Awesome Cloud Native Security
This repository is used to collect AWESOME resources on the topic of cloud native security found during research.
Note:
- All resources will be suffixed and ordered by date of conferences, blogs or other formats of publication, if applicable.
- Resources in sub-list are related to their parent entries.
- For simplicity, resources would NOT be duplicated in two or more topics. For example, some resources about Escape of Windows Server Containers are within topic Windows Containers.
- Contributions are welcome & appreciated :)
0 General
- OWASP Cloud-Native Application Security Top 10
- Hacking and Hardening Kubernetes Clusters by Example (KubeCon 2017)
- 2018Lu Meng Ke Ji Rong Qi An Quan Ji Zhu Bao Gao (2018-11)
- A Measurement Study on Linux Container Security: Attacks and Countermeasures (ACSAC 2018)
- Kubernetes Security: Operating Kubernetes Clusters and Applications Safely (Book, 2018-09-28)
- MITRE ATT&CK framework for container runtime security with Falco. (2019-05-10)
- Threat matrix for Kubernetes (Microsoft, 2020-04-02)
- Guo Nei Shou Ge Yun Shang Rong Qi ATT&CKGong Fang Ju Zhen Fa Bu ,A Li Yun Zhu Li Qi Ye Rong Qi Hua An Quan Luo Di (2020-06-18)
- MITRE ATT&CK Containers Matrix (2021-04-29)
- Zui Jia Shi Jian :Fa Bu Guo Nei Shou Ge K8S ATT&CKGong Fang Ju Zhen (Qing Teng , 2021-08-25)
- 2021Xi Bu Yun An Quan Feng Hui Zhao Kai :"Yun An Quan You Cai Ji Hua "Fa Bu ,Teng Xun Yun An Quan Gong Fang Ju Zhen Liang Xiang (2021-09-26)
- Yun Yuan Sheng An Quan :Ji Yu Rong Qi ATT&CKJu Zhen Mo Ni Gong Fang Dui Kang De Si Kao (2021-11-01)
- Containers' Security: Issues, Challenges, and Road Ahead (IEEE Access 2019)
- Qi Ye Ying Yong Rong Qi Hua De Gong Yu Fang (JINQI-CON 2019)
- Sysdig 2021 Container Security and Usage Report (2021-01-01)
- CNCF Cloud Native Security Whitepaper (2021-02-17)
- Metarget:Yun Yuan Sheng Gong Fang Ba Chang Kai Yuan La ! (2021-05-10)
- keonteineoeseo beogeu cajgi eodiggaji haebwassni (How to Find Container Platform Bug, CodeEngn 2021)
- Kubernetes Hardening Guidance (by NSA & CISA, 2021-08-03)
- Kubernetes Security Checklist and Requirements
- <
> - Security Challenges in the Container Cloud (IEEE TPS-ISA 2021)
1 Offensive
1.1 General
- Container Security: Examining Potential Threats to the Container Environment (2019-05-14)
- Yun Yuan Sheng Huan Jing Shen Tou Gong Ju Kao Cha (2020-06-22)
- Hong Lan Dui Kang Zhong De Yun Yuan Sheng Lou Dong Wa Jue Ji Li Yong Shi Lu (2021-03-02)
- Ba Ji Shi Yan :Zong He Chang Jing Xia De Shen Tou Shi Zhan
- Exploit Symlink for Fun and Profit: from Native to Cloud Native (2021-12-08)
1.2 Kubernetes
1.2.1 General
- Walls Within Walls: What if your attacker knows parkour? (KubeCon 2019)
- k0otkit:Zhen Dui K8sJi Qun De Tong Yong Hou Shen Tou Kong Zhi Ji Zhu (CIS 2020)
- Advanced Persistence Threats: The Future of Kubernetes Attacks (RSA 2020)
- Compromising Kubernetes Cluster by Exploiting RBAC Permissions (RSA 2020)
- Kubernetes Privilege Escalation: Excessive Permissions in Popular Platforms
- Command and KubeCTL: Real-world Kubernetes Security for Pentesters (Shmoocon 2020)
- Using Kubelet Client to Attack the Kubernetes Cluster (2020-08-19)
- Attacking Kubernetes Clusters Through Your Network Plumbing: Part 1 (2020-11-05)
- Metadata service MITM allows root privilege escalation (EKS / GKE) (2021-02-28)
- etcdWei Shou Quan Fang Wen De Feng Xian Ji Xiu Fu Fang An Xiang Jie (2021-04-09)
