Matthew chapter 5. We're going to look at verse 5 today as we continue our study in the gospel of Matthew and as we continue our series through what has been referred to as the Sermon on the Mount. Verse 5 says, blessed are the meek for they shall inherit the earth. As we've been going through this particular portion of Scripture we have begun to look at what has been called the Sermon on the Mount. It's obvious that it's referred to as the Sermon on the Mount because Jesus is on a mount somewhere in the northern portion of Israel. He's in a region called Galilee and he's speaking at this time to a large group of people. Matthew refers to them as a multitude and this large group of people have gathered to hear him. Now as he sees this multitude he takes the opportunity to present to them things concerning the kingdom of God. Now that becomes to be a habit of the Lord Jesus Christ that multitudes gather and Jesus teaches. You'll see it in again throughout the gospel of Matthew but Mark in chapter 6 verse 34 says, Jesus when he came out saw a great multitude was moved with compassion for them because they were like sheep not having a shepherding he began to teach them many things and so that's what the Lord would do when given opportunity is he would speak to the multitude and would share with them concerning the things of the kingdom of God. Now it states to us that Jesus was seated there which tells us that as a rabbi he was now speaking with authority and he gives to them what is called the blessings or the beatitudes. As we've been looking at the beatitudes or the blessings the message he gives gives us insight into the steps of coming to faith in him as well as insight into the qualities of a genuine Christian. Now we here in the United States have surveys every once in a while and people will answer the survey as it pertains to whether or not they have a religious faith and very often the highest percentage of response will be in the survey concerning religious faith will be that they have Christian faith 83% and above in the United States very often will will say that we are Christians well the fact of the matter is as many people refer to themselves as Christians but in reality they're anything but they haven't been born again they don't like to read the Word of God they don't have fellowship with other Christians they never speak concerning faith in Christ unless it's an argument concerning the religious preference and very often these who are arguing out in the state and that that they are Christians they don't have a relationship with God through Jesus Christ they don't have a faith in him and so Jesus is actually telling us how one becomes a Christian and he speaks concerning in this way he says blessed are those who are poor in spirit now when he says blessed are the poor in spirit as I've been mentioning to you blessed are those who have an awareness of your spiritual poverty blessed is the one who realizes that you have nothing to offer God at all blessed are you when you stop believing that you can earn or purchase eternal life blessed are you when you realize your spiritual poverty Romans 11 34 and 35 says it like this who has known the mind of the Lord or who has become his counselor or who has first given to him and it shall be repaid to him who first gave to God so that God owes you anything is what Paul is asking and those who have spiritual poverty are simply those who have realized that we have nothing to offer God at all I can't bargain with him I can't say that I've been good I've been religious I can't do any of that and Jesus said blessed is the one who is recognizing their spiritual poverty for theirs is the kingdom of heaven and so with that will come mourning blessed blessed is the one who mourns blessed is the one who recognizes that they have sinned against God because when we have understood that we are spiritually impoverished it leads to our mourning over sin not simply the fact that we sin and do wrong but primarily because we have sinned against God and we have a personal guilt like it says again in Psalm 51 4 against you you only have I sinned and done this evil in your sight and so one to be a Christian means that I recognize my spiritual poverty to it results in a response of mourning over my sin against God and then three it produces a meekness of heart that should characterize a Christian now in our society there is confusion about what meekness really is many consider meekness to be weakness and they don't find the quality of meekness attractive the readers digest Oxford complete word finder gives a list of synonyms for meekness tame timid mild unambitious retiring weak docile acquiescent repressed spiritless these words are not properly describing what it means to be meek this is typical of how many people look at meekness and that's why they find it unattractive poverty of spirit mourning meekness these aren't acceptable qualities to possess for many people you see the way of the world is to defend yourself constantly to fight to argue to look out for number one to deflate footballs to win a game I mean that's what the world does super bowl humor but that kind of mentality only produces unhappiness conflict and hurt it runs contrary to what the Lord would have us to be like in Proverbs 29 23 it says a man's pride shall bring him low but honor shall uphold the humble in spirit meekness speaks of being mild or soft the word describes a soft breeze a soothing medicine meekness is a gentleness of spirit a quietness a tender heartedness but it does not mean weakness the word has an association with domesticated animals specifically beasts of burden like an ox and an ox at