DNS Spoofing in Kubernetes Cluster
In this post I’ll describe how an attacker, who manages to run malicious code on a cluster can, with no special permissive permissions, successfully spoof DNS responses to all the applications running on the cluster, and from there execute a MITM (Man In The Middle) on all network traffic of pods. Before we get into the attack scenario, let’s understand how Kubernetes intra-node networking works. We can discuss about Kubernetes networking in a whole series of blogs and still not cover everything, so in the following explanations, I’m mostly going to concentrate on the default configurations, just for setting a common ground Kubernetes Networking in a Nutshell Generally speaking, pod-to-pod networking inside the node is available via a bridge that connects all pods. This bridge is called “ cbr0 ”. (1) (Some network plugins will install their own bridge, and give it a different name, but in this blog, we’ll refer to it as “cbr0...