# KubeHound: Detecting Microservices' Security Smells in Kubernetes Deployments
## 4 Detecting Security Smells in Kubernetes-Based Microservices
### Hardcoded Secrets
(5) Using the pyshark library (a Python wrapper to tshark), the resulting capture file is loaded and packets are filtered by excluding those whose source or destination IP is present in the nodes IP list. This is carried out to exclude them from the analysis health check requests performed by the cluster's nodes, since they are often made using plain HTTP[40]. (6) Every packet in the capture file is analysed and each packet for which tshark decoded the HTTP protocol layer is saved in a list. (7) If no HTTP packets are found, then the capture file is analysed again,

Figure 3: A sketch of the networking in Kubernetes: intra-pod communications exploit the loopback interface, while inter-pod communications exploit the eth0 interface, with each pod having its unique IP in the overlay network[38]. trying to identify HTTP2 packets. The motivation for detecting HTTP2 is that high-level protocols such as gRPC are implemented on top of HTTP2 [43]. The detection of the HTTP2 protocol layer is not performed by tshark by default, and an additional decoding flag has to be specified during the capture loading. (8) Finally, if any HTTP or HTTP2 packets are detected, corresponding instances of the _Non-Secured Service-to-Service Communications_ smell are reported, together with a sample of the packets that triggered this report. Sometimes tshark will incorrectly detect the HTTP protocol layer on packets that are part of a TLS stream. In our experience, this situation occurs quite commonly, even when dealing with relatively small capture files. This could lead to false positives, as unencrypted traffic could be falsely detected. To mitigate this issue, the plugin implements a heuristic that exploits the fact that HTTP packets start with a printable line. On detection of HTTP packets, the tool will try to decode the first line as ASCII. If this decoding fails then the packet is simply ignored. In our experiments, this was sufficient to eliminate false positives without impacting the effectiveness of the smell-detection technique when unencrypted HTTP traffic was present. ## 6 Assessment

In this section, we report on the assessment of KubeHound by illustrating its application in controlled experiments (Section 6.1) and two case studies (Section 6.2). The controlled experiments are based on a mock application, which we realised ad hoc to enable the injection of the instances of security smells that should be detected. The two case studies are instead based on two third-party microservice applications, viz., Sock Shop [44] and Online Boutique [45]. To enable repetition of our experiments and case studies, all the necessary data are publicly available on GitHub ([[https://github.com/di-unipi-socc/kube-hound/tree/master/data/examples](https://github.com/di-unipi-socc/kube-hound/tree/master/data/examples)]([https://github.com/di-unipi-socc/kube-hound/tree/master/data/examples](https://github.com/di-unipi-socc/kube-hound/tree/master/data/examples)). A snapshot of the experiments' data is also stored on Software Heritage at [[https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.com/di-unipi-socc/kube-hound&path=data/examples](https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.com/di-unipi-socc/kube-hound&path=data/examples)]([https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.com/di-unipi-socc/kube-hound&path=data/examples](https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.com/di-unipi-socc/kube-hound&path=data/examples)), accessed on 26 June 2023). ### Controlled Experiments

To experiment with KubeHound's functionalities, we developed a simple mock microservice application. Despite there already existing benchmarking microservice applications, such as Sock Shop [44] and Online Boutique [45], they are not focused on security aspects, but rather on experimenting with the microservice-based architectural style.