the plow is not weak it's strong the key is his power is harnessed and directed and therefore meekness is strength that is submitted to an appropriate authority when you read the Bible you'll find this interesting I hope in the Bible only two people are ever spoken of as being meek Moses and Jesus when you read numbers chapter 12 verse 3 it says Moses was very meek above all the men which were upon the face of the earth and in Matthew 11 28 and 29 Jesus said come unto me all you that labor in our heavy laden I will give you rest take my yoke upon you learn of me for I am meek and lowly in heart and you shall find rest unto your souls so only Moses and Jesus are ever spoken of as being meek in Scripture but nobody who reads their Bible would ever say that either Moses or Jesus was weak nobody would say that I mean when you look at Moses Moses dealt firmly with that Egyptian taskmaster and he led the children of Israel with firmness we remember the story of Moses we remember how that in Exodus chapter 2 the Lord had spoken to him or rather in his heart he had perceived that he was to lead the children of Israel to be a deliverer and what had happened is Moses had gone to visit the children of Israel and while he went to visit them there was a Hebrew that was being mistreated by a taskmaster now the taskmasters and some of you may not be aware of this maybe you've never been taught this or it's just it hasn't been something that that you've heard in the past but the taskmasters during the time of the Jewish captivity in Egypt the taskmasters were amongst the strongest and meanest members of the Egyptian society they would bully the Hebrew slaves they intimidated them they were ferocious and frightening and so with that kind of mentality they they were lording it over and they were the taskmasters so here's Moses Moses goes to visit the children of Israel and he watches as a taskmaster abuses one of his Hebrew brethren and the Bible is very clear about this it speaks of how that Moses looks to the left and then he looks to the right and then he immediately kills this taskmaster don't let that get past you because it's telling you something you see what Moses was doing is he already had sized up this taskmaster he had no fear of him at all he was simply looking to see if there are going to be any witnesses to what i'm about to do that shows to me confidence it shows to me that he had a capacity to take care of business in an instant he's not even thinking in terms of what is going to happen he's just looking to the left to see who's watching nobody looks to the right there's nobody there and then he immediately kills him and buries him in the sand now when you think of Moses you may not be thinking of him in that light because again according to numbers 12 3 Moses was very meek above all the men which were upon the face of the earth he was the most meek of the meek and yet when he saw this injustice he responded with ferocity in the book of acts chapter 7 verse 22 Moses was learned learned in all the wisdom of the Egyptians and was mighty in words and deeds one of the things we need to remember about Moses is he was in the house of Pharaoh being raised as one of his sons in line to the Egyptian throne he would have been trained in everything that would be offered to somebody in that position which included martial arts so Moses was was the Cain Velasquez we'll say of the Jews he was a UFC fighter a champion that's what he was and so when he sees the task master he's not intimidated at all about it he looks to the left he looks to the right there's nobody watching bang it's done bury you off we go so meekness is not weakness meekness is not being powerless it is power that is under authority who would say that Jesus Christ was weak anybody who would speak of him in that way is really doesn't have an understanding of who this man was Jesus was a carpenter as a carpenter he worked with his hands if he was going to make a table he didn't call Bethlehem lumber and said I'd like to order some you know one by fours he would go out into the forest he would cut down the tree he would prepare it he would bring it his hands would have been calloused his back would have been strong his legs were strong he walked everywhere he went and there are times that he'd take a day's journey that's 20 miles that he would walk with his men Jesus was also a mason he worked with his hands with stone so his hands would have been bruised and cut up by all that heavy labor and that kind of works so when you think of Jesus very often you get caught up of thinking him like some of the pictures we've seen in in medieval art where Jesus is meek and mild with a lamb over his shoulder and kind of a sad face the little glow around his head he didn't glow in the dark and when you saw Jesus this was listen carefully this was a man's man he was the kind of man that a fisherman like like the apostle Peter would follow he was the kind of man that had strong men following when you read about the apostle Peter on one occasion he by himself pulls a a net filled of fish he drags these this net up by himself 153 fish this was a powerful man and this powerful man named the apostle Peter followed another powerful man by the name of Jesus Christ it was Jesus Christ who walks into the temple you see it in John chapter 2 and then later on in in Matthew we'll see that and he walks into the temple and he sees what's taking place there with the sale of animals and and the ripping off of the people for religious reasons he fashions a cord into a whip cords into a whip and he drives them out he didn't cross his arms and tap his foot and say this makes me very angry he