# KubeHound: Detecting Microservices' Security Smells in Kubernetes Deployments
## 4 Detecting Security Smells in Kubernetes-Based Microservices
### Hardcoded Secrets
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Name** & **Type** & **Input** & **Detected Smells** & **Tools** \\ \hline \hline _Insufficient Access Control in_ & static & OpenAPI & \begin{tabular}{c} _Insufficient Access Control_, \\ _Centralised Authorisation_ \\ \end{tabular} & - \\ \hline \hline _Insufficient Access Control in_ & dynamic on & & & \\ _Services’ Implementations_ & unmodified & OpenAPI & _Insufficient Access Control_ & \begin{tabular}{c} OpenAPI- \\ fuzzer \\ \end{tabular} \\ \hline \hline _Insufficient Access Control to_ & dynamic on & & & \\ _the Kubernetes API_ & unmodified & - & _Insufficient Access Control_ & \begin{tabular}{c} Kube- \\ hunter \\ \end{tabular} \\ \hline \hline _Exposal Kubernetes Services_ & static & Kubernetes & _Publicly Accessible Microservices_ & - \\ _using service type_ & static & & & \\ _is_ & dynamic on & & & \\ _is_ & unmodified & - & _Publicly Accessible Microservices_ & - \\ \hline \hline _Exposal Kubernetes Services_ & dynamic on & & & \\ _using Port Scanning_ & unmodified & - & _Publicly Accessible Microservices_ & \begin{tabular}{c} Nmap, \\ Kube- \\ hunter \\ \end{tabular} \\ \hline \hline _Unnecessary Priiliges to_ & static & Kubernetes & _Unnecessary Priiliges_ & \begin{tabular}{c} Kubesec.io, \\ _to Microservices_ \\ \end{tabular} & \begin{tabular}{c} Kubesec.io, \\ Checkov \\ \end{tabular} \\ \hline \hline _Misconfigured_ & \begin{tabular}{c} dynamic on \\ unmodified \\ cluster \\ \end{tabular} & - & \begin{tabular}{c} _Unnecessary Priiliges_ \\ _to Microservices_ \\ \end{tabular} & \begin{tabular}{c} Kube- \\ bench \\ \end{tabular} \\ \hline \hline _Usage of Cryptographic_ & static & source code & _Own Crypto Code_ & Sonarque \\ _Primitives_ & static & source code & _Own Crypto Code_ & - \\ \hline \hline _Subicious_ & static & Kubernetes & _Non-Encrypted Data Exposure_ & Checkov \\ _Explude in DBMSs_ & static & \begin{tabular}{c} Kubernetes \\ configuration files \\ \end{tabular} & _Haroded Secrets_ & Checkov \\ \hline \hline _Hardoxed Unencrypted_ & static & Kubernetes & _Haroded Secrets_ & Checkov \\ _Kubernetes Secrets_ & static & \begin{tabular}{c} Dockerfile, \\ source code \\ \end{tabular} & _Haroded Secrets_ & \begin{tabular}{c} Checkov, \\ Sonarque \\ \end{tabular} \\ \hline \hline _Handoxed Secrets in_ & dynamic on & & & \\ _Containers’ Environment_ & unmodified & - & _Haroded Secrets_ & - \\ \hline \hline _Unencrypted_ & \
\begin{tabular}{c} dynamic on \\ modified \\ cluster \\ \end{tabular} & - &
\begin{tabular}{c} _Non-Scrud_ \\ _Service-to-Service Communications_ \\ \end{tabular} & - \\ \hline \hline _User Context Drop in_ & dynamic on & & & \\ _internal requests_ & modified & - & _Unauthenticated Traffic_, _Certralised Authorisation_ & - \\ \hline \hline _Multiple Authentication_ & & & \\ _Enflopoints in Services’_ & static & OpenAPI & _Multiple User Authentication_ & - \\ _API specifications_ & & & \\ \hline _Suspicious Authentication_ & static & OpenAPI & _Multiple User Authentication_ & - \\ _Enflopoints and Parameters_ & dynamic on & & & \\ _Compilation Endpoints_ & unmodified & - & _Multiple User Authentication_ & - \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Analyses to automatically detect microservices’ security smells. ### Architecture of KubeHound

The main goal of KubeHound is to enable automation of the detection of the microservices' security smells of [PERSON] et al. (2018) by running analysis techniques such as those outlined in Section 4. KubeHound therefore takes as input the Kubernetes configuration files and Dockerfiles specifying the target application deployment and a configuration file specifying where to retrieve the microservices' source code and their API specifications in the OpenAPI standard, when available. The Kubernetes cluster to which it connects to run dynamic smell-detection techniques is instead automatically retrieved from the KUBECONFIG variable specified in the environment where KubeHound is running.