Hacking Istio: The Good, the Bad, and the Misconfigured

Explore the intricacies of Istio security in this hands-on tutorial focused on identifying and exploiting vulnerabilities caused by misconfigurations. Dive into the world of network security tools provided by Istio, including mutual TLS encryption and AuthorizationPolicies for access control. Gain practical experience with pre-configured Kubernetes clusters featuring Istio installations and intentional vulnerabilities. Begin with an introduction to Istio before engaging in a collaborative, beginner-friendly exercise to find and exploit Istio misconfigurations. Receive guidance and hints as needed while working towards uncovering a hidden flag within the cluster. Learn about the new Ambient mode in Istio and its implications for configuring access control across different network layers. Conclude with a comprehensive walkthrough of the steps required to locate the concealed flag, reinforcing the critical importance of properly configuring Istio security policies and understanding the potential consequences of overlooked misconfigurations.

Tutorial: Hacking Istio: The Good, the Bad, and the Misconfigured - Nina Polshakova & Peter Jausovec