drove them out it is written my father's house shall be a house of prayer you have made it he said into a den of thieves this is a man's man this is somebody who walks in and says i'm not putting up with this he didn't do it just once he did it twice this is a man who would speak to the religious authorities of his day and he would speak firmly to them and even refer to them in unflattering terms you are serpents you are whitewashed tombs that takes a strength so when you think of Jesus as being weak he was never weak he stood before the high priest and challenged the high priest when the high priest was questioning him and Jesus challenged that high priest when that high priest said tell me about your work and your disciples and he said go and ask somebody out there and see they've all heard they've all seen the things that i did somebody punches Jesus in the face do you speak to the high priest like that if i've done wrong then judge me for the wrong but if not why are you striking me that's strength when Jesus did that he's standing before Pontius Pilate and Pontius Pilate says you answer me nothing don't you know that i have the power to to put you to death and Jesus looking back at the Roman governor who is trying him says you have no power at all unless it's given to you Jesus Christ was not a wimp Jesus had strength and majesty about him and by the way by the way anytime you're preaching the gospel sharing the word of God and you're coming against the tide of the age that takes courage and that takes strength to do that because it's easier as a dead fish to flow down the stream but it takes a live one to go against it and that takes the holy spirits powering you but you don't come with an argumentative arrogant mindset you come with humility but you come with the knowledge that the strength you have comes from God himself Jesus didn't defend himself but he did defend others and there are times when the church has to stand up to defend others the rights of the unborn those who are being victimized in the society we have that call from God and we ought to stand up and we ought to speak with the kind of conviction that God gives to those who are on the side of justice in that which is right and Jesus does that amen you can clap if you like that's the truth so Jesus would do nothing to defend himself he didn't use his supernatural or even his natural power for his own welfare because he was meek meekness is not weakness again meekness is power under control in Proverbs 1632 he who is slow to anger is better than the mighty he who rules his spirit then he who takes a city meekness is a quality of gentleness that results when we see ourselves for what we really are it results when we become aware of our need for God and cry out for his mercy it exists when we have spiritual knowledge of our self we have understanding and when our knowledge understanding and passion is in balance now meekness is a necessary quality for many reasons there are blessings and Jesus says it here in verse five that are coming with meekness blessed are the meek for they shall inherit the earth so it's a necessary quality for various reasons and we receive benefits and blessings through it it's how we receive God's word to be saved in the first place and it's how we we grow in our faith after we're saved James 1 21 says get rid of all moral filth and the evil that is so prevalent and meekly accept this word planted in you which can save you meekness increases your joy Isaiah 29 19 says the meek also shall increase their joy in the Lord and the poor among men shall rejoice in the Holy One of Israel meekness is how you will live a contented life Psalm 22 26 says the meek shall eat and be satisfied they shall praise the Lord that seek him your heart shall live forever with meekness you become a better witness for Jesus Christ in 1 Peter 3 15 said it says sanctify the Lord God in your heart be ready always to give an answer to every man that asks you a reason of the hope that is in you with meekness and fear with meekness and respect for men meekness it is it is withholding and it's presenting with gentleness see i've had a lot of lessons God teaches us meekness and he's been working in me for a long time in this one particular area meekness because i too have had misunderstanding of what meekness actually is i was very argumentative i was arrogant on more than one occasion but especially so as a young man no excuse but explanation i got saved i was brought out of darkness into light i was excited about the Lord Jesus Christ and what he does in somebody's life how he transforms still in process being changed and all still learning about him and all but very excited about being a Christian and as a young man i started reading the bible i started studying i started going to bible college i started picking up books to help me to understand the elements of the Christian faith i began to speak to people who would knock on my door and and bring a false doctrine to me especially Mormons and Jehovah's witnesses and i can still remember a young man knocking on at my door i was in my mid 20s at the time so it's been a couple of years and knocked on the door and i answered the door hello how can i help you he says well i'm just going door to door sharing the good news of the kingdom i said really he says yes i'm a Jehovah's witness and i just wanted to know if you have a few minutes that you'd like to talk about God and i said sure he says do you know anything have you ever heard of the Jehovah's witnesses and i said yes i have and he says oh what do you think of Jehovah's witnesses and i said i think you're a false prophet i think that you lie to