- New Attacks on Kubernetes via Misconfigured Argo Workflows (2021-07-20)
- Creating Malicious Admission Controllers (2021-08-09)
- Don't let Prometheus Steal your Fire (2021-10-12))
- Attack Cloud Native Kubernetes (HITB 2021)
- Metasploit in Kubernetes (2021-11-04)
- [(Ji Zhu Tui Jian )] Yun Yuan Sheng Zhi KubernetesAn Quan (2021-12-18)
1.2.2 Vulnerabilities and Exploits
- Understanding about CVE-2017-1002101 on kubernetes (2018-03-19)
- Exploiting path traversal in kubectl cp (CVE-2018-1002100, 2018-05-04)
- Disclosing a directory traversal vulnerability in Kubernetes copy - CVE-2019-1002101 (2019-03-28)
- CVE-2019-11246: Clean links handling in cp's tar code (2019-04-30)
- CVE-2019-11249: Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal (2019-08-05)
- CVE-2019-11251: kubectl cp symlink vulnerability (2020-02-03)
- The Story of the First Kubernetes Critical CVE (CVE-2018-1002105, 2018-12-04)
- CVE-2018-1002103:Yuan Cheng Dai Ma Zhi Xing Yu Xu Ni Ji Tao Yi
- Kubernetes hostPort allow services traffic interception when using kubeproxy IPVS (CVE-2019-9946, 2019-03-28)
- Non-Root Containers, Kubernetes CVE-2019-11245 and Why You Should Care, (2019-08-28)
- When it's not only about a Kubernetes CVE... (CVE-2020-8555, 2020-06-03)
- Kubernetes Vulnerability Puts Clusters at Risk of Takeover (CVE-2020-8558, 2020-07-27)
- Kubernetes man in the middle using LoadBalancer or ExternalIPs (CVE-2020-8554, 2020-12-08)
- Host MITM attack via IPv6 rogue router advertisements (K8S CVE-2020-10749 / Docker CVE-2020-13401 / LXD / WSL2 / ...) (2021-02-28)
- Exploiting and detecting CVE-2021-25735: Kubernetes validating admission webhook bypass (2021-04-28)
- Detecting and Mitigating CVE-2021-25737: EndpointSlice validation enables host network hijack (2021-05-24)
- Qian Tan Yun Shang Gong Fang ----CVE-2020-8562Lou Dong Wei k8sDai Lai De An Quan Tiao Zhan (2021-10-25)
- cr8escape: New Vulnerability in CRI-O Container Engine Discovered by CrowdStrike (CVE-2022-0811)
1.3 Container
1.3.1 General
- Abusing Privileged and Unprivileged Linux Containers (2016-06-01)
- Bypassing Docker Authz Plugin and Using Docker-Containerd for Privesc (2019-07-11)
- A Methodology for Penetration Testing Docker Systems (Bachelor Theses, 2020-01-17)
- Li Ying Wai He :Jie Rong Qi rootTi Quan (2020-12-03)
- CVE-2021-21287: Rong Qi Yu Yun De Peng Zhuang ----Yi Ci Dui MinIODe Ce Shi (2021-01-30)
- New Vulnerability Affecting Container Engines CRI-O and Podman (CVE-2021-20291) (2021-04-14)
1.3.2 Container Escape
- Container escape through open_by_handle_at (shocker exploit) (2014-06-18)
- Dirty COW - (CVE-2016-5195) - Docker Container Escape (2017-09)
- Escaping Docker container using waitid() - CVE-2017-5123 (2017-12-27)
- A Compendium of Container Escapes (Black Hat 2019)
- In-and-out - Security of Copying to and from Live Containers (Open Source Summit 2019)
- CVE-2019-5736: Escape from Docker and Kubernetes containers to root on host (2019-02-13)
- An Exercise in Practical Container Escapology (2019-03-07)
- Felix Wilhelm's Twitter on the Escape Technique utilizing release_agent (2019-07-17)
- Kubernetes Pod Escape Using Log Mounts (2019-08-01)
- Original Tweet on CVE-2019-16884 (2019-09-22)
- CVE-2019-19921: Volume mount race condition with shared mounts (2020-01-01)
- Rong Qi Tao Yi Ji Zhu Gai Lan (2020-02-21)
- Escaping Virtualized Containers (Black Hat 2020)
- CVE-2020-14386: Privilege Escalation Vulnerability in the Linux kernel (2020-10-09)
