privileges into wider cloud environments.
1. **Discussing container privilege escalation and volume security risks** (43:55) — Audience questions clarify the limits of rootless containers and highlight security risks introduced by shared volume mounts.

## Related Moments

- [Live demonstration of vulnerability exploitation and zero trust mitigation](https://www.wearedevelopers.com/videos/100089-trust-issues-because-zero-trust-isn-t-optional-anymore) (from "Trust Issues: Because Zero-Trust Isn’t Optional Anymore")
- [Assessing common Kubernetes security incidents and misconfigurations](https://www.wearedevelopers.com/videos/1411-kubernetes-security-best-practices) (from "Kubernetes Security Best Practices")
- [Introduction to Kubernetes security challenges and opportunities](https://www.wearedevelopers.com/videos/412-kubernetes-security-challenge-and-opportunity) (from "Kubernetes Security - Challenge and Opportunity")
- [Executing a DNS exfiltration attack in Kubernetes](https://www.wearedevelopers.com/videos/100183-from-build-to-breach-hacking-kubernetes-through-the-supply-chain) (from "From Build to Breach: Hacking Kubernetes Through the Supply Chain")
- [Identifying software vulnerabilities and typical configuration weaknesses](https://www.wearedevelopers.com/videos/412-kubernetes-security-challenge-and-opportunity) (from "Kubernetes Security - Challenge and Opportunity")
- [Demonstrating a container escape using kernel vulnerabilities](https://www.wearedevelopers.com/videos/412-kubernetes-security-challenge-and-opportunity) (from "Kubernetes Security - Challenge and Opportunity")

## Related Articles

- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Learning Kubernetes made easy with KubeCampus](https://www.wearedevelopers.com/magazine/348-learning-kubernetes-made-easy-with-kubecampus)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)

## Related Jobs

- [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio**
- [Lead Cloud DevSecOps Engineer - Kubernetes](https://www.wearedevelopers.com/jobs/ext/1659167-lead-cloud-devsecops-engineer-kubernetes) at **BWI GmbH**
- [Platform Engineer (DevOps)](https://www.wearedevelopers.com/jobs/48264-platform-engineer-devops) at **WDW Consulting GmbH**
- [Staff Engineer - Offensive Security](https://www.wearedevelopers.com/jobs/ext/1226927-staff-engineer-offensive-security) at **Twilio**
- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Penetration Tester / Red team Specialist](https://www.wearedevelopers.com/jobs/ext/293774-penetration-tester-red-team-specialist) at **Raiffeisen Bank International AG**