Only Takes a Spark: Popping a Shell on 1000 Nodes
ayoul3 details attacking Apache Spark big data clusters, demonstrating how misconfigurations and unauthenticated APIs yield root shells across thousands of nodes.
Summary
Apache Spark in Distributed Data Processing
Apache Spark powers enterprise data pipelines, machine learning workloads, and analytics clusters spanning hundreds or thousands of high-performance compute nodes.
Exposed Cluster Management Interfaces
ayoul3 evaluates default configurations and unauthenticated master/worker REST APIs frequently exposed across corporate networks and public clouds.
Executing Arbitrary Code Across 1000 Nodes
Submitting malicious job payloads and manipulating deserialization endpoints enables executing arbitrary operating system commands simultaneously across entire cluster nodes.
Defending Distributed Big Data Infrastructure
The author outlines essential security controls, including enabling mutual TLS authentication, configuring network ACLs, and isolating worker processes.
Related talks
Main Stage·28 min
ayoul3
ayoul3 answers audience questions regarding Apache Spark cluster penetration testing, REST API security, and big data isolation.
Main Stage·42 min
Sheila A. Berta
Sheila A. Berta exposes critical security oversights across enterprise Big Data stacks (Hadoop, Spark, Flink), executing remote code execution on distributed analytics clusters.
NorthSec·27 min
Yossi Weizman
Engineers explore architecture and security mechanisms for NSEC2022 - Yossi Weizman - From the cluster to the cloud and back to the cluster: Lat. mov. in K8s.