- hostMo Shi Rong Qi Tao Yi Lou Dong (CVE-2020-15257)Ji Zhu Fen Xi (2020-12-02)
- The Strange Case of How We Escaped the Docker Default Container (CVE-2020-27352, 2021-03-04)
- runc mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs (CVE-2021-30465, 2021-05-30)
- Li Yong LinuxNei He Lou Dong Shi Xian DockerTao Yi (2021-06-11)
- [(An Quan Gan Huo )] Docker CVE-2018-6552 (2021-06-30)
- CVE-2021-22555: Turning \x00\x00 into 10000$ (2021-07-07)
- With Friends like eBPF, who needs enemies? (Defcon 29)
- Container Escape in 2021 (HITB 2021)
- Finding Azurescape - Cross-Account Container Takeover in Azure Container Instances (2021-09-09)
- Yun Yuan Sheng An Quan Gong Fang |Shi Yong eBPFTao Yi Rong Qi Ji Zhu Fen Xi Yu Shi Jian (2021-11-03)
- Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration (CVE-2021-43784, 2021-12-06)
- Podman Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-2023-0778)
- Attacks are Forwarded: Breaking the Isolation of MicroVM-based Containers Through Operation Forwarding
1.3.3 Container DoS
- Houdini's Escape: Breaking the Resource Rein of Linux Control Groups (CCS 2019)
- DockerZu Jian Jian Biao Zhun Shu Ru Shu Chu Fu Zhi De DoSGong Ji Fen Xi (Wang Luo Xin Xi An Quan Xue Bao 2020)
- Demons in the Shared Kernel: Abstract Resource Attacks Against OS-level Virtualization (CCS 2021)
1.4 Serverless
- Hacking Serverless Runtimes (Black Hat 2017)
- Serverless Toolkit for Pentesters (2018-11-11)
- Serverless Red Team Infrastructure: Part 1, Web Bugs (2018-09)
- Zhen Dui AWS LambdaDe Yun Xing Shi Gong Ji (2020-12-02)
- How We Escaped Docker in Azure Functions (2021-01-27)
- RTYou Wan Xin Tao Lu ,Jing Ran Zhe Yang Yin Cang C2 (2021-04-21)
- CDN+FaaSDa Zao Gong Ji Qian Zhi (2021-08-11)
1.6 Service Mesh
- A Survey of Istio's Network Security Features (2020-03-04)
- IstioFang Wen Shou Quan Zai Pu Gao Wei Lou Dong (CVE-2020-8595, 2020-03-13)
- Attack in a Service Mesh (CIS 2020)
- Istio Security Assessment (2021-07-13 (disclosed), 2020-08-06 (accomplished) by Istio with NCC Group)
1.7 API Gateway
1.8 Windows Containers
- Well, That Escalated Quickly! How Abusing Docker API Led to Remote Code Execution, Same Origin Bypass and Persistence in The Hypervisor via Shadow Containers (Black Hat 2017)
- What I Learned from Reverse Engineering Windows Containers (2019-12-12)
- Windows Server Containers Are Open, and Here's How You Can Break Out (2020-07-15)
- Who Contains the Containers? (Project Zero, 2021-04-01)
1.9 Tools
- kube-hunter - Hunt for security weaknesses in Kubernetes clusters
- serverless_toolkit - A collection of useful Serverless functions I use when pentesting
- kubesploit
- kubeletmein - Security testing tool for Kubernetes, abusing kubelet credentials on public cloud providers
- CDK - Zero Dependency Container Penetration Toolkit
- Metarget - framework providing automatic constructions of vulnerable infrastructures
- red-kube - Red Team K8S Adversary Emulation Based on kubectl
- whoc - A container image that extracts the underlying container runtime
- kdigger - A context discovery tool for Kubernetes penetration testing
2 Defensive
2.1 Standards and Benchmarks
- NIST.SP.800-190 Application Container Security Guide (2017-09-25)
- NIST.IR.8176 Security Assurance Requirements for Linux Application Container Deployments (2017-10)
- OWASP Container Security Verification Standard
- CIS Kubernetes Benchmark
- CIS Docker Benchmark
- NIST.SP.800-204 Security Strategies for Microservices-based Application Systems (2019-08)