people and that you're going to the hell that you deny exists that's what i think you are now isn't that kind isn't that meek wasn't that sweet that was me i was a cult hunter some of you don't know that i would actually hunt them in my Volkswagen that's the truth i am not lying to you i would drive down neighborhoods and i'd pull over and wait and they would walk up to my door to talk to me bang thank you very much let's get it off that was me i'm serious i really was abusive arrogant self-righteous unloving everything you shouldn't be that's that's me as a young man i i said god you know what zeal for thy house has consumed me i want to speak about you and and the lord for years has taught me a simple lesson in the greek he taught it to me in the greek i'll tell you it in english shut up shut up you don't have to win every argument you don't have to present all that you know listen and love them respond to their questions and show humility the things i've given to you are not intended to burn other people they're intended to show the love of god stop having to be right about everything stop having to be right in every argument have a ear to hear what somebody else is saying and with meekness speak to them concerning the things of god it has taken me years to learn that years oh by the way i am still more than willing to speak about the lord and say what is true but i don't do it with arrogance anymore i hope i don't do it with that kind of attitude anymore i i want to love the person and share listen the god that we worship is a god of love and i my heart goes out to you because you're out there knocking on doors and writing your 10 speeds and all of that and and and and would to god more christians would would have it in their heart to take for the truth what you do for that which is not true but at the same time these humility and the meekness that should be in a man's heart had not been in mind we are not to be arrogant we're not to be argumentative we're to be patient and loving and we share the word of god with other people and that's what god has called us to do one of the things that lord has taught me and is teaching me and has taught me to do over the years and i can share this with some who perhaps will benefit from this one bit of advice or one lesson i've learned is this to learn to bite my tongue there have been times when i when i wanted to just share what's on my mind and i literally literally would take my teeth and bite my tongue in a literal way and i listen and i actually would bite my tongue because it was my way of reminding myself shut up shut up shut up you can do that with your children you can do that with friends you i have learned to just bite my tongue i bit my tongue so much i have half a tongue i have bitten my tongue so many times because the lord has said i don't need your mouth to bring my truth at this moment they're not going to listen to you especially with your attitude so you do me a greater service by saying nothing than if you open your mouth at this moment and i have learned to do that i have learned to bite my tongue and not to share sometimes just to listen because sometimes people need an ear more than they need to hear my voice and then there's a certain withholding that that there that you will sometimes need to do you can feel guilty i should share but lord haven't you commanded me to share but the holy spirit will prompt you sometimes and will say not at this moment not at this moment listen to what they're saying because later on you may have opportunity to share in response to what's being said right now and so there are benefits to the meekness that the lord would have us to have in order that we might also be blessed he says not only that but he says the meek shall inherit the earth the meek shall inherit the earth the word inherit means to receive your rightful inheritance it speaks of receiving your allotted portion you shall inherit the earth your allotted portion when god created man he gave to man dominion over the earth man was given stewardship of god's creation and adam was created to care for creation in a proper way but when he was tempted he yielded it up he yielded up his authority luke chapter four verses five through seven says the devil taking him taking jesus on high mountain showed him all the kingdoms of the world in a moment of time and the devil said to him all this authority i will give you and their glory for this has been delivered to me and i give it to whom ever i wish therefore if you will worship before me all will be yours this has been delivered to me adam yielded it up when jesus died on the cross he paid the penalty for sin he redeemed man but he also redeems creation romans 8 19 through 21 says all creation is waiting eagerly for the future day when god will reveal who his children really are against its will everything on earth was subjected to god's curse all creation anticipates the day when it will join god's children in glorious freedom from death and decay so the meek shall inherit the earth the complete fulfillment of that work is still yet in the future one day god will take the earth out of the hands of the enemy and the wicked who dominate today you read your newspaper you see the things that are going on and you begin to wonder how long oh lord is like what the psalmist asap in psalm 73 verses 3 through 5 says he said i envied the proud when i saw them prosper despite their wickedness they seem to live such a painless life their bodies are so healthy and strong they aren't troubled like other people or plagued with problems like everyone else you raised your kid to fear the lord your kid doesn't want to go to