Certificates 019 Low Default Injected Init Container Requires Sensitive Capabilities 021 Low Execution of System Commands without Validation 008 Informational Weak Trust Boundary Between Workload Container unauthenticated users with a wide range of information about the Cluster, Istio’s configuration, and execution information about running programs. It could be used to target other services or potentially in /requirements/ 32 | Google Istio Security Assessment Google / NCC Group Confidential Finding Execution of System Commands without Validation Risk Informational Impact: Low, Exploitability: Low Identifier

end of the audit, the these are the stats of the fuzzers: Fuzzer Total executions Total hours of execution FuzzWriteTo 78,576,767 150.3 FuzzRunTemplate 925,533,849 103.5 FuzzReadCACert 39,734,279 91.8 write vulnerability. If the Operator runs with high privileges, this could lead to remote code execution. Even without sudo privileges, the vulnerability could have multiple attack vectors. The root cause Effective Lifetime ID: ADA-IST-3 Fix: https://github.com/istio/istio/pull/41786 Description If execution goes into this branch, outFile is not closed: https://github.com/istio/istio/blob/d0705cf0ed559

process Bypass adaptor SkyWalking backend Tracing Metric Receiver in gRPC/HTTP Analysis Core Query CoreIstio telemetry Attribute Vocabulary https://istio.io/docs/reference/config/policy-and- tel AlarmRecord belong to this type.Query in GraphQL • Five types query • Metadata • Metric • Aggregation • Trace • Alarm https://github.com/apache/incubator- skywalking-query-protocolEcosystem powered

● Resolving DNS for services in remote clusters #IstioCon Role of DNS in Istio, Today 1. DNS query httpbin.ns1.svc.cluster.local 2. DNS response – 10.4.4.4 http req to 10.4.4.4 GET /status/200 ns1.svc.cluster.local SVC IP: 10.4.4.4 #IstioCon DNS Issues on VMs accessing K8s SVCs 1. DNS query for httpbin.ns1.svc.cluster.local 2. DNS response – no such host httpbin.ns1.svc.cluster.local 4.4.4 #IstioCon DNS Issues on ext-TCP SVCs without VIPs #IstioCon Smart DNS Proxying 1. DNS query httpbin.ns1.svc.cluster.local 2. Cached DNS response – 10.4.4.4 DNS queries to the system configured

accesses to services. Deploy web application firewall to defend against DDoS, injection, remote execution attacks. Edge security Egress 2. Define egress security policies to defend against data exfiltration

“src”: “Canada” : } getDetails(…): Req parameter /api?…&UPC=[…]&src=warehouse12&… Test execution sequence : : Problem • Test uses outcome of a previous API request • Context propagation rarely

不能容忍，能否低成本解决？ Ø 比如常用运维降级、止损能力各个产品线重复建设，方案差异大，OP期望运维能力在不同产品线之间能够通用化， 集中化管理，甚至做到自动决策 Ø 精细故障能力（异常query、注入延迟等）期望能够标准化、低成本跨产品线复制 Ø 百度APP架构缺少上下游模块视图和流量视图，黄金指标不足，导致容量管理压测效率低、混沌工程实施成 本高、故障定位成本高。 #IstioCon