Beginner's Guide to Bypassing Falco Container Runtime Security in Kubernetes - Kubernetes Village at Bsides Bangalore 2024

This presentation, crafted for the Kubernetes Village at BSides Bangalore 2024, delves into the essentials of bypassing Falco, a leading container runtime security solution in Kubernetes. Tailored for beginners, it covers fundamental concepts, practical techniques, and real-world examples to help you understand and navigate Falco's security mechanisms effectively. Ideal for developers, security professionals, and tech enthusiasts eager to enhance their expertise in Kubernetes security and container runtime defenses.

1. Beginner's Guide to Bypassing Falco Container Runtime Security in K8s Anjali Shukla Senior Security Consultant 1

2. Anjali $ whoami Senior Security Consultant with 5+ years in Cloud Security, DevSecOps , IAC Security, K8s, Container, Big Data Trainer & Speaker @ BlackHat , Bsides , c0c0n, CSA AWS Community Builder Bangalore Chapter Lead of W3-CS. Crew Member @ Defcon Cloudvillage Blogs – https://infosecblo55om.medium.com/ Author – Linux Armour Ansible Role 2

3. Credit To Guru’s Blackberry Falco Bypass NCC Group image name manipulations. Weak Image Name Comparison by Brad Greesaman Bypass Falco by Leonardo Di Donato, Sysdig Falco team via github Toctou Bypass by R.Guo & J.Zeng Getting started with runtime security and Falco 3

4. Disclaimer The views expressed in this presentation and its content, as well as any accompanying resources, are solely the speaker's own and do not necessarily reflect the opinions or endorsements of the speaker's employer. Credits to the original author & the attacks reproduced here and the attempts to bypass uses similar new payloads, created from references to the original research. 4

5. What will get covered? Introduction to Falco and Container Runtime Security in K8s Architecture & Diving into eBPF What are Syscalls Working of Falco Falco Triggers Falco Bypass Payload’s in K8s Best Practices & Recommendations in K8s Conclusion & Q/A 5

6. Introduction to Falco and Container Runtime Security in Kubernetes What is Falco? Container runtime security in Kubernetes. Why it's crucial to be aware of bypass techniques? 6

7. Architecture of Falco 7 https://sysdig.com/opensource/falco/

8. Diving into eBPF : Foundations and Context 8 https://ebpf.io

9. What are Syscalls 9 Julia evans

10. What are Syscalls 10

11. Container Runtime Falco Working 11 https://sysdig.com/opensource/falco/

12. Falco Triggers Triggers when certain conditions are met. System calls: A process opens a file in a sensitive directory. File operations: A process creates a new file in a sensitive directory. Process events: A new process is created or when a process exits. Network traffic: A process sends a request to a known malicious IP address. 12

13. Falco Triggers 13 Falco Alert Triggered

14. Falco Rules 14 https://github.com/falcosecurity

15. Falco Bypass Techniques From Past Symlink TOCTOU Attack Relative Path Bypass Directory Name Comparison Bypass Hard Links vs. Soft Links Tricking By Process Name Exploiting Parent and Ancestor Process Names 15 Only for Reference

16. Failures In Character Class Manipulation Using character classes like [a-t] or [^0-9] to represent a range or exclude certain characters. This failed to bypass the default rule set. 16

17. Failures In Character Class Manipulation 17 Falco Alert Triggered

18. Failures In Path Obfuscation Obscuring file paths using wildcard characters (?, *), which might not be caught if the security rules are looking for explicit matches. This will also fail like previous payload. 18

19. Previous Bypass : Symbolic Links Exploitation Creating a symlink that points outside the current directory or to sensitive paths can be used to manipulate file paths and trick security mechanisms that rely on straightforward path matching. 19 Credit: https://github.com/blackberry/Falco-bypasses/

20. Symbolic Links Exploitation 20 Credit: https://github.com/blackberry/Falco-bypasses/

21. Symbolic Links Exploitation 21 Credit: https://github.com/blackberry/Falco-bypasses/ No Falco Alert

22. Bypass : Subshell Execution Running commands within a subshell to potentially bypass checks on the parent command. 22 Credits: https://book.hacktricks.xyz/linux-hardening/bypass-bash-restrictions

23. Subshell Execution 23 Credits: https://book.hacktricks.xyz/linux-hardening/bypass-bash-restrictions No Falco Alert

24. Best Practices & Recommendations Reflecting on lessons from advanced bypass methods. Ensure rules are prioritized accurately. Check for the public CVE specific exploits. Generate private set of rules based on infrastructure. Enable Guardduty for real time alerts on EKS attack Use multi-layer defence including logging & monitoring 24

25. Conclusion & Q/A 25

26. Connect Me: @peachycloudsecurity 26

27. 27 👉[email protected]