Lev Khakimov, a student from the Faculty of Computer Sciences of VSU, gave a speech at the professional conference for developers of HighLoad++ systems. This is the largest professional conference for developers of high-load systems. The event aims at sharing knowledge about technologies that allow for the simultaneous servicing of many thousands and millions of users.
The programme covers such aspects of web development as architectures of large projects, databases, and storage systems, devops and system administration, load testing, operation of large projects, and other areas related to large and high-load IT systems.
Lev Khakimov’s speech was devoted to a practical analysis of vulnerabilities in the Kubernetes orchestration system and escaping the isolated secure container environment for servers, as well as the main security mechanisms that exist in K8s, yet about which little is known.
His report addressed the following topics:
- Reverse-shell or how to make the server connect to your PC and provide you with a shell.
- Docker Escape in practice: The danger of privileged containers and a practical demonstration of escaping by adding a self-written module to the kernel.
- RBAC, rights in K8s and what granting too broad powers to Pods can result in.
- Practical cluster capture on Pod and launching cryptominers.
- Major errors when writing manifests for services.
