How eBPF Can Detect Kubernetes Container Escapes and Runtime Attacks
Summary
A walkthrough shows how eBPF-based runtime monitoring can surface Kubernetes attack activity, including privileged-pod escapes, reverse shells, pod creation, and access to /etc/shadow, alongside prevention measures.
Key points
- The article demonstrates a privileged Kubernetes pod using host access and nsenter to escape its container and reach host resources.
- A test web application with missing input validation is used to demonstrate remote command execution and a reverse shell into a Kubernetes node.
- After gaining cluster access in the scenario, the tester enumerates Kubernetes resources, reads a service-account token, and creates pods.
- The article says eBPF can capture real-time kernel and container activity for investigation, threat hunting, and security policy creation.
- Recommended measures include network policies, controls that block privileged pods, and runtime observability.
- Wiz’s Runtime Sensor is described as using eBPF to monitor activity and detect behaviors including reverse shells, pod creation, and access to /etc/shadow.
Article Details
- Defense Focus
- Use eBPF-based runtime observability to detect and help prevent Kubernetes container escapes, remote code execution, and suspicious activity in pods and on hosts.
- Detection Methods
- Monitor container runtime and host system activity in real time using eBPF-captured system calls.
- Inspect process trees and correlate process activity with user sessions and network connections across containers and systems.
- Detect non-standard socket connections to remote network addresses, including reverse-shell behavior.
- Alert on unexpected process execution, pod creation, and access to /etc/shadow.
- Use workload behavior monitoring and anomaly detection to identify new or suspicious activity.
- Data Sources
- eBPF-captured system calls
- Process activity and process trees
- User sessions
- Network connections and socket activity
- Container and host runtime activity
- Pod creation events
- File access events, including access to /etc/shadow
- Platforms
- Kubernetes
- Defensive Actions
- Apply network policies to restrict communication between external hosts and sensitive pods.
- Use admission controls and security guardrails to block creation of privileged pods.
- Enable runtime observability and security monitoring across the cluster.
- Investigate unexpected remote socket connections, privileged pod activity, pod creation, and sensitive-file access.
MITRE ATT&CK
T1005 · Data from Local SystemThe article describes reading the /etc/shadow file after deploying a privileged pod.T1046 · Network Service DiscoveryThe reconnaissance scenario uses Nmap to scan network ranges and identify exposed IP addresses and ports.T1059.003 · Windows Command ShellThe article shows command execution through a web application lacking input validation and describes running shell commands on the host.T1059.004 · Unix ShellThe demonstrated payload uses Bash to run a reverse shell on the compromised host.T1098.001 · Additional Cloud CredentialsThe article describes using a Kubernetes service account token read from a secret to access the cluster.T1105 · Ingress Tool TransferThe operator downloads kubectl from an attacker-controlled Kali Linux machine to interact with the compromised cluster.T1552.007 · Container APIThe demonstrated activity reads a Kubernetes service account token from a secret.T1611 · Escape to HostThe article demonstrates escaping a privileged Kubernetes pod to the host using kubectl exec and nsenter to enter the host namespace.T1613 · Container and Resource DiscoveryThe demonstrated cluster enumeration lists pods and creates new pods using the service account token.
Vendors
Products
Tools
eBPFuse of cloud-native environments is a challenge for today's security tools. That's why solutions such as eBPF have emerged and become standards for addressing these issues. kubectlOnce the pod is created, just executing the kubectl command like the following will allow you to escape from the pod: netcatThe first step is to set up a shell listener using the netcat command in our pen testing machine and execute the crafted payload, which executes a remote shell (RCE) into the application. Here’s an example to set up theNmapNmap is a tool commonly used by hackers in their kill chain. Attackers typically scan large network ranges to locate exposed IPs and ports. In this case, we will utilize Nmap to determine which ports are open andnsenter➜ ~ kubectl exec -it privileged-pod -- nsenter -t 1 -m -u -n -i -p bash