RBACdoors: How Cryptominers Are Exploiting RBAC Misconfigs - Greg Castle & Vinayak Goyal, Google
Abstract
Earlier this year you may have read news articles about cryptomining attacks using RBAC to backdoor clusters. We’ll talk about an attack of this type we observed on a cluster in March this year and demonstrate the attack step by step. We’ll cover how RBAC was misconfigured by the cluster owner to accidentally grant privileged access, how we detected the attack, and how we reconstructed the attacker’s actions from the logs. The attack techniques were interesting: the attacker masqueraded as K8s system components and used the certificates API to create new powerful access. We’ll discuss prevention and detection techniques for this kind of attack. We’ll also share some results of measuring similar RBAC misconfigurations across clusters to get a feel for how widespread these types of misconfigurations are in the industry.