2.2 Kubernetes
2.3 Container
- Understanding and Hardening Linux Containers (2016-06-29)
- Tan Suo Sysdig Falco:Rong Qi Huan Jing Xia De Yi Chang Xing Wei Jian Ce Gong Ju (2019-09-25)
- Yun Yuan Sheng Zhi Rong Qi An Quan Shi Jian (2020-03-12)
- Rong Qi Huan Jing Xiang Guan De Nei He Lou Dong Huan Jie Ji Zhu (2020-08-31)
- Detecting a Container Escape with Cilium and eBPF
2.4 Secure Container
- Making Containers More Isolated: An Overview of Sandboxed Container Technologies (2019-06-06)
- Shen Du Jie Xi AWS Firecracker Yuan Li Pian - Xu Ni Hua Yu Rong Qi Yun Xing Shi Ji Zhu (2019-12-09)
- Yi DockerWei Dai Biao De Chuan Tong Rong Qi Dao Liao Sheng Si Cun Wang Zhi Ji (2019-12-24)
- Kata ContainersChuang Shi Ren :An Quan Rong Qi Dao Lun (2019-12-26)
2.5 Network
2.6 Practices
- Guo Wai Ding Jian Rong Qi An Quan Chan Pin Shi Zen Yao Zuo De (2020-12-04)
- Yun Yuan Sheng |Rong Qi He Ying Yong An Quan Yun Ying Shi Jian Si Kao (2021-09-07)
2.7 Tools
- docker-bench-security
- kube-bench
- KubiScan
- Falco
- Elkeid - Elkeid is a Cloud-Native Host-Based Intrusion Detection solution project to provide next-generation Threat Detection and Behavior Audition with modern architecture
- kubescape - kubescape is the first tool for testing if Kubernetes is deployed securely as defined in Kubernetes Hardening Guidance by to NSA and CISA
- veinmind-tools
- cnspec - cloud-native security and policy project
3 Incidents
- Lessons from the Cryptojacking Attack at Tesla (2018-02-20)
- Graboid: First-Ever Cryptojacking Worm Found in Images on Docker Hub (2019-10-15)
- Detect large-scale cryptocurrency mining attack against Kubernetes clusters (2020-04-08)
- Coinminer, DDoS Bot Attack Docker Daemon Ports (2020-05-06)
- TeamTNTTuan Huo Dui DockerZhu Ji Fa Qi Gong Ji Huo Dong ,Zhi Ru Wa Kuang Mu Ma (2020-08-04)
- Team TNT - The First Crypto-Mining Worm to Steal AWS Credentials (2020-08-16)
- Cetus: Cryptojacking Worm Targeting Docker Daemons (2020-08-27)
- Black-T: New Cryptojacking Variant from TeamTNT (2020-10-05)
- TeamTNT Wa Kuang Mu Ma Li Yong Docker Remote APIWei Shou Quan Fang Wen Lou Dong Ru Qin Yun Fu Wu Qi (2020-11-27)
- TeamTNT Now Deploying DDoS-Capable IRC Bot TNTbotinger (2020-12-18)
- Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes (2021-02-03)
- TeamTNT Targets Kubernetes, Nearly 50,000 IPs Compromised in Worm-like Attack (2021-05-25)
- Tracking the Activities of TeamTNT: A Closer Look at a Cloud-Focused Malicious Actor Group (2021-06)
- TeamTNT Actively Enumerating Cloud Environments to Infiltrate Organizations (2021-06-04)
- TeamTNT with new campaign aka "Chimaera" (2021-09-08)
- Team TNT Deploys Malicious Docker Image On Docker Hub (2021-10-07)
- Zai Ci Bu Huo Yun Shang Zai Ye Rong Qi Gong Ji ,TeamTNTHei Chan Gong Ji Fang Fa Jie Mi (2021-10-20)
- Compromised Docker Hub Accounts Abused for Cryptomining Linked to TeamTNT (2021-11-09)
- Misconfigured Kubeflow workloads are a security risk (2020-06-10)
- Jian Quan Pei Zhi Bu Dang ,Ruan Chong Zai Zi Jian K8sJi Qun Zi You Chu Ru (2020-09-16)
- Siloscape: First Known Malware Targeting Windows Containers to Compromise Cloud Environments (2021-06-07)
- NSA, Partners Release Cybersecurity Advisory on Brute Force Global Cyber Campaign (2021-07-01)
- DockerHubZai Xian Bai Mo Xia Zai Liang Hei Chan Jing Xiang ,Xiao Xin Ni De Rong Qi Bei Wa Kuang (2021-08-30)
- Misconfigured Kafdrop Puts Companies' Apache Kafka Completely Exposed (2021-12-06)