school and the pagan next door has one of those bumper stickers my kid is an honor student and you want to have your pagan kid go beat up that honor student there's something inside you how long oh lord give them devotions pray with them take them to church i do all the things that you call me to do i love them for christ's sake but they're not listening how long i pray i seek you i've lost my job i pray i seek you i can't take him to the to the doctor i can't afford the medical care how long and they don't ever get sick they seem to prosper that's all that's going on i don't understand well asaf wrote that and he went on to say in verses 16 through 19 i tried to understand why the wicked prosper but what a difficult task it is then one day i went into your sanctuary oh god and i thought about the destiny of the wicked truly you put them on a slippery path and send them sliding over the cliff to destruction in an instant they are destroyed swept away by terror sometimes it can seem as if the wicked will always prosper and we believers will live in constant tension but that's not true god's word declares the unrighteous shall not inherit the kingdom of god and as believers we come to the place of simply trusting the lord to do what is right god will settle accounts and so we live by faith and we rest in his promises and his promise in the future is what belongs to christ belongs also to us we will inherit the earth in first Corinthians 3 21 3 23 let no one boast of men for all things are yours whether paul or apollos or seafus or the world or life or death or the present or the future all are yours and you are christ's and christ is god's amazing because we trust in jesus our place in his kingdom is as secure as his the meek because they've received god's grace live in peace with god now and in the future because only meekness will give complete glory to god pride seeks its own glory meekness seeks god's glory and meekness teaches us that when we have him we have all that we will ever need so blessed are the meek for they shall inherit the earth


All right so I had a question asked specifically about like kind of what I did as a trauma PA and then also talking about my patient's census because I mentioned that I had a census or we as the trauma team had a census of over 60 patients and the person that commented said you know that's a lot. I thought 20 patients was a lot which 20 patients is a lot but 60 is a lot as well and so I just wanted to clarify for you guys like exactly like what that looks like what does the 60 patient census look like who and how much I'm really responsible for and what I do on a consistent basis as a trauma PA. So let's get into the video right now. All right what's up you guys to Donna welcome back to my channel. Okay so 60 patient census yes that is in totality so obviously I've mentioned before that as the trauma team like there's throughput in terms of like what how a patient is like comes into the hospital how they're seen and then like how they kind of maneuver throughout the hospital and then essentially go home and so for the trauma team like we are we are in the emergency department but we are not part of the emergency department at least on our trauma side. We are separate although we are adjacent to so adjuncts I guess you can say so a person can come into emergency department and then be upgraded to become a trauma or they can come into the hospital and be just go straight to trauma or they can just come directly to trauma after being called on the box from the EMS saying like hey you know like no I don't need a console this is literally just information I'm coming in with a 55 year old male that was in a car accident had a long extrication they're splintering on the windshield loss of consciousness diminished GCS right and so immediately this person is coming directly to trauma this is not something that the emergency department is going to handle so that is like we are like the first line of defense I guess you could say in terms of the trauma PAs like we will be the ones that are seeing the patient and we are very much like super super involved like it is our patient yes we have our attendings that are like their names are like the ones that are on the patient but there are certain cases and certain patients that we will see on our own and then we will talk to our attendings about it you know when they come out of the OR or whatever the case may be we'll let them know what our plan of action has been thus far and if there is anything that they want us to do in addition they'll let us know but we are the first line so if a patient comes in I'm going to be doing like the assessment I'm going to be prescribing the medication I'm going to be doing all of that getting all the various different you know imaging that is essentially what happens and so those patients that come in will be seen on the next shift if they are here overnight and so that adds to our census so if we have like 10 patients or 15 patients in total in the ICU and then we had five patients in the IMC but then we have 30 patients on the floor that's 50 patients already and that's kind of how it goes so in trauma our patients are spread out everywhere there's going to be patients in the emergency department there are going to be patients in the trauma they're going to be patients in the OR in the PACU they're going to be patients on the floor in the ICU and in our step down unit now we are responsible for seeing all of those patients because we have to know what's going on with each of those patients and although I am not like directly kind of taking care of the patients in the ICU because there are ICU PAs