As NASA prepares for its first crewed Artemis missions, the agency is preparing to build, test, and assemble…
Contract for new Galileo atomic clock tech signed – Technology Org
ESA has signed a €12 million contract with Leonardo S.p on behalf of the European Commission.A (Italy) and…
NASA-Supported Team Discovers Aurora-Like Radio Bursts Above Sunspot – Technology Org
A NASA-funded team of scientists has discovered long-lasting radio signals emanating from the Sun that are similar to…
NASA’s Webb Finds Ethanol, Other Icy Ingredients for Worlds – Technology Org
What do margaritas, vinegar, and ant stings have in common? They contain chemical ingredients that NASA’s James Webb…
Inflection-2.5: The Powerhouse LLM Rivaling GPT-4 and Gemini
Inflection AI has been making waves in the field of large language models (LLMs) with their recent unveiling of Inflection-2.5, a model that competes with the world’s leading LLMs, including OpenAI’s GPT-4 and Google’s Gemini. Inflection AI’s rapid rise has been further fueled by a massive…
Will the EU’s AI Act Set the Global Standard for AI Governance?
In an unprecedented move, the European Parliament officially passed the Artificial Intelligence Act (AI Act), a comprehensive set of regulations designed to govern the rapidly evolving field of artificial intelligence. This groundbreaking legislation, marking a first in the realm of AI governance, establishes a framework for…
Securing Kubernetes: mitigating the RCE flaw for Windows nodes – CyberTalk
EXECUTIVE SUMMARY:
As the backbone of modern container orchestration, Kubernetes plays a pivotal role in managing workloads across clusters. However, recent research has shed light on a critical vulnerability that demands attention from security practitioners. In this article, we delve into the specifics of the flaw and provide practical steps that can help you safeguard your Kubernetes environment.
The vulnerability
The flaw, tracked as CVE-2023-5528, allows attackers to remotely execute code with system privileges on Windows endpoints within a Kubernetes cluster. The severity score of 7.2 underscores the urgency around addressing this issue.
Exploitation mechanism
The vulnerability exploits Kubernetes volumes — a feature designed for data sharing between pods or persistent storage. By manipulating these volumes, attackers can escalate their privileges to admin level on Windows nodes.
“It is very easy to exploit this vulnerability because an attacker would only need to modify a parameter and apply 3 YAML files to gain remote control execution (RCE) over the Windows endpoints,” says cyber security analyst Tomer Peled. The Kubernetes framework leverages YAML files for “basically everything,” Peled noted.
Risk assessment and impact
Why should you be concerned?
1. Full takeover potential. Successful exploitation enables hackers to control all Windows nodes within the cluster.
2. Ease of exploitation. Modifying a single parameter and applying three YAML files is all it takes to achieve RCE.
3. Widespread impact. Default Kubernetes installations (versions earlier than 1.28.4) running on-premises or in Azure Kubernetes Service are vulnerable. Even if your cluster lacks Windows nodes, patching remains critical.
Mitigation strategies
Patch the cluster
- Immediate action: The flaw resides in the source code, making it an ongoing threat. Apply the available patch promptly, regardless of your cluster’s Windows node configuration.
YAML hygiene
- Audit YAML files. Regularly review YAML files used for pod creation and volume management. Ensure proper sanitization and input validation to prevent malicious injections.
Limit in-tree storage plugins
- While Kubernetes supports various volume types, consider minimizing reliance on in-tree storage plugins for Windows. Explore alternatives to reduce the attack surface.
Further thoughts
Address the Kubernetes RCE flaw head-on as to maintain the integrity of clusters and to protect your organization from potential breaches. Remember: Secure Kubernetes is resilient Kubernetes.
Please feel free to share this article with your cyber security team. For more insights into severe cyber security vulnerabilities, please see CyberTalk.org’s past coverage.
Lastly, subscribe to the CyberTalk.org newsletter for timely insights, cutting-edge analyses and more, delivered straight to your inbox each week.
Disney Dreamlight Valley Dev Gameloft Making Dungeons & Dragons Survival Sim Game
Gameloft, the studio behind Disney Dreamlight Valley, has revealed it is partnering with Wizards of the Coast to create a new Dungeons & Dragons game. It’s being developed for both consoles and PC and Gameloft describes it as an “innovative hybrid of survival, life simulation, and action RPG.”
Disney Dreamlight Valley is popular in the life sim genre, mixing fun gameplay, unique customization, and Disney together into a package that players seem to really enjoy. It launched into Early Access back in 2022 before the full release debuted in December. All of this is to say: if you’re a fan of Disney Dreamlight Valley and Dungeons & Dragons, there’s a new game to keep an eye on.
Currently untitled, Gameloft says in its announcement on Instagram that the game is set in the mythical Forgotten Realms, which is also the D&D setting Baldur’s Gate 3 takes place in. The game, which will mix survival, life simulation, and action RPG elements into one, will feature “unique cooperative gameplay,” the studio says.
“Players can expect an adventure where the rich lore of this legendary franchise meets real-time strategy in a unique campaign of resilience, camaraderie, and danger at nearly every turn,” the announcement reads.”
There’s no name for the project and no release window either. Gameloft is currently hiring for the project.
News of this D&D game arrives roughly a year after Wizards of the Coast, which owns the D&D IP and is a division within Hasbro, reportedly canceled five unannounced games. The last D&D game released was Dungeons & Dragons: Dark Alliance back in 2021 – read Game Informer’s review of it here.
Are you excited about this game? Let us know in the comments below!
Anthropic says Claude 3 Haiku is the fastest model in its class
Anthropic has released Claude 3 Haiku, the fastest and most affordable AI model in its intelligence class. Boasting state-of-the-art vision capabilities and strong performance on industry benchmarks, Haiku is touted as a versatile solution for a wide range of enterprise applications. The model is now available…