The Machine With Many Faces Identity Impersonation In Spiffe Spire

This talk explores the crucial role of machine identity in zero trust environments, emphasizing its importance alongside human identity. Eviatar Gerzi, a principal security researcher at CyberArk, discusses the vulnerabilities in the trust assumptions of SPIFFE and SPIRE, commonly used for workload authentication in Kubernetes and cloud-native systems. The speaker demonstrates how attackers can exploit these identity models through techniques such as selector spoofing, overlapping identities, and SVID/key extraction, using the open-source tool Spooffe to illustrate how adversaries can impersonate workloads and move laterally across clusters. Attendees will gain insights into strengthening SPIRE deployments to defend against workload identity attacks.