Kubernetes (K8s) is an open-source orchestration platform that revolutionizes how organizations deploy, manage, and scale containerized applications. Many organizations use K8s for their cloud environment and on-premises due to its benefits, such as service discovery, load-balancing, and helf-healing. However, the misconfigurations in Role-Based Access Control (RBAC), exposed APIs on insecure ports, overly privileged containers, and vulnerabilities in container runtime or K8s lead to exploits. The goal of this research is to analyze critical vulnerabilities and exploits related to container cryptojacking, breakout, and privilege escalation, identify key logs from both Linux and K8s, and develop log correlation rules to detect unknown attacks in on-premises K8s. Using the Nunamaker methodology for a structured approach to information system development, the article begins with an introduction to the topic, contextualizes the research, reviews the state of the art, and identifies vulnerabilities and exploits in K8s. This is followed by a description of the modeling, implementation, and integration of the systems. Quantitative and qualitative evaluations of the systems and insights gained from these assessments conclude the paper.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Identifying and Analyzing Vulnerabilities and Exploits in On-Premises Kubernetes

  • Sunny Chowdhury,
  • Florian Freund

摘要

Kubernetes (K8s) is an open-source orchestration platform that revolutionizes how organizations deploy, manage, and scale containerized applications. Many organizations use K8s for their cloud environment and on-premises due to its benefits, such as service discovery, load-balancing, and helf-healing. However, the misconfigurations in Role-Based Access Control (RBAC), exposed APIs on insecure ports, overly privileged containers, and vulnerabilities in container runtime or K8s lead to exploits. The goal of this research is to analyze critical vulnerabilities and exploits related to container cryptojacking, breakout, and privilege escalation, identify key logs from both Linux and K8s, and develop log correlation rules to detect unknown attacks in on-premises K8s. Using the Nunamaker methodology for a structured approach to information system development, the article begins with an introduction to the topic, contextualizes the research, reviews the state of the art, and identifies vulnerabilities and exploits in K8s. This is followed by a description of the modeling, implementation, and integration of the systems. Quantitative and qualitative evaluations of the systems and insights gained from these assessments conclude the paper.