BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: Thinking Outside the Kube - Finding and Exploiting C
 ommand\n   Injections in Kubernetes\n   When: Friday\, Aug 9\, 16:00 - 16:
 50 PDT\n   Where: LVCC West/Floor 2/W204-W207/W204-W207-Narrows - [1]Map\n
 \n   Description:\n\n   Kubernetes is an extremely popular\, open source c
 ontainer\n   orchestration system\, that is used by organizations large an
 d small.\n   Kubernetes’s design philosophy leaves security to the syste
 m\n   administrators\, letting them pick and choose which security mechani
 sms\n   they want to enable or disable. As such\, it can leave Kubernetes\
 n   deployments quite vulnerable.\n\n   In an attempt to abuse this fact\,
  we began looking for potential\n   exploitation avenues. Eventually\, we 
 were able to identify several\n   vulnerabilities in different Kubernetes 
 components that could enable a\n   low privileged attacker to execute code
 \, escalate privileges and\n   exfiltrate data. We also found flaws in Kub
 ernetes sidecar project:\n   “gitsync”. These flaws will not be patche
 d\, meaning mitigation\n   hinges only on the awareness of security person
 nel.\n\n   In this talk we will go through the methodology we used to find
  these\n   kinds of vulnerabilities\, share our thought process on how to 
 exploit\n   them and show how attackers can easily execute commands with S
 YSTEM\n   privileges. We will also discuss Kubernetes’s design philosoph
 y and\n   how it can allow these types of opportunities.\n\n   SpeakerBio:
   Tomer Peled\n   No BIO available\n   '\n\n   1. #LVCCW_Level2_West\n\n\n
DTEND:20240809T235000Z
DTSTART:20240809T230000Z
LOCATION:RTV - LVCC West/Floor 2/W204-W207/W204-W207-Narrows
SUMMARY:Thinking Outside the Kube - Finding and Exploiting Command Injectio
 ns in Kubernetes
END:VEVENT
END:VCALENDAR