SPIFFE/SPIRE identity spoofing, in a Bite

Zero trust rests on attestation, and attestation rests on the node underneath it. That assumption held when one host ran one tenant. It gets shakier when a single node runs forty of them. Root once, and the reach is wider than most threat models admit.

• SPIRE hands out short-lived identity documents, called SVIDs, after it checks which container a process runs in.
• On Linux that check reads the cgroup path from /proc. Root on the node can write to that same path.
• An attacker copies a victim’s cgroup path, drops its own PID there, and asks the agent for an identity. The agent hands over a valid SVID.
• With that SVID, mTLS and other identity-based controls stop blocking lateral movement inside the cluster.
• Unit 42 has not seen the technique in the wild and released a tool called Spooffe so teams can test for it.

The lesson is blunt. Root on a node means every identity on that node is compromised. Rotate those identities after an incident and treat the host as a full breach.

Read the full analysis, with the defense checklist, at Root on One Kubernetes Node Is Every Identity on It.