for that any patient anywhere else I will be taking care of them now because we are a trauma and acute care service we see all of the general surgery patients as well so your small bowel obstructions your appendicitis and your colostitis like all of those like that's our bread and butter as well so we will have patients that are primarily medicine in nature however we as a consulting service for general surgery will also be managing those patients so when I say I have a 60 patient census that is overall so the trauma PA team has two attendings like for the an A we have the list kind of split up into A and B so the A team and the B team will have each an attending they will also have each a PA and then the ICU like attending that's taking care of all the trauma and critical care patients that came in will also be a part of the team but they're generally like we're still primary as the trauma team so it's it's kind of weird like they're primary but also kind of consulting in the ICU because they're boarding there and then they will have their own PA so I will be seeing let's say all of the patients on the B team but also some of those patients might be in the ICU so I'll have to go and see them although the majority of the care will be done by the ICU PA I still have to know what's going on with that patient because if there is something emergently that's wrong like from a traumatic standpoint or like you know a wound back is working or something along those lines or the patient is bleeding and I need to now come and throw a couple sutures into something they call me you know like the ICU PA will call me and be like hey this is what's going on so yes it is a lot of patients I think on each list we would have like maybe like 30 or so patients sometimes 20 and the majority of them will be floor status so 20 will still have like about 20 patients that we are responsible for so it is still a lot of patients a lot of notes to write a lot of people to like kind of be up on and that is why like I always have my trusty handy list and I have my little notes on my list a little like highlighted in different colors so I know like what's going on with each patient I'll have check marks for things that I've done things that still need to be done will be in a different color you have to be very systematic when you're dealing with lots of people and they all need something and so from a trauma PA standpoint like we do a lot you know we're gonna still see traumas that come in actively you know if you come in from a bicycle accident like I still will have to run downstairs and see you if my trauma EDPA colleague is busy with another trauma we will have to pick up that kind of you know like slack I guess you could say which is not really a good word but we'll just have to help out help and you know like triage that patient as well because they need to be seen but at the same time I still will have floor patients that need to be managed and so it's really important for us to be a team be team players but ultimately I'm not only just seeing patients in the emergency department and and in the trauma bay I'm managing floor patients as well and so that's where our synthesis can balloon like out of control and that's where we can get inundated with the various different tasks like pulling out chest tubes or inserting ng tubes or you know we get a consult for you know some of the sub specialties and we have to run and do like a fully a placement or we have to go do a line placement or put a chest tube in or there's a fistula that's bleeding there are all these aspects of things that we have to kind of triage as well as taking care of our patients and so if that's not something that you want to do if that's not something that you want to like be a part of if you solely want to just see patients and then send them out you know like then emergency medicine and urgent care is for you but from the trauma in the trauma service we see patients and they stay with us for a little bit longer okay it's not just like a one and done like I'm seeing you for 24 hours and that's it although we do have those aspects of patients as well but that is what I do as a trauma PA if you want a more in-depth detailed look maybe I might try to like do some videos or something I don't know we'll see how that can go but I can try to like just be a little bit more detailed about like the day to day but ultimately like that is essentially it and when it comes down to our senses our senses can balloon out of control especially in the summer times when trauma is extremely high because people are out having fun and being stupid so we can have a really high senses but ultimately because we have a team and we are team players you know it makes the workload like all right so I hope I answered you guys question if you have any other questions for me leave them in the comment section below thank you guys so much for watching be sure to stay tuned for the new series called who wants to be and if you haven't already also like this video follow me on instagram and down the pa and on instagram I get that see university and don't forget to subscribe thank you guys I will talk to you guys next time


