title: ÐÑÐ¾ÑÐ¸Ð²Ð¾Ð´ÐµÐ¹ÑÑÐ²Ð¸Ðµ Ð°ÑÐ°ÐºÐ°Ð¼ ARP- Ð¸ DNS-spoofing Ð² ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ°Ñ Kubernetes Ð¿ÑÐ¸ Ð½Ð°Ð»Ð¸ÑÐ¸Ð¸ Ð¿ÑÐ¸Ð²Ð¸Ð»ÐµÐ³Ð¸Ð¸ CAP_NET_RAW
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð±Ð°ÐºÐ°Ð»Ð°Ð²ÑÐ°
titleType: Subtitle
title: Counteracting ARP- and DNS-spoofing attacks in Kubernetes containers with the CAP_NET_RAW capability
Creators: name: Ð£Ð»ÑÐºÐ¸Ð½, ÐÐ»ÐµÐºÑÐµÐ¹
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2024
Subjects: ARP
DNS
spoofing
kubernetes
ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ¸Ð·Ð°ÑÐ¸Ñ
CAP_NET_RAW
containerization

description: Ð¢ÐµÐ¼Ð° Ð²ÑÐ¿ÑÑÐºÐ½Ð¾Ð¹ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÑ: Â«ÐÑÐ¾ÑÐ¸Ð²Ð¾Ð´ÐµÐ¹ÑÑÐ²Ð¸Ðµ Ð°ÑÐ°ÐºÐ°Ð¼ ARP- Ð¸ DNS-spoofing Ð² ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ°Ñ Kubernetes Ð¿ÑÐ¸ Ð½Ð°Ð»Ð¸ÑÐ¸Ð¸ Ð¿ÑÐ¸Ð²Ð¸Ð»ÐµÐ³Ð¸Ð¸ CAP_NET_RAWÂ». Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ Ð¿Ð¾Ð²ÑÑÐµÐ½Ð¸Ðµ Ð·Ð°ÑÐ¸ÑÐµÐ½Ð½Ð¾ÑÑÐ¸ ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ¾Ð² Kubernetes Ð¾Ñ Ð°ÑÐ°Ðº ARP- Ð¸ DNS-spoofing Ð¿ÑÐ¸ Ð½Ð°Ð»Ð¸ÑÐ¸Ð¸ Ð¿ÑÐ¸Ð²Ð¸Ð»ÐµÐ³Ð¸Ð¸ CAP_NET_RAW. ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÑÑÑÑ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÐµ Ð¼ÐµÑÐ¾Ð´Ñ Ð¿ÑÐ¾ÑÐ¸Ð²Ð¾Ð´ÐµÐ¹ÑÑÐ²Ð¸Ñ Ð°ÑÐ°ÐºÐ°Ð¼ ARP- Ð¸ DNS-spoofing Ð² ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ°Ñ Kubernetes. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°ÑÑ Ð²Ð½ÑÑÑÐµÐ½Ð½ÐµÐµ ÑÑÑÑÐ¾Ð¹ÑÑÐ²Ð¾ ÑÐµÑÐ¸ Ð² ÐºÐ»Ð°ÑÑÐµÑÐµ Kubernetes. 2. ÐÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°ÑÑ Ð²Ð»Ð¸ÑÐ½Ð¸Ðµ ÑÑÑÐ°Ð½Ð¾Ð²Ð»ÐµÐ½Ð½Ð¾Ð¹ Ð¿ÑÐ¸Ð²Ð¸Ð»ÐµÐ³Ð¸Ð¸ CAP_NET_RAW Ð½Ð° Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÑ ÐºÐ»Ð°ÑÑÐµÑÐ° Kubernetes. 3. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°ÑÑ Ð´ÐµÐ¼Ð¾Ð½ÑÑÑÐ°ÑÐ¸Ð¾Ð½Ð½ÑÐ¹ ÑÑÐµÐ½Ð´ Ð´Ð»Ñ Ð¿ÑÐ°ÐºÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð°ÑÐ°Ðº ARP- Ð¸ DNS-spoofing Ð² ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ°Ñ Kubernetes Ñ Ð²Ð¾Ð·Ð¼Ð¾Ð¶Ð½Ð¾ÑÑÑÑ Ð¼Ð¾Ð½Ð¸ÑÐ¾ÑÐ¸Ð½Ð³Ð° ÑÐ¾ÑÑÐ¾ÑÐ½Ð¸Ñ ÑÐ¸ÑÑÐµÐ¼Ñ. 4. Ð¡ÑÐ¾ÑÐ¼Ð¸ÑÐ¾Ð²Ð°ÑÑ Ð¿ÑÐ°Ð²Ð¸Ð»Ð° Ð´Ð»Ñ Ð¿ÑÐ¾ÑÐ¸Ð²Ð¾Ð´ÐµÐ¹ÑÑÐ²Ð¸Ñ Ð°ÑÐ°ÐºÐ°Ð¼ ARP- Ð¸ DNS-spoofing Ð² ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ°Ñ Kubernetes. Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð° Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð° ÑÐµÑÐµÐ²Ð°Ñ Ð¼Ð¾Ð´ÐµÐ»Ñ Ð² ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ°Ñ Kubernetes, ÑÐ¿ÐµÑÐ¸ÑÐ¸ÐºÐ° ÑÐ°Ð±Ð¾ÑÑ Ð¸ Ð²Ð·Ð°Ð¸Ð¼Ð¾Ð´ÐµÐ¹ÑÑÐ²Ð¸Ñ Ð¾ÑÐ´ÐµÐ»ÑÐ½ÑÑ ÐºÐ¾Ð¼Ð¿Ð¾Ð½ÐµÐ½ÑÐ¾Ð² ÐºÐ»Ð°ÑÑÐµÑÐ°, Ð¾ÑÐ¾Ð±ÐµÐ½Ð½Ð¾ÑÑÐ¸ ÑÐ°Ð±Ð¾ÑÑ DNS-ÑÐµÑÐ²ÐµÑÐ° Ð¸ ÑÐ°Ð·ÑÐµÑÐµÐ½Ð¸Ðµ MAC-Ð°Ð´ÑÐµÑÐ¾Ð² Ð¿Ð¾ Ð¿ÑÐ¾ÑÐ¾ÐºÐ¾Ð»Ñ ARP. ÐÑÐ»Ð¸ ÑÐ°ÑÑÐ¼Ð¾ÑÑÐµÐ½Ñ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐ¸, ÑÐ²ÑÐ·Ð°Ð½Ð½ÑÐµ Ñ Ð½Ð°Ð»Ð¸ÑÐ¸ÐµÐ¼ ÑÑÑÐ°Ð½Ð¾Ð²Ð»ÐµÐ½Ð½Ð¾Ð¹ Ð¿ÑÐ¸Ð²Ð¸Ð»ÐµÐ³Ð¸ÐµÐ¹ CAP_NET_RAW. ÐÑÐ»Ð¸ Ð¿ÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ñ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÐµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð² Ð¾Ð±Ð»Ð°ÑÑÐ¸ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ ÑÐµÑÐ¸ Ð² ÐºÐ»Ð°ÑÑÐµÑÐ°Ñ Kubernetes. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ» ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½ Ð´ÐµÐ¼Ð¾Ð½ÑÑÑÐ°ÑÐ¸Ð¾Ð½Ð½ÑÐ¹ ÑÑÐµÐ½Ð´ Ð´Ð»Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð°ÑÐ°Ðº ARP- Ð¸ DNS- spoofing Ð² ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ°Ñ Kubernetes, Ð¿Ð¾Ð·Ð²Ð¾Ð»ÑÑÑÐ¸Ð¹ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐºÑÐ¿Ð»Ð¾Ð¹ÑÐ°, Ð° ÑÐ°ÐºÐ¶Ðµ Ð¾ÑÑÐ»ÐµÐ¶Ð¸Ð²Ð°ÑÑ ÑÐ¾ÑÑÐ¾ÑÐ½Ð¸Ðµ ÑÐ¸ÑÑÐµÐ¼Ñ Ñ Ð¿Ð¾Ð¼Ð¾ÑÑÑ ÑÑÐ¸Ð»Ð¸Ñ Ð´Ð»Ñ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐµÑÐµÐ²Ð¾Ð³Ð¾ ÑÑÐ°ÑÐ¸ÐºÐ° Ð¸ ÑÐµÑÐµÐ²ÑÑ Ð½Ð°ÑÑÑÐ¾ÐµÐº. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÑÐ°Ð±Ð¾ÑÑ ÑÐ°ÐºÐ¶Ðµ Ð±ÑÐ»Ð¸ Ð¿ÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½Ñ Ð¼ÐµÑÐ¾Ð´Ñ Ð¿ÑÐ¾ÑÐ¸Ð²Ð¾Ð´ÐµÐ¹ÑÑÐ²Ð¸Ñ Ð°ÑÐ°ÐºÐ°Ð¼ ARP- Ð¸ DNS-spoofing Ð² ÐºÐ»Ð°ÑÑÐµÑÐµ Kubernetes. Ð¡Ð¾ÑÑÐ°Ð²Ð»ÐµÐ½Ñ ÑÐµÐºÐ¾Ð¼ÐµÐ½Ð´Ð°ÑÐ¸Ð¸ Ð¿Ð¾ Ð²ÑÐ±Ð¾ÑÑ Ð¿ÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½Ð½ÑÑ Ð¿Ð¾Ð´ÑÐ¾Ð´Ð¾Ð² Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ ÑÑÐµÐ±Ð¾Ð²Ð°Ð½Ð¸Ð¹ Ñ Ð·Ð°ÑÐ¸ÑÐ°ÐµÐ¼Ð¾Ð¹ Ð¸Ð½ÑÑÐ°ÑÑÑÑÐºÑÑÑÐµ, Ð¾ÑÐ¾Ð±ÐµÐ½Ð½Ð¾ÑÑÐµÐ¹ ÐºÐ¾Ð½ÑÐ¸Ð³ÑÑÐ°ÑÐ¸Ð¸ ÐºÐ»Ð°ÑÑÐµÑÐ° Ð¸ Ð²Ð»Ð¸ÑÐ½Ð¸Ðµ ÐºÐ°Ð¶Ð´Ð¾Ð³Ð¾ Ð¼ÐµÑÐ¾Ð´Ð° Ð½Ð° ÑÑÐ½ÐºÑÐ¸Ð¾Ð½Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¹ Ð² ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ°Ñ. ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð² ÐºÐ°ÑÐµÑÑÐ²Ðµ Ð¾ÑÐ½Ð¾Ð²Ñ Ð´Ð»Ñ Ð²ÑÐ±Ð¾ÑÐ° ÑÑÑÐ°ÑÐµÐ³Ð¸Ð¸ Ð¿Ð¾ Ð¿ÑÐ¾ÑÐ¸Ð²Ð¾Ð´ÐµÐ¹ÑÑÐ²Ð¸Ñ ÑÐµÑÐµÐ²ÑÐ¼ Ð°ÑÐ°ÐºÐ°Ð¼ ARP- Ð¸ DNS-spoofing Ð² ÐºÐ¾Ð½ÑÐµÐ¹Ð½ÐµÑÐ°Ñ Kubernetes.
