Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kubernetes clusters being hijacked to mine cryptocurrencies

blog.binaryedge.io

Post reply on HN
Print view View original

11–20 of 67 posts

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#11

Post by tetha »

kevin_nisbet wrote: post #10
tetha wrote: post #8

Ugh. I mean, I recently got in an argument if anything but a hard firewall could or should be exposed to a WAN interface on the internet and we kinda agreed to not agree for now. But, popular services, on default ports, with default APIs enabled, without hard authentication on a WAN interface? That should be a paddling. That doesn't fly. Or, well it does, except not for the guy paying the power.

To be fair, kubernetes itself and most distributions are quite secure by default. So with kubernetes it's not the same as it was NoSQL databases that didn't have authentication that were bound to the internet. I'm not familiar with enough distributions to know if there is a popular distribution that totally disabled authentication by default, but in my companies distribution, kubeadm clusters, and I suspect all manag…

How do you provide your initial credentials, though? Providing decently secure default initial credentials is possible, but tricky.

And that's where I'll turn around 180 degrees and say: If you can't give me a hard reason why you'll be a hard target on the internet, you shouldn't have a public address. Default authentication isn't enough.

I dislike trusting my edge firewall, but it gives me time to handle weak internal systems.

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#13

Post by whalesalad »

Got in a pretty heated debate with a colleague once about this. We had a really great infrastructure setup with a VPN bastion host that would get you into our VPC. You couldn't reach any of our kube nodes externally. Your Google account was your VPN account. It was pretty solid.

When this engineer redid things they opted to go the public internet route where the master runs a public api and auth is done via a certificate. The logic here was so that external 3rd party stuff (CI) could control our master.

To my knowledge this setup is still running and chances are these machines are vulnerable to this issue.

Contrast to the prior setup where, immediately upon being offboarded from the company your VPN access became automatically terminated (thank you LDAP and Foxpass!)

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#14

Post by [deleted] »

whalesalad wrote: post #13

Got in a pretty heated debate with a colleague once about this. We had a really great infrastructure setup with a VPN bastion host that would get you into our VPC. You couldn't reach any of our kube nodes externally. Your Google account was your VPN account. It was pretty solid. When this engineer redid things they opted to go the public internet route where the master runs a public api and auth is done via a certifi…

[deleted]

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#15

Post by justicezyx »

nineteen999 wrote: post #4

This is one of the side-effects of products having enormous hype in this industry. Far too many people are adopting Docker/Kubernetes as they have been the hot new product for the last couple of years, often regardless of whether they are actually the best or most appropriate tool for the job. A lot of the people who get sucked into the hype are often inexperienced programmers, devops or admin types who are in positi…

Note K8s is designed to control a lot of machines, sometime the entire fleet of smbs.

So itself should be more sensitive than other infrastructure pieces.

And I think op meant to say that, not that k8s is particularly bad in security in general. Or k8s is less experienced in security.

The down vote is not warranted.

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#16

Post by honkycat »

whalesalad wrote: post #13

Got in a pretty heated debate with a colleague once about this. We had a really great infrastructure setup with a VPN bastion host that would get you into our VPC. You couldn't reach any of our kube nodes externally. Your Google account was your VPN account. It was pretty solid. When this engineer redid things they opted to go the public internet route where the master runs a public api and auth is done via a certifi…

I can't imagine a good reason to expose ANY of my services to the public internet. Aside from a rest-api that drives our application, where that is the feature of course.

With software like google IAP, and many similar products, it just seems silly.

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#17

Post by clubm8 »

Is anyone else a little tired of "X used to mine crypto" stories?

Yes - if it has a CPU and access to the public internet, someone will hack it and make it mine "cypto". Let's stop pretending we aren't aware that the internet of things exists and writing breathless stories every time a toaster, router, or adult toy starts churning out Monero.

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#18

Post by roguecoder »

clubm8 wrote: post #17

Is anyone else a little tired of "X used to mine crypto" stories? Yes - if it has a CPU and access to the public internet, someone will hack it and make it mine "cypto". Let's stop pretending we aren't aware that the internet of things exists and writing breathless stories every time a toaster, router, or adult toy starts churning out Monero.

This is an important vulnerability in widely-used software. Crypto is relevant because the inherent design of crypto makes hacks like this more profitable, but it's not the main thing about the article.

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#19

Post by outworlder »

justicezyx wrote: post #15
nineteen999 wrote: post #4

This is one of the side-effects of products having enormous hype in this industry. Far too many people are adopting Docker/Kubernetes as they have been the hot new product for the last couple of years, often regardless of whether they are actually the best or most appropriate tool for the job. A lot of the people who get sucked into the hype are often inexperienced programmers, devops or admin types who are in positi…

Note K8s is designed to control a lot of machines, sometime the entire fleet of smbs. So itself should be more sensitive than other infrastructure pieces. And I think op meant to say that, not that k8s is particularly bad in security in general. Or k8s is less experienced in security. The down vote is not warranted.

The "hype" part is pretty subjective and may have warranted down votes.

It's not hype if it solves a lot of organizations pain points.

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#20

Post by andrewstuart2 »

nineteen999 wrote: post #4

This is one of the side-effects of products having enormous hype in this industry. Far too many people are adopting Docker/Kubernetes as they have been the hot new product for the last couple of years, often regardless of whether they are actually the best or most appropriate tool for the job. A lot of the people who get sucked into the hype are often inexperienced programmers, devops or admin types who are in positi…

I disagree that hype leads to the problem you describe. Kubernetes is good at its job, and therefore it's popular, and therefore it's used by people who may not understand it.

You could say the exact same thing about Linux, Cisco, Dell, or pretty much any of the popular FOSS projects. Popular things, regardless of their complexity, get chosen by people of all experience levels. Inexperienced people are less likely to properly configure something, regardless of its popularity or hype.

If anything, having a few attractive projects tends to be beneficial (or at least neutral) for security as there are so many more people scrutinizing it, and many more people learning how to properly use it.

Post reply on HN