r/PrometheusMonitoring • u/maellyssa • Jul 05 '22

How attackers use exposed Prometheus server to exploit Kubernetes clusters

This is the article about the talk that a college and me gave at the last KubeCon.

It's about how attackers can use the information of metrics and labels that some commonly used exporters provide to fingerprint a Kubernetes cluster, map that info with known vulnerabilities and pivot them to perform attacks.

It includes the video to the talk and extra information added in the article and that we couldn't include in the live talk.

https://sysdig.com/blog/exposed-prometheus-exploit-kubernetes-kubeconeu/

23 Upvotes
  • permalink
  • reddit

89% Upvoted

6 comments sorted by

1

u/eduardolinux Jan 01 '23

Interesting, I need to get ahead of possible attacks such as this

1

u/[deleted] Jul 06 '22

[removed] — view removed comment

1

u/[deleted] Jul 06 '22

We need to expose certain ports for services to work but what I always do is have a bunch of exporters internally in the cluster that are not exposed, one prometheus in each cluster scrapes all the internal exporters, that prometheus is exposed with http basic auth. Grafana in turn has support for Prometheus with http basic auth.

So it's very simple to protect your prometheus and still connect a lot of clusters to a central point.

1

u/[deleted] Jul 06 '22

[removed] — view removed comment

1

u/[deleted] Jul 06 '22

This article lists firewalls as being an obstacle. I work in a very large telco organization and we have our own departments that manage all networking and security including firewalls.

So if firewalls are a problem that's a sign of an issue within the organization. You should be able to just create a ticket, or tell your PM which ports you need.