API8:2023 — Security Misconfiguration

Slide 1 · The Breach That Defined the Category

No password. Kubernetes on the internet. Tesla’s cloud mining for someone else.

February 2018 — RedLock researchers found Tesla’s admin console open to the world. Attackers had already been there.

📄 RedLock Cloud Security Intelligence Report · February 2018 · Palo Alto Networks

THE INCIDENT

Tesla Kubernetes Cryptojacking — February 2018

RedLock security researchers were scanning cloud environments for misconfigured services. They found that Tesla’s Kubernetes cluster — the orchestration system managing their cloud workloads — had its admin dashboard exposed directly on the internet with no password protection.

The Kubernetes dashboard is an administrative web interface that shows all running containers, their logs, and their environment variables. Tesla’s dashboard was accessible to anyone who knew the URL — no username, no password, no IP restriction.

What the researchers found inside: AWS credentials in environment variables within the Kubernetes pods — the standard way to pass cloud credentials to containers. More alarmingly, attackers had already found the dashboard before the researchers did. A Kubernetes pod was running a cryptomining script, using Tesla’s AWS compute resources to mine cryptocurrency for the attackers. The miner was configured to connect to a mining pool through a proxy to mask the traffic. Tesla was paying their AWS bill while attackers collected the mining proceeds.

Two misconfigurations. Both required.

This required two separate failures: (1) The Kubernetes dashboard was deployed with no authentication — a default configuration mistake. (2) AWS credentials were accessible as environment variables inside pods visible through that dashboard. Either fix alone would have limited the damage. This is the compounding nature of Security Misconfiguration.

← All modules What is API8? →