security1 publisher
Root on a Kubernetes node makes the SPIRE agent sign a neighbour's identity for you
Unit 42 showed that spoofing the cgroup data a SPIRE agent reads during workload attestation makes it hand over a co-located workload's SVID, and released a tool so defenders can size the loss per node.
Publishers:unit42.paloaltonetworks.com
Reality
- Evidence68
- Adoption22
- Hype gap+18
- Incentives65
- Confidence55