description: The topic of the graduate qualification work is Â«Counteracting ARP- and DNS-spoofing attacks in Kubernetes containers with the CAP_NET_RAW capabilityÂ». The purpose of the study is to increase the security of Kubernetes containers from ARP- and DNS-spoofing attacks with the CAP_NET_RAW capability. The subject of the work is modern methods to counter ARP and DNS spoofing attacks in Kubernetes containers. The research set the following goals: 1. Explore the internal network structure in a Kubernetes cluster. 2. Analyze the impact of the installed CAP_NET_RAW capability on the security of the Kubernetes cluster. 3. Develop a demonstration stand for practical research of ARP- and DNS-spoofing attacks in Kubernetes containers with the ability to monitor the system state. 4. Create rules to counter ARP- and DNS-spoofing attacks in Kubernetes containers. During the work, the network model in Kubernetes containers, the specifics of the operation and interaction of individual cluster components, the features of the DNS server and the resolution of MAC addresses via the ARP protocol were studied. Vulnerabilities associated with having the CAP_NET_RAW privilege installed were reviewed. Modern research in the field of network security in Kubernetes clusters was analyzed. As a result of the work, a demo stand was developed for analyzing ARP and DNS spoofing attacks in Kubernetes containers, allowing one to research the operation of an exploit, as well as monitor the state of the system using utilities for studying network traffic and network settings. As a result of the work, methods were also proposed to counter ARP and DNS spoofing attacks in the Kubernetes cluster. Recommendations have been made for selecting the proposed approaches based on the requirements of the protected infrastructure, cluster configuration features, and the impact of each method on the functioning of applications in containers. The results obtained can be used as a basis for choosing a strategy to counter ARP and DNS spoofing network attacks in Kubernetes containers.