# KubeHound: Detecting Microservices' Security Smells in Kubernetes Deployments
## 4 Detecting Security Smells in Kubernetes-Based Microservices
### Hardcoded Secrets
Using the Kubernetes API, the plugin retrieves the information about all the Kubernetes services running on a cluster, including its External-IP (if any). The service names are then matched against the user-provided properties. We report an instance of the _Publicly Accessible Microservices_ smell for each service that has a non-empty external IP. This plugin makes use of the services' properties claimed in the input configuration file: if some service is declared external, it will assume that it was intentionally exposed to the public by the development team and it will not report any corresponding smell instance. Unencrypted Pod-to-Pod Traffic with Ksniff.We implemented as a plugin for KubeHound to detect unencrypted pod-to-pod traffic (Section 4.7), that is, an instance of the _Non_Secured Service-to-Service Communications_ smell ([[https://github.com/di-unipi-socc/kube-hound/blob/master/kube_hound/builtin_analyses/unencrypted_pod_to_pod_traffic.py](https://github.com/di-unipi-socc/kube-hound/blob/master/kube_hound/builtin_analyses/unencrypted_pod_to_pod_traffic.py)]([https://github.com/di-unipi-socc/kube-hound/blob/master/kube_hound/builtin_analyses/unencrypted_pod_to_pod_traffic.py](https://github.com/di-unipi-socc/kube-hound/blob/master/kube_hound/builtin_analyses/unencrypted_pod_to_pod_traffic.py)), accessed on 26 June 2023). In particular, the plugin focuses on detecting HTTP and HTTP2 packets, but it can be extended to work with other clear-text protocols. To achieve this, we injected network probes in the cluster to monitor traffic in the Kubernetes overlay network. Figure 3 sketches the internals of Kubernetes networking. Each pod is assigned an IP address in the overlay network, while containers in the same pod can communicate with each other using localhost[38]. This implies that every container in the pod has (at least) two network interfaces: a loopback interface and a pod-to-pod interface, typically called eth0[39]. The eth0 interface is also used for communications with external entities, e.g., health checks for the liveness of the pods[40]. The implementation of this plugin makes use of the tool Ksniff[41], which allows it to intercept and record traffic on clusters networked as in Figure 3. In particular, given a pod, a container, and a network interface, Ksniff will record the network traffic and it will save it on the local disk as a pcap file. Ksniff is run with the -p flag set, so as to deploy a privileged pod that has access to the node's network interfaces. This pod will run the tcpdump program to record network packets on the target interface. Following the network model presented above, this plugin will capture network traffic from the eth0 interface to intercept only pod-to-pod traffic. In the presence of a service mesh that enables mTLS via a sidecar container (e.g., the Istio service mesh), it is also possible to intercept clear-text service-to-service communications by capturing packets on the loopback interface[42]. This, other than providing a concrete basis to implement more sophisticated types of analysis that also take into account the content of network packets, is also an example of why services should be deployed with the fewest privileges. The takeover of a privileged pod by an attacker could result in eavesdropping of clear-text communications, even in the presence of a service mesh providing mTLS. The plugin executes the following steps: (1) Using the Kubernetes API, the external IP addresses of worker nodes are retrieved and stored in a list. (2) For each pod related to a service in the cluster, a Ksniff privileged pod is deployed on the cluster, recording on the eth0 interface. (3) The network traffic is recorded for a configurable amount of time (the default is 30 s) and the resulting network captures are stored in a temporary directory. (4) The Ksniff pods are destroyed to clean up the cluster.