Cloud Native Computing Foundation Cloud Native Security Day EU 2021, 14 May 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Lightning Talk: Capture The Flag Overview - Andrew Martin & Lewis Denham-Parry, Control Plane

Description

Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon North America 2021 in Los Angeles, CA from October 12-15. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Lightning Talk: Capture The Flag Overview - Andrew Martin & Lewis Denham-Parry, Control Plane

Delve deeper into the dark and mysterious world of Kubernetes security! Exploit a supply chain attack and start your journey deep inside the target infrastructure, exploit your position to hunt and collect the flags, and hopefully learn something new and wryly amusing along the way!

Attendees can play six increasingly beguiling and demanding scenarios to bushwhack their way through the dense jungle of Kubernetes security. Everybody is welcome, from beginner to hardened veteran, as we venture amongst the low-hanging fruits of insecure configuration and scale the lofty peaks of cluster compromise!

Note: Registration for Cloud Native Security Day Europe is required to participate in Capture The Flag.

A

Hello and welcome to the cloud native security day, courtesy of sig security. We shall be playing a capture the flag game today, and this is how you participate.

A

First of all, we will run through a precap, but at the end of the day, we will have a companion recap to go through the scenarios and understand, during a rye retrospective, exactly what happened, but first of all, we are going to wet your appetites for some parental honking.

A

Peace, indeed, was never an option for a naughty goose. Today's goal is to learn in a happy and joyous environment. We're grateful to have the absolute pleasure of helping people on their security journey and containery hackery. We've built this in collaboration with sig security, and we have a learning outcome in mind for every scenario. Throughout the day we are using the same platform as last time, so those of you with prior experience will know how to enter the game for everybody else.

A

We have a companion website, slack channel and plenty of volunteers to aid you on your way. We also have a newly minted twitch channel this year with a roster of pre-eminent kubernetes security personalities to give you a red or blue team perspective on the scenarios as we navigate the turbulent waters of kubernetes and cloud native security.

A

So what can you expect to delve deeper into the dark and mysterious world of kubernetes? Your adversary has exploited a supply chain, and you start your journey deep inside a kubernetes system looking to hunt and collect the flags they dropped and hopefully learn something along the way.

A

No waterway is safe and you can play six increasingly beguiling and demanding scenarios to bushwhack your way through the dense jungle of cloud native security. Everybody is, of course, welcome from beginner to hardened veteran, as we venture out amongst the low hanging fruits of insecure configuration and scale the lofty peaks of full cluster compromise.

A

So, yes, you should find these a little bit tricky and increasingly difficult, but you can- and please do ask for help at any time at the point of today- is to learn and not to compete.

A

Of course, you're welcome to compete against friends, family and colleagues.

A

Now these clusters aren't going to stand up themselves, so we have a team of task masters, managing the infrastructure and on hand to provide help on slack. There are six scenarios to advance through throughout the day, and the instructions are all in the companion website. So, let's see louis guide us through a first time user's experience.

B

Thank you for that introduction, andy, and what a great day it is going to be to break out of some containers.

B

I am indeed lewis the head of training at control plane and what I'm going to do now is I'm going to give you a demo of one of the scenarios that we did last year for the ctf to get started, you're going to need to contact the taskmaster via dm on the cncf slack channel you'll be able to find us taskmaster, probably posting gifs. Throughout the day now, once you've contacted the taskmaster they're going to go and they're going to get a cluster from cubesim now these clusters have been misconfigured on purpose.

B

The taskmaster then needs to send you credentials the safest way. They know how over slack. Incidentally, don't worry, because we've got an intern ready to take the fall. If anything should happen.

B

So once we received our file, we want to check that we've got it downloaded and we see we have a tar file here. So we need to get the contents out so tar xf and then, with these files, I'm able to run an ssh command and accepting the fingerprint I'm now inside a container.

B

That was a little bit quick if you're not used to doing things like this, then have a look at the website: we'll have videos specific to operating systems and equally, if you're, still struggling just reach out to the task master we're there to.

