Skip to content

13. Cloud-Native Attack and Defense

13.1 Kubernetes Attacks (Real-World Kill Chain)

Attack chain: unauthorized API Server (8080/8443) → etcd exposure → Service Account Token theft → Pod escape → node control → cluster takeover

Container escape evolution (real 2025-2026 CVEs):

runc escape (CVE-2025-31133, 2025.11): - Principle: /dev/null is replaced with a symlink → runc mounts an arbitrary host path into the container at creation time → writing to /proc/sys/kernel/core_pattern achieves escape - Exploitation conditions: ability to create containers with runc/containerd + the host runs an affected version (≤1.2.7) - Operational approach: obtain execution privileges inside the container → check the runc version → replace /dev/null with a symlink → trigger container recreation → write to core_pattern → escape to host root - Tool: container-escape-ebpf (includes a PoC and Tetragon detection rules)

eBPF Verifier escape (CVE-2026-31413, 2026.04): - Principle: insn_idx + 1 in the Linux BPF verifier's push_stack() call causes a fork path to skip one ALU instruction → the verifier believes dst=0 but the CPU actually computes 0|K=K → register values diverge - Attack chain: OOB read/write of the BPF map → vtable hijacking → overwrite modprobe_path → trigger an unknown binary format → the kernel executes the attacker's script as root - Exploitation conditions: requires CAP_BPF + CAP_PERFMON + CAP_NET_ADMIN (present in privileged containers) - Affected versions: Linux 6.12.75+ through 7.0-rc4 - Fix: a one-character change (insn_idx + 1 → insn_idx) - Operational significance: most production K8s clusters run older kernels; run uname -r first to confirm the version

eBPF zero-day (CVE-2025-41111, 2026.03): - Principle: a Linux kernel eBPF verifier flaw → an authenticated attacker bypasses seccomp/AppArmor/Pod Security Policy from inside a container - Attack chain: inject malicious eBPF code (sidecar / privileged DaemonSet) → exploit the verifier flaw to escalate privileges → switch host user namespace → disable SELinux/AppArmor → mount the host filesystem → install a persistent rootkit - Chainable attacks: combined with PackageGate (npm/pnpm/Bun supply chain) → inject from the CI/CD pipeline → cluster-level takeover

CDK cgroup2_eBPF_bypass (added 2026.02): - Principle: in cgroup v2, device access is controlled by eBPF programs → enumerate all active eBPF program IDs on the host → forcibly detach them from the container's cgroup mount point → device control removed → create a device node to read the host disk - In practice: ./cdk run cgroup2-ebpf-bypass → debugfs -w ./cdk_mknod_v2_result → browse host files (including /root/.ssh)

eBPF rootkit in the wild (LinkPro, discovered by Synacktiv, 2025.10): - Target: AWS EKS cluster - Deployment: malicious Docker image kvlnt/vv → contains two eBPF modules - Stealth mechanism: module 1 hooks sys_bpf → matches its own program ID → returns an error code → invisible to management tools such as bpftool - Fallback stealth: when eBPF fails, modify /etc/ld.so.preload → load the malicious libld.so library - C2 activation: module 2 "Knock" uses XDP (eXpress Data Path) to listen for a "Magic TCP SYN" packet (specific window size=54321) → opens the reverse shell only upon receiving the magic packet → undetectable by port scanning - Significance: eBPF is not just a local persistence tool; it is a cloud-native lateral movement tool

Toolchain: - CDK (includes cgroup2-eBPF-bypass) / kubeletctl / peirates - Detection: Tetragon (eBPF runtime security) / Falco

13.2 Serverless Attacks

  • AWS Lambda: cold-start injection (modify the initialization handler) / environment-variable leakage (cloud credentials) / persistence via the temp directory (/tmp) / Layer poisoning (contaminating shared layers)
  • Azure Functions: Managed Identity abuse (the function's inherited managed identity → access Key Vault/Storage) / function-key leakage
  • Attack chain: function vulnerability (RCE/SSRF) → steal cloud credentials (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY) → AWS CLI lateral movement to other resources

13.3 Cloud IAM Privilege Escalation

AWS: iam:PassRole+ec2:RunInstances → create an EC2 with a high-privilege role / sts:AssumeRole chains / Lambda function execution-role abuse Azure: Entra ID (Microsoft Graph) → conditional-access policy modification / PIM abuse / Managed Identity → Key Vault GCP: Service Account key leakage → impersonate the SA → IAM policy modification

13.4 Supply Chain Attacks: CI/CD Pipeline

Attack approaches (PackageGate 2026): - GitHub Actions poisoning: malicious Action/Workflow → steal GITHUB_TOKEN / custom secrets → repository code injection - Dependency Confusion: internal package name → register a same-named package on public npm/PyPI → version higher than the internal one → the malicious package is pulled automatically - Build pipeline poisoning: contaminate the build environment → produce backdoored build artifacts (SolarWinds-style attack) - Defense: pin dependency versions / private Registry / SBOM analysis / signature verification