Clusterfuck -- A Multi-Stage Attack Simulation Framework for Kubernetes

Format:
Hybrid (in-person and online) event

In-person location:
Security Compass
325 Front Street West, Unit 103
Toronto, ON
M5V 2Y1

Note: In-person attendance is limited to 70 people, in a first-come, first-serve basis.
Doors will open at 6:00 PM, with the event will start at 6:30 PM (EDT).
For those who cannot attend in person, please join us virtually via the livestream!

Presentation Title:
Clusterfuck -- A Multi-Stage Attack Simulation Framework for Kubernetes
K8s environments present unique attack surfaces that traditional security tools often fail to detect comprehensively. This talk introduces clusterfuck, an open-source multi-stage attack simulation framework designed to validate CSPM/MDR detection capabilities.

clusterfuck executes a realistic 20+ stage attack chain targeting actual weaknesses in Kubernetes deployments: privilege escalation via misconfigured security contexts, container escape through host filesystem mounts, credential theft (Kubernetes service account tokens and AWS IAM credentials), process hiding via eBPF and LD_PRELOAD manipulation, lateral movement, C2 establishment through multiple protocols, and resource hijacking via cryptomining payloads.