Analysis of a Kubernetes Hack

Re:Analysis of a Kubernetes Hack by alpb on Tuesday March 13, 2018 @04:33PM (#16579522)

I'm trying to understand what the issue here was. Did they publicly expose the kubelet port on the internet?

[ Parent | on HN ]

Re:Analysis of a Kubernetes Hack by jc_sec on Tuesday March 13, 2018 @04:39PM (#16579576)

Yep. The kubelet ports were exposed. From the article:

As it turns out, our coworker’s server was also publicly exposing the kubelet ports (tcp 10250, tcp 10255). Although the problem here was obvious, it should raise some questions about your own Kubernetes deployment, as it did for us.

[ Parent | on HN ]

Re:Analysis of a Kubernetes Hack by jc_sec on Tuesday March 13, 2018 @05:10PM (#16579816)

Try a quick nmap scan on an AWS or Google IP range for tcp port 10250 to see some scary results.

[ Parent | on HN ]