Bypassing Falco - How to Compromise a Cluster without Tripping the SOC

Bypassing Falco - How to Compromise a Cluster without Tripping the SOC

Explore advanced techniques for bypassing Falco, a popular runtime security tool for Kubernetes, in this 34-minute conference talk by Shay Berkovich from BlackBerry. Discover nine different classes of bypasses, including seven novel methods, that allow for stealthy target enumeration, privilege escalation, and lateral movement within a cluster. Learn how to leverage a specially designed container image and code snippets to automate these bypasses. Witness a practical demonstration of applying these techniques to compromise a secure Kubernetes cluster without alerting security operations. Gain valuable insights into the limitations of current security tools and understand the evolving landscape of Kubernetes security challenges.