Mission Impossible. Across the Fast and the Furious, Dead Reckoning Part 1 is out in theaters, and I had a chance to watch it. I'm gonna tell you how it is. There's a lot of Part 1s this year. At an easy breezy cover girl, Mission Impossible Dead Reckoning Part 1 is the longest Mission Impossible movie so far. I think. I didn't actually look. I'm just assuming. Because every movie now is stupidly long. This is gonna be a spoiler-free review. If you choose to accept that, I would appreciate a subscription by just, you know, hitting that subscribe wherever you can find it. It's somewhere. It's all over actually. So just please do that. Let's talk about this film. Tom Cruise is back, baby, as Ethan Hunt. And he's got his whole crew with him. We got Simon Pegas Benji. We got my always beautiful Rebecca Ferguson as Ilsa. And we got Vin Reims as Luther, who somehow turned into the oracle in this film. I don't know if it was just me, but every time he talked, it was in like riddles or as some sort of sage advice. I don't remember that in the past movies so much. But here, whenever he's talking to Ethan, he's like, in the future, you're gonna have to make a choice. Either the red or the blue pill. And whatever you choose, chaos will follow. It just felt like they were on a park bench and Agent Smith was right around the corner. And he's telling them like, listen, dude, this is what you have to do to win the Matrix. Haley Atwell joins the team as Grace. Solid pick. Very nice to see her. Very nice to see all of her. Vanessa Kirby's back is the white widow. And we also have Mantis here from Guardians of the Galaxy. Played by Pom Clemente Frenchname. I can't pronounce things. Let's keep going. Actually, let's not keep going. Let's pump the brakes and talk about Pom's character here for a second. Paris. Easily the highlight of the film for me outside of TC of course, running. He's doing this a lot. You got to love it every time. But Pom is straight up hardly quitting it throughout this film. I can't imagine another critic has made this correlation. I'm sure I'm the first one because I'm such a creative genius on this platform. But yeah, she was giving me shades of joke or she was giving me shades of Harley. In fact, I think she was kind of doing it better. I loved her. I absolutely loved her here. Let's talk about what else I loved. The action. Just as fantastic as always. Big set pieces.  Stuff's blowing up. He's climbing up a train at one point, which is easily my favorite part of the film. And it straight up seemed like something out of Uncharted 2. In fact, a lot of this movie felt like set pieces from Uncharted 2 or the series in general. And I was all for it because that game is awesome. There's a few villains in this film. Naturally, we have double crosses, triple crosses, Chris crosses will make you jump crosses. And then there is the main threat. The AI, the artificial intelligence that's everywhere, all the time seen and hacking into everything, simply known as the entity.  It's called the entity.  They say that word so many times. It's a little bit insult. It's almost as much as family is said in a Fast and the Furious film. And much like the Fast and the Furious franchise or some of these others that have gone on for decades at this point, you kind of know what you're getting into with the Mission Impossible movie, just like a John Wick movie.  This is no different. So if you're on board, if you're with this mission, you chose to accept, you're probably gonna love this. I liked it a lot. I wouldn't say I loved. I honestly felt the writing was pretty weak in this movie. It felt a lot dumber than past Mission Impossible movies that seemed pretty sharp. This one was just kind of like, eh, there's like two agents constantly running after Ethan. They're like the two Stooges. They're everywhere all the time.  It's just slapstick nonsense. But they never leave.  I also felt this plot was incredibly convoluted. It was hard to know which agency who was working for and what side anyone was on. There was so many different agencies going throughout this flick that it just felt a little disjointed. And I had a hard time really connecting to any of it. It was pretty much just, okay, they're doing exposition dumps again, and then we're gonna have an awesome chase scene for like 25 minutes, more exposition dumps, which there are three or four that go on for a long time, and then more cool action. And that's pretty much the summary of Mission Impossible Dead Reckoning Part 1. Now, I will say, unlike Across the Spider-Verse and Fast 10, the ending, the Part 1 cliffhanger of this is way more satisfying than those two films. This just has kind of a more completed story arc, even though there's still more story to tell. It felt like a natural conclusion to a film, whereas Across the Spider-Verse and Fast 10 leave on these giant cliffhanger, like, big crescendo building moments. And so that leaves you feeling unsatisfied. This feels like a complete picture, and I'm excited for what's to come. Definitely not my favorite in the franchise. I'd probably throw it somewhere in the middle of the mix. But even a mid-tier Mission Impossible movie is still a great time at the theaters. Well, those are my thoughts on Mission Impossible Dead Reckoning Part 1. What a title. Oh, what a title. Let me know yours. Have you seen the movie yet? Are you excited to see the movie? Put it in the comments. It helps the algorithm, I think. I don't really know what the YouTube entity is going to do with any of this anymore, but like, share, do all that stuff, and I think it will keep it happy. You have to feed the entity to make it happy. If you've been following me for a while and you want to show some support, I have a Patreon at patreon.com slash adamdosmovies. There's a few different tiers you can sign up for. Show some support, or you can become a member right here on YouTube via that join button. Any little extra help you can give means a lot. This is a passion project for me. I have a full-time job, a family, and different adult stuff going on, so really, I mean, crowdfunding helps quite a bit. I would appreciate it. Take care.