A

B

Now I can see that I'm in someone else's shell well someone else's container. Who knows where we are, but let's get started now, I'm going to go through the quick happy route, I'm going to start by looking at what we have mounted within our container, and I can see here that there is something interesting called the dev xvda1.

B

What does that not mean? I still don't know: um I'd recommend having a look on a search engine just find out. That's what's.

A

Encouraged today,.

B

So we're going to mount this so we're going to mount dev xvd a1 onto our mount directory. Now, let's have.

A

B

Here now I wasn't expecting to see something like this. This looks like the root file system of another machine, so I might have just broken out of a container onto the host machine running for container that we're on yeah. Now having a look through here, I can see some interesting folders, um but the one that really sticks out to me is the node secrets.

B

So let's just have a look in there, so check them out no secrets and let's just cut out.

B

There we go, we've captured the flag. I would copy this flag and I'll send it across for taskmaster, who will probably send even more gifs to congratulate breaking out the container and completing the scenario. We've got six scenarios all different uh difficulty levels, um but the main thing about today's is just have fun and learn: um you're gonna break out of container it's gonna be great fun and well with myself as being one of the taskmasters.

B

Here we learned from the peers around us, and so it's just our absolute pleasure to help you break out of your containers today.

B

I think that's pretty much it and I haven't even mentioned that we're hiring so to this point, I'd like to pass back to the mr andrew martin.

A

And with that thoroughly captivating introduction from the right honorable task, master lewis, we are ready to roll everything that you need to participate is in the top link. The task master is on the cncf slack, so please sign up to engage with the ctf and we'll be rolling all day on twitch. Please create an account if you'd like to comment on the stream and with that go forth and assault these foolish and wantonly misconfigured clusters control plane are more than proud to support.

A

Sig security and today's ctf and plenty of task masters are on hand to help. Beware: pirates, sparing gifts, have fun and future andy and lewis will be back later for a line-by-line teardown of the mystical, incantations and command line, invocations required to complete each scenario.

A

B

Hey andy, I haven't seen you for ages, man, how you doing.

A

Really good really good. Indeed, how are you doing.

B

Yeah well, I just finished the video for the keynote that we're delivering one thing.

A

B

Though, like I had a suit, I had like a shirt and tie on and I just completely forgot, so I just kept my hoodie on just what a.

A

B

There anything else this felt like something else. We forgot.

A

It does feel like something has eluded us.

B

Well, it won't be the first time to be honest, but this is oh.

A

It's not the flag.

B

No, we've got the.

A

Flags we've hidden him really well in those directions. Yeah we've done that. um It's not defense against the dark and nefarious captain jack.

B

Well, after last time, jeez- let's hope it's not that again, but uh oh.

A

Twitch, the twitch stream, of course,.

B

um Wait: okay, I've got an idea andy, but I need you. I need you to believe in me.

A

I believe lewis, no.

B

I believe no last time he said that I fell and I and it hurt so.

A

I needed it, it was all a bit weird. I was distracted.

B

Okay, all right, okay, come on. Just look at me. Look into my eyes: okay, three, two one there. It is.

A

Look that worked out. I mean fantastic, wait, that's exactly what we needed.

B

And we got everyone at cubecon as well: hey.

A

How are you doing good morning.

B

We're just catching up um yeah; no, here's the twitch stream that you need to join, to be able to follow.

A

It's important yeah, it's.

B

Really important and for some reason we forgot, but it's here now um all right. I think we gotta go. um I need.

A

To go and spin up some.

B

A

They will not spin up themselves.

B

No, that just won't happen, um but we're I'll see you later on yeah.

A

Yeah see you in a few hours and we'll we'll do this again.

B

Yeah yeah and we'll show people how to get the flags and um yeah.

A

Cool yeah and bundle all the magic all.

B

Right, I think I.

A

B

Up all my magic doing that, but I'll try and find some up yeah.

A

It was mighty impressive.

B

Well, shut up right, I'll, see you in a bit.

A