Initial access Execution Persistence Privilege escalation Defense evasion Credential access Discovery Lateral movement Collection Impact
Using Cloud Exec into Container Backdoor Container Privileged Container Clear Container Logs List K8s secrets Access the K8s API server Access cloud resources Images from a private repository Data Destruction
Compromised images in registry bash/cmd in container Writable hostPath mount Cluster-admin binding Delete k8s events Mount service principal Access Kubelet API Container service account Ressource hijacking
Kubeconfig file New container Kubernetes CronJob hostPath mount Pod / container name similarity Access container service account Network mapping Cluster internal networking Denial of Service
Application vulnerability Application exploit (RCE) Malicious admission controller Access cloud resources Connect from proxy server Applications credentials in configuration files Access Kubernetes dashboard Applications credentials in configuration files
Exposed sensitive interfaces SSH server running in inside container Disable Namespacing Access managed identity credentials Instance metadata API Writable volume mounts on the host
Sidecar injection Malicious admission controller CoreDNS poisoning
ARP poisoning and IP spoofing

Pod / container name similarity

Pods that are created by controllers such as Deployment or DaemonSet have random suffix in their names. Attackers can use this fact and name their backdoor pods as they were created by the existing controllers. For example, an attacker could create a malicious pod named coredns-{random suffix} which would look related to the CoreDNS Deployment.

Also, attackers can deploy their containers in the kube-system namespace where the administrative containers reside.

Example

The following deploys a pod in the kube-system namespace (assuming the attacker has the necessary permissions) with a name that looks as it is necessary for Kubernetes to work as intended. The same could also be done by using a Deployment.

$ kubectl get pods -n kube-system
NAME                                      READY   STATUS      RESTARTS   AGE
...
coredns-b96499967-r4zrt                   1/1     Running     0          32h

apiVersion: v1
kind: Pod
metadata:
  name: coredns-b96499967-r5zrt
  namespace: kube-system
spec:
  containers:
  - image: nginx # would in reality be a malicious image
    name: coredns

$ kubectl get pods -n kube-system
NAME                                      READY   STATUS      RESTARTS   AGE
...
coredns-b96499967-r4zrt                   1/1     Running     0          32h
...
coredns-b96499967-r5zrt                   1/1     Running     0          5s