Habib Bahruddin
Member
Work From Cloud
Habib Bahruddin is a serial entrepreneur and independent security researcher. His work focuses on vulnerability research and cloud security, while turning technical ideas into products and business opportunities. He is an active CTF competitor with multiple national and international achievements, including 1st place at the International Cloud Village CTF at BSides San Francisco in 2023 and 3rd place at DEF CON 29 Cloud Village CTF in 2021.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
Honeypod: Turn Your Pod into a Kubernetes Decoy
Honeypod is a Kubernetes operator that deploys a decoy control plane inside an existing cluster and redirects compromised workloads away from the real Kubernetes API. When an attacker steals a ServiceAccount token and begins exploring the cluster, Honeypod makes them believe they have reached the real control plane with realistic workloads, RBAC permissions, and Kubernetes API behavior.
Unlike a simulated API, Honeypod runs a functional Kubernetes control plane. Commands such as kubectl get pods or kubectl create deployment behave as expected, preventing the environment from easily revealing itself as a decoy. Meanwhile, every action performed with the stolen token is attributed and recorded, similar to Kubernetes Audit Logs.
Inspired by post-compromise lateral movement seen in incidents such as the Hugging Face breach, this session explores how Honeypod can contain attackers after initial access, protect real workloads, and help security teams understand what attackers do once they compromise a pod.
- 16:20
- Tue
- 01 Dec
Stage:
Arsenal 3
Sessions Type:
Keynote