The most popular and comprehensive Open Source ECM platform
Let us know more
Security: Hackers Exploit Kubernetes Misconfigurations, but also Use it as a Tool to Scale Their Attacks
Software misconfiguration is one of the easiest ways that a hacker can exploit software, and unfortunately, misconfiguration problems are common. One study found that more than 80 percent of systems were vulnerable because of misconfiguration problems — firewall, web server, application servers, and applications.
Gartner said that misconfigurations are typically self-inflicted problems. 95 percent of misconfiguration issues are due to mistakes or unintentional oversights of the organization. In particular, moving software that was running on one machine to another is notorious for introducing security misconfigurations.
It’s no surprise then that complex software like Kubernetes and containers often have misconfiguration issues. A Flexera study found that 94 percent of container users had experienced a security vulnerability over the course of one year. In that same study, 61 percent said that container and Kubernetes security misconfigurations were their biggest worry.
Just because the cloud infrastructure that you run on is certified as secure does not imply that the software that you’ve deployed into it will inherit that security.
A report from Intezer found that “even if your cluster is deployed on a managed cloud Kubernetes service such as Amazon Web Service (AWS), EKS or Azure Kubernetes Service (AKS), the shared responsibility model still states that the cloud customer, not the cloud provider, is responsible for taking care of all necessary security configurations for the applications they deploy.”
It’s interesting to note that Kubernetes is a favorite of hackers to exploit because of its complexity, but i’s also a favorite tool for hackers to use themselves when launching large-scale attacks. Attacks by the Russian group known as ‘Fancy Bear’ has employed Kubernetes clusters to conduct widespread and rapid-fire attacks to exploit many systems simultaneously at scale.
Saumitra Das, CTO and Cofounder of Blue Hexagon, said that the attack “used Kubernetes to orchestrate and scale their attacks to continuously attempt initial access into organizations. This implies high-level automation and semi-autonomous attack capabilities to target a wide list and then focus on where they are able to brute force in.”
