Full Report
Learn how root access on a compromised K8s node allows attackers to utilize SPIFFE/SPIRE metadata to spoof and harvest co-located workload identities. The post The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE appeared first on Unit 42.
Analysis Summary
# Tool/Technique: SPIFFE/SPIRE Identity Spoofing & Harvesting
## Overview
This technique involves a post-exploitation scenario in Kubernetes (K8s) environments where an attacker gains root access to a node. By leveraging the design of the SPIFFE Runtime Environment (SPIRE), the attacker can manipulate the node-level SPIRE Agent to spoof the identities of any workloads co-located on that specific node. This allows for unauthorized access to sensitive resources, lateral movement, and data exfiltration by assuming the identity of legitimate services.
## Technical Details
- **Type:** Technique / Post-Exploitation Method
- **Platform:** Kubernetes, Cloud-Native Environments (Linux-based)
- **Capabilities:** Identity theft, credential harvesting, lateral movement, bypassing mTLS-based authorization.
- **First Seen:** Publicized by Unit 42 in October 2024.
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- [T1528 - Steal Application Access Token]
- [T1552 - Unsecured Credentials]
- **[TA0008 - Lateral Movement]**
- [T1550 - Use Alternate Authentication Material]
- **[TA0004 - Privilege Escalation]**
- [T1611 - Escape to Host] (Prerequisite for node-level access)
- **[TA0007 - Discovery]**
- [T1613 - Container and Resource Discovery]
## Functionality
### Core Capabilities
- **Workload Attestation Spoofing:** An attacker with root access can mimic the Unix Domain Socket (UDS) metadata (UID/GID/PID) that the SPIRE Agent uses to identify local workloads.
- **SVID Harvesting:** By tricking the SPIRE Agent, the attacker can obtain SPIFFE Verifiable Identity Documents (SVIDs)—typically X.509 certificates—belonging to other legitimate workloads on the same node.
- **API Impersonation:** Use the harvested SVIDs to communicate with other microservices as if the attacker were the legitimate workload, bypassing Zero Trust network policies.
### Advanced Features
- **PID Manipulation:** Utilizing root privileges to create processes or manipulate namespace visibility to match the selectors expected by the SPIRE Server.
- **Agent Workload API Abuse:** Directly interfacing with the SPIRE Agent’s Workload API (exposed via a local Unix socket) to request certificates for any identity the node is authorized to issue.
## Indicators of Compromise
- **File Names:** Look for unauthorized access to the SPIRE Agent Unix Domain Socket (usually located at `/run/spire/sockets/agent.sock`).
- **Network Indicators:** Unexpected mTLS connections between pods that do not typically communicate; traffic to sensitive internal APIs (e.g., Vault, Cloud provider metadata) originating from an unexpected node.
- **Behavioral Indicators:**
- A single PID attempting to fetch multiple distinct SVIDs in a short timeframe.
- SPIRE Agent logs showing successful attestation for a workload that is not currently scheduled on that node.
- Execution of `nsenter` or similar tools to manipulate process namespaces.
## Associated Threat Actors
- No specific group has been publicly attributed to this technique yet; however, it is a high-value method for sophisticated actors targeting cloud-native supply chains and high-security Kubernetes environments.
## Detection Methods
- **Behavioral Detection:**
- Monitor for processes other than the legitimate application binary accessing the SPIRE Workload API socket.
- Audit SPIRE Server logs for "identity flapping" or multiple SVID requests for the same identity from different nodes (if identities are not strictly scoped to nodes).
- **Runtime Security:** Use tools like Falco or Tetragon to detect unauthorized file access to the SPIRE socket or suspicious system calls (e.g., `ptrace`, `setns`) by compromised containers.
## Mitigation Strategies
- **Node-Attested Selector Restriction:** Implement strict "Node-Authorized" selectors. Ensure the SPIRE Server verifies that a requested identity is actually authorized to run on the specific node requesting it.
- **Policy Engine Integration:** Use OPA (Open Policy Agent) to enforce that only specific workloads can assume specific SPIFFE IDs based on validated K8s labels.
- **Kernel-Level Security:** Enable Seccomp and AppArmor profiles to restrict access to the SPIRE Agent socket to only necessary PIDs.
- **Limit Node Blast Radius:** Distribute sensitive workloads across different nodes so that a single compromised node does not grant access to the identities of the entire application suite.
## Related Tools/Techniques
- **Kubernetes Node Pressure/Eviction:** Used to force target workloads onto a node controlled by the attacker.
- **Token Request API Abuse:** Similar to harvesting K8s ServiceAccount tokens, but specific to the SPIFFE ecosystem.
- **Istio/Service Mesh Identity Spoofing:** Related techniques involving the subversion of sidecar proxies.