Tokens are a powerful way of controlling the access to to Rest APIs. Chasing them should be hard. Unfortunately, there is a widespread habit of leaving tokens lying around allowing very powerful attack vectors. An attack demonstrates how to hack an OpenShift cluster, which is fully securty compliant to the accepted standards of NIST and CIS. Hijacking a container gives full control to the cluster, including host access. If running in the cloud, the cluster can be used for further attacks, because the host has another token to the cloud API server. With this token, arbitrary accounts and cloud resources can be controlled, including virtual machines, storage and derived accounts.
This will be part of a set of trainings on Kubernetes security, open sourced at https://github.com/thomasfricke/training-kubernetes-security
Speakers: Thomas Fricke