Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kubescape – tool for testing if Kubernetes is deployed securely

github.com

Post reply on HN
Print view View original

81–90 of 104 posts

Re: Kubescape – tool for testing if Kubernetes is deployed securely

#81

Post by anotherhue »

reissbaker wrote: post #52
sildur wrote: post #22

Earlier quoted context omitted.

There is a vast community who thinks it's bad, and unsafe (with examples on how to detect direct piping to bash in order to serve malware) and a few ones condoning it. That seems like saying there is currently a debate on the roundness of the planet Earth.

Ultimately, the only insecure thing about curl-to-bash is if you don't trust the server — the server in this case being Github. I think few people or companies include Github-being-malicious in their threat model; if Github was malicious, any build artifacts produced by even cloning from Github would be potentially suspect, since Github could fairly easily detect automated build agents and serve them different conten…

OP. Of course if there's trusted parties along the way it's safe enough. But it is not durable to that trust being broken. e.g. if the user has learned to do this, and ends up through typo squatting on a malevolent fork of their code.

If it's okay on GH, we train the user to think it's okay on less secure sites.

Re: Kubescape – tool for testing if Kubernetes is deployed securely

#82

Post by anotherhue »

mishafb wrote: post #65
rjzzleep wrote: post #62

Earlier quoted context omitted.

I'm not going to go into the curl|sh debate, but there is actually something wrong about what you described. Trusting the server doesn't apply to Github at all. Github is technically like a bazaar or mall. It's wrong to assume that if you trust a store on the bazaar you then trust ALL stores on the bazaar. You personally may, but then I strongly question your sense of security. Sure, you trust that Github doesn't add…

This is equivalent to running a Makefile or a pre-built executable as your user which you're bound to do anyway

It is unusual for an executable to install itself, and good Makefile practices has a separate install stage than a build stage.

No doubt, these conventions can be and are ignored, but they are good conventions.

Re: Kubescape – tool for testing if Kubernetes is deployed securely

#83

Post by anotherhue »

kentonv wrote: post #31
sildur wrote: post #22

Earlier quoted context omitted.

There is a vast community who thinks it's bad, and unsafe (with examples on how to detect direct piping to bash in order to serve malware) and a few ones condoning it. That seems like saying there is currently a debate on the roundness of the planet Earth.

Yes, it's exactly like that, but not in the way you think. One side is a small-but-vocal minority making silly arguments. "how to detect direct piping to bash in order to serve malware"? An attacker who tries to serve different things to different people will easily be caught, and a simple diff will highlight their exploit. A much more robust attack strategy is to serve the same malware to everyone but obfuscate it.…

> An attacker who tries to serve different things to different people will easily be caught

Can be detected, and will be detected are quite different. I don't know of any scanning projects even attempting to detect such things.

Re: Kubescape – tool for testing if Kubernetes is deployed securely

#84

Post by gatlin »

kyrra wrote: post #59
kgarten wrote: post #41

There's CIS KubeBench and OpenSCAP as other comments mentioned. I don't trust an organization that keeps Zero days to themselves for offensive capabilities.

The NSA is much like the FBI, it has multiple divisions with different purposes. The NSA has one group that is specifically focused on the security of US public and private entities. They help to find standards that the rest of the US bureaucracy follows to keep their systems secure. On the other hand, the NSA does have hacking hand that is supposed to go after foreign adversaries, and this is the group that will use…

For me you have justified precisely why I agree with the parent comment.

Re: Kubescape – tool for testing if Kubernetes is deployed securely

#85

Post by chmod-777 »

ButterWashed wrote: post #24

Does the NSA/CISA advice differ significantly from CIS? KubeBench does a great job of CIS assessment.

There is also an implementation difference between the two, while KubeBench requires installation within the cluster, Kubescape runs as CLI from any computer using Kube API, so it can be added to any CI/CD pipeline very easily, also the latest version enables you to scan YAML files before you deploy them so you know early on whether you are compliant.

Re: Kubescape – tool for testing if Kubernetes is deployed securely

#87

Post by raesene9 »

ButterWashed wrote: post #24

Does the NSA/CISA advice differ significantly from CIS? KubeBench does a great job of CIS assessment.

The NSA doesn't really do a full coverage of Kubernetes security hardening, but does touch on a lot of the same ground as the CIS benchmark.

It also covers some areas that aren't in-scope of the CIS benchmark, at a high level.

Re: Kubescape – tool for testing if Kubernetes is deployed securely

#88

Post by raesene9 »

geofft wrote: post #15
anotherhue wrote: post #13

I politely suggest that a security focused tool should not further the curl|bash pattern.

What alternative pattern would you suggest?

Using cosign/sigstore to sign release artifacts https://github.com/sigstore/cosign and instructions for validating signature on download could be a good option here.

Re: Kubescape – tool for testing if Kubernetes is deployed securely

#89

Post by uzakov »

capableweb wrote: post #73
asjfj9 wrote: post #71

I feel like installing a security tool by curling a random script off the internet and piping it into `/bin/bash` is a bit contradictory. Surely there's a better way to install this?

If you're smart enough to realize that there might be something to worry about, you should be smart enough to be able to figure out how to divide the command into three parts instead of one (download the script, inspect the contents and then run the same inspected [local] script). Every time a project with curl | sh is featured on HN this comes up. At this point we might as well write a bot that scrapes submitted pag…

> If you're smart enough to realize that there might be something to worry about, you should be smart enough to be able to figure out how to

This is gatekeeping 101. Some people are just starting out in security/software engineering and things like this might not be obvious to them. It's good that you have suggested what to do but there are different ways to "suggest" things.

Re: Kubescape – tool for testing if Kubernetes is deployed securely

#90

Post by kovek »

uzakov wrote: post #89
capableweb wrote: post #73

Earlier quoted context omitted.

If you're smart enough to realize that there might be something to worry about, you should be smart enough to be able to figure out how to divide the command into three parts instead of one (download the script, inspect the contents and then run the same inspected [local] script). Every time a project with curl | sh is featured on HN this comes up. At this point we might as well write a bot that scrapes submitted pag…

> If you're smart enough to realize that there might be something to worry about, you should be smart enough to be able to figure out how to This is gatekeeping 101. Some people are just starting out in security/software engineering and things like this might not be obvious to them. It's good that you have suggested what to do but there are different ways to "suggest" things.

So ‘curl; cat; bash’ and not ‘curl | sh’ because the server can detect the pace/existence of the pipe and sneak in some unsafe commands.
Post reply on HN