Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kubernetes clusters being hijacked to mine cryptocurrencies

blog.binaryedge.io

Post reply on HN
Print view View original

21–30 of 67 posts

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#21

Post by justicezyx »

outworlder wrote: post #19
justicezyx wrote: post #15

Earlier quoted context omitted.

Note K8s is designed to control a lot of machines, sometime the entire fleet of smbs. So itself should be more sensitive than other infrastructure pieces. And I think op meant to say that, not that k8s is particularly bad in security in general. Or k8s is less experienced in security. The down vote is not warranted.

The "hype" part is pretty subjective and may have warranted down votes. It's not hype if it solves a lot of organizations pain points.

Let's be honest, pretty much every new tech got hyped initially.

K8s is no doubt hype, otherwise it won't enjoy the explosive growth.

That's not subjective, at least IMHO

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#23

Post by ryacko »

kevin_nisbet wrote: post #10
tetha wrote: post #8

Ugh. I mean, I recently got in an argument if anything but a hard firewall could or should be exposed to a WAN interface on the internet and we kinda agreed to not agree for now. But, popular services, on default ports, with default APIs enabled, without hard authentication on a WAN interface? That should be a paddling. That doesn't fly. Or, well it does, except not for the guy paying the power.

To be fair, kubernetes itself and most distributions are quite secure by default. So with kubernetes it's not the same as it was NoSQL databases that didn't have authentication that were bound to the internet. I'm not familiar with enough distributions to know if there is a popular distribution that totally disabled authentication by default, but in my companies distribution, kubeadm clusters, and I suspect all manag…

You will have to patch a critical vulnerability every year on production systems, no matter what language or who develops it.

Secure defaults are irrevalent if you pay attention to the news.

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#24

Post by skunkworker »

whalesalad wrote: post #13

Got in a pretty heated debate with a colleague once about this. We had a really great infrastructure setup with a VPN bastion host that would get you into our VPC. You couldn't reach any of our kube nodes externally. Your Google account was your VPN account. It was pretty solid. When this engineer redid things they opted to go the public internet route where the master runs a public api and auth is done via a certifi…

Ugh going from bastion host hopping to publicly addressable would be a nightmare. Please tell me the database doesn't have a publicly addressable ip & host.

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#25

Post by closeparen »

whalesalad wrote: post #13

Got in a pretty heated debate with a colleague once about this. We had a really great infrastructure setup with a VPN bastion host that would get you into our VPC. You couldn't reach any of our kube nodes externally. Your Google account was your VPN account. It was pretty solid. When this engineer redid things they opted to go the public internet route where the master runs a public api and auth is done via a certifi…

Why is a web server's demand for a certificate different from a VPN server's demand for a certificate?

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#26

Post by wbl »

closeparen wrote: post #25
whalesalad wrote: post #13

Got in a pretty heated debate with a colleague once about this. We had a really great infrastructure setup with a VPN bastion host that would get you into our VPC. You couldn't reach any of our kube nodes externally. Your Google account was your VPN account. It was pretty solid. When this engineer redid things they opted to go the public internet route where the master runs a public api and auth is done via a certifi…

Why is a web server's demand for a certificate different from a VPN server's demand for a certificate?

Because VPNs are magic that never has a backdoor for a decade.

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#27

Post by solatic »

whalesalad wrote: post #13

Got in a pretty heated debate with a colleague once about this. We had a really great infrastructure setup with a VPN bastion host that would get you into our VPC. You couldn't reach any of our kube nodes externally. Your Google account was your VPN account. It was pretty solid. When this engineer redid things they opted to go the public internet route where the master runs a public api and auth is done via a certifi…

> The logic here was so that external 3rd party stuff (CI) could control our master

Why not sidestep the issue by running CI within the VPC? :/

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#28

Post by fulafel »

whalesalad wrote: post #13

Got in a pretty heated debate with a colleague once about this. We had a really great infrastructure setup with a VPN bastion host that would get you into our VPC. You couldn't reach any of our kube nodes externally. Your Google account was your VPN account. It was pretty solid. When this engineer redid things they opted to go the public internet route where the master runs a public api and auth is done via a certifi…

A the risk of stating the obvious: using a VPN would not really protect you this vulnerability, though it would mitigate your exposure (a lot or a little depending on your setup and threat model).

edit: to clarify, vpn/vpc requirement would turn CVE-2018-1002105 from a pre-auth to a post-auth vulnerability, right? Which might be a big or small help depending on how controlled your user pool and signup process is.

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#29

Post by hueving »

closeparen wrote: post #25
whalesalad wrote: post #13

Got in a pretty heated debate with a colleague once about this. We had a really great infrastructure setup with a VPN bastion host that would get you into our VPC. You couldn't reach any of our kube nodes externally. Your Google account was your VPN account. It was pretty solid. When this engineer redid things they opted to go the public internet route where the master runs a public api and auth is done via a certifi…

Why is a web server's demand for a certificate different from a VPN server's demand for a certificate?

Complexity and publicity.

Complexity: Single purpose apps built with a very specific threat model in mind for a boring, established usecase tend to be more secure. K8s is a fast evolving labyrinth of complexity with contributions from thousands of people, very few of whom have a grasp on the whole codebase.

Publicity: the general Internet doesn't find your VPN server just by using your API.

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#30

Post by raverbashing »

kevin_nisbet wrote: post #10
tetha wrote: post #8

Ugh. I mean, I recently got in an argument if anything but a hard firewall could or should be exposed to a WAN interface on the internet and we kinda agreed to not agree for now. But, popular services, on default ports, with default APIs enabled, without hard authentication on a WAN interface? That should be a paddling. That doesn't fly. Or, well it does, except not for the guy paying the power.

To be fair, kubernetes itself and most distributions are quite secure by default. So with kubernetes it's not the same as it was NoSQL databases that didn't have authentication that were bound to the internet. I'm not familiar with enough distributions to know if there is a popular distribution that totally disabled authentication by default, but in my companies distribution, kubeadm clusters, and I suspect all manag…

To be fair, you're playing with fire if you rely on product security to be perfect. For every SSHd out there there are multiple SystemD or worse security products.
Post reply on HN