PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Defeating Kubernetes Privilege Escalation: A Cloud Detection & Response Case Study

wiz.io | vulnerability | #cloud | #aws | #incident-response | #kubernetes | #privilege-escalation | #eks | #cloud-detection
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A case study of an attacker escalating from a Kubernetes cluster toward the AWS control plane, and how baseline-aware heuristics—an EC2 role querying resources from an odd IP—detected it early.
Published
Collected

Related coverage

research · calif.io
Privilege escalation in AWS Elastic Kubernetes Service
# Privilege escalation in AWS Elastic Kubernetes Service How a pod with the wrong permissions becomes control of the whole cluster. An Trinh and Duc Nguyen April 2, 2023 cloud Update · August 19,...
research · wiz.io
Announcing the EKS Cluster Games
A Wiz-sponsored cloud security CTF covering five real-world Amazon EKS misconfigurations: players act as the attacker in a controlled environment and earn certificates and leaderboard spots.
blog · wiz.io
LiteLLM Compromised, Steals Credentials
# LiteLLM Compromised, Steals Credentials In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a...
research · wiz.io
The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub
Wiz's Blue Agent walks through investigating a multi-platform data exfiltration campaign spanning AWS, S3 and GitHub, showing how the agent gathers evidence and reconstructs the full attack chain in minutes instead of hours.
blog · wiz.io
New attack vectors in EKS
Wiz Research maps attacker tactics against new Amazon EKS features: a compromised IAM identity can enumerate clusters through Access Entries APIs and pivot between cloud and cluster.
blog · wiz.io
New EKS Access Management and Pod Identity features: a security analysis
A security analysis of the new EKS Access Management and Pod Identity features: how they affect existing controls, the new pain points they introduce, and best practices for safe adoption.
Back