All Roads leads to GKE's Host : 4+ Ways to Escape

Presented at DEF CON 30 (2022), Aug. 13, 2022, noon (45 minutes)

Container security is a prevalent topic in security research. Due to the great design and long-term effort, containers have been more and more secure. Usage of container technology is increasingly being used. Container security is a topic that has started to be discussed a lot lately.

In late 2021, Google increased the vulnerability reward program in kCTF infrastructure, which was built on top of Kubernetes and Google Container Optimized OS, with a minimum reward of $31,337 per submission.

In this talk, we will share about how we managed to have 4 successful submissions on kCTF VRP by exploiting four Linux kernel bugs to perform container escape on kCTF cluster, we will explain some interesting kernel exploit techniques and tricks that can be used to bypass the latest security mitigation in Linux kernel. We will also share what we did wrong that causes us to nearly lose 1 of the bounty.

As of writing, there are 14 successful entries to kCTF. In this presentation, we are willing to share our full, in-depth details on the research of kCTF.

To the best of our knowledge, this presentation will be the first to talk about a complete methodology to pwn kCTF (find and exploit bugs within 0-day and 1-day) in public.

Presenters:

• Billy Jheng - Security Researcher at STAR Labs
  Billy Jheng is a information security researcher at STAR Labs, focusing on Hypervisor and Linux Kernel vulnerability research and exploitation, a member of the Balsn CTF team. He participated in Pwn2Own 2021 Vancouver & Austin and was a speaker at conferences HITCON.
• Muhammad ALifa Ramdhan - Security Researcher at STAR Labs
  Muhammad Ramdhan is a security researcher at STAR Labs, currently interested on Linux Kernel, Hypervisor or Container vulnerability research and exploitation. He is also a CTF enthusiast who is currently a member of CTF team SuperGuesser focusing on binary exploitation problems.

Links:

• https://forum.defcon.org/node/241933
• https://infocon.org/cons/DEF CON/DEF CON 30/DEF CON 30 video and slides/DEF CON 30 - Billy Jheng, Muhammad ALifa Ramdhan - All Roads Lead to GKEs Host - 4 Ways to Escape.mp4
• https://infocon.org/cons/DEF CON/DEF CON 30/DEF CON 30 video and slides/DEF CON 30 - Bing-John Jheng, Muhammad Ramdhan - All Roads Lead to GKEs Host - 4 Ways to Escape.mp4
• https://infocon.org/cons/DEF CON/DEF CON 30/DEF CON 30 video and slides/DEF CON 30 - Billy Jheng, Muhammad ALifa Ramdhan - All Roads Lead to GKEs Host - 4 Ways to Escape.srt (subtitles)
• https://infocon.org/cons/DEF CON/DEF CON 30/DEF CON 30 video and slides/DEF CON 30 - Bing-John Jheng, Muhammad Ramdhan - All Roads Lead to GKEs Host - 4 Ways to Escape.srt (subtitles)
• https://www.youtube.com/watch?v=DcyjTlTIcMA

Similar Presentations:

• DerbyCon 8.0 Evolution (2018) / Living in a Secure Container, Down by the River
• BruCON 0x0A (2018) / Outside the Box: Breakouts and Privilege Escalation in Container Environments
• ToorCon San Diego 20 (2018) / If You Give a Container a Capability: A Tale of Container Exploitation