# KubeHound: Detecting Microservices' Security Smells in Kubernetes Deployments
## 4 Detecting Security Smells in Kubernetes-Based Microservices
### Hardcoded Secrets
**User Context Drop in Internal Requests**. This technique enables the detection of an instance of the _Unauthenticated Traffic_ smell by dynamically analysing the distributed traces of microservice interactions to detect a drop in user context in such traces. In microservice applications, there is the need to share the calling user context among the microservices, which is used to propagate user claims in a decentralised manner and to ensure the authenticity of requests. Typically, this is achieved by propagating a signed token (often a JSON Web Token) to each involved service. Such a service can then verify the signature and enact access control based on the user claims contained in the token. The analysis makes individual requests to the target application and, by exploiting network probes in the cluster, traces the call graph of the request. The user context drop occurs if, at some point in the call graph, requests do not have the user context token anymore. This is an instance of the _Unauthenticated Traffic_ smell, since (starting from the service that dropped the user context) requests are no longer authenticated. ### Multiple User Authentication

We consider three different instances of the _Multiple User Authentication_ smell, for which we hereafter introduce three different detection techniques. The techniques enable the detection of such smell instances in the OpenAPI specification of microservices' APIs or by interacting with token-emission endpoints. **Multiple Authentication Endpoints in Services' API specifications**. This technique enables the detection of an instance of the _Multiple User Authentication_ smell by statically analysing the specification of the microservices' APIs in the OpenAPI standard [23]. The analysis detects multiple endpoints that enact user authentication, as per the specifications in the security field in the OpenAPI specification (described in Section 4.1). If the analysis detects multiple endpoints secured through HTTP basic authorisation (i.e., username and password), it considers this as an instance of the _Multiple User Authentication_ smell. **Suspicious Authentication Endpoints and Parameters**. This technique also enables the detection of an instance of the _Multiple User Authentication_ smell by statically analysing the specification of the microservices' APIs in the OpenAPI standard [23]. The analysis, however, focuses on identifying, from the OpenAPI specification of the microservices, endpoints with suspicious names and parameters that would suggest that such endpoints are performing authentication. These endpoint names can be things such as /auth or /login, and parameter names can be things such as username or password. The _Multiple User Authentication_ smell is detected if there are multiple such endpoints in an application. **Multiple Access Token Emission Endpoints**. This technique enables the detection of an instance of the _Multiple User Authentication_ smell by dynamically looking for multiple endpoints that emit an access token back to the user. The emission of a token is common practice for standard authentication methods such as OAuth2 and OpenID Connect. Following the single-sign-on pattern, there should be only one endpoint that can emit such tokens. Therefore, this dynamic analysis can make requests to the application and analyse the responses to detect if they contain an access token. If we detect multiple endpoints emitting an access token, we have an instance of the _Multiple User Authentication_ smell. ### Centralised Authorisation

Instances of the _Centralised Authorisation_ smell can be detected with the _User Context Drop in internal requests_ analysis described in Section 4.8. Indeed, if authorisation is performed only at the edge of the application, the user context will not be propagated through the internal services, which can be interpreted as a user context drop by the gateway.