Hi, thank you for joining us for another session of SuperUserTV. I'm Shemal Tahir with IBM, representing the Product Work Group for this session. Hi, I'm Carol Barrett with Intel, and happy to talk about the community roadmap that the Product Work Group has been producing for the past couple of releases. We first started producing the release, actually, the roadmap rather in Vancouver. And the reason for doing this was a couple. One was we wanted to be able to have a consolidated view of what were the projects we were doing, where were they focusing their energy, what type of enhancements were coming into the projects so that the community could be aware in different projects. So that operators could have that information to base their current deployments, scaling them, planning maintenance, upgrades, and new operators could go ahead and have that information as they're considering how they were going to start their deployment.  So it's a lot of data that we gather, and the last roadmap, actually, we had about 27 projects that we covered. And from that perspective, what we aim to do was we wanted to collect that information, make it available to the users and the community of OpenStack, whether you're a developer, an operator, a business decision maker. And to that end, we took this data, and on top of this data, we built what we call views, and each view offers a different level of detail. So the highest level of view provides information on themes. What we define as themes today are things like scalability, resiliency, manageability, interoperability, modularity to give a very broad brushstroke idea of what's happening in a release of OpenStack or within a project of OpenStack. And then the next level of detail is we actually say, OK, if a release had a certain theme, which projects were actually working against that theme? And that's why we said the theme for this release is so-and-so. And then finally, of course, if you're really interested in knowing the internal workings of how the teams are operating and what they're working on, from that perspective, we have the last level of detail, which is giving you exact transcript, almost, of what information we got from the project teams themselves. Right? Which is what you would expect if you think about how we go ahead and put together the information. So we start by the last set of information that we published in the roadmap. And then we actually sit down and interview the PTLs to get their latest thinking on what are they going to do in this upcoming release and how that's going to continue or change in the release after that. And then we take the information from specs and other ether pads and blueprints and consolidate that into a set of information to feed those different views. And then review it with the PTLs and the project teams to make sure that we have the latest information and the most accurate view of it all before we go ahead and compile it together. I think maybe the other thing to think about and where to share in as we talk about the roadmap is what we cover in the roadmap. So what projects are in there? Because the Big Ten is ever increasing. And that's more resources than we have inside of the product workgroup to be able to go ahead and get that level of information. So we look at what are the top projects that are being adopted by operators today? And we look to the user survey to tell us that information. So we target being able to include all the projects that are greater than 10% reported deployment in the user survey.  And then the last thing we look at is what are the up-and-coming projects that we're hearing operators talk about? That we want to go ahead and be able to provide that information so that they can start to think about when might be a time for them to either start to do a POC or dive in and learn more about it. That's really how we figure it out. And for this release, that brought us to a total of 28 projects. Or in the last release, it had been 22. And previous to that, it had been 17. So we're ever increasing our coverage on the Big Ten to provide that information out to the community and to operators. Exactly. And so in the roadmap, and we don't have enough time to go through the entire detail of what we have in there, but you have find information in there that tells you that Glantz has focused on a new image API for uploading images. And then, of course, Nova will continue to work on scalability through Cells V2, and so there's a ton of data in there. And where you can find the roadmap is opensack.org slash roadmap. And if you're using the roadmap, we're also looking for feedback on seeing how we can maybe define better themes or how we might be able to better represent the data as well. So feel free to drop us a line on the Product Work Group mailing list, or you'll find us in IRC as well. And we'll be glad to hear. And keep an eye out for the upcoming Newton Design series as well, where you can watch videos of some of the PTLs of the top projects that will talk to you directly from their voice and what their teams are focused on and what they think are the top priorities for them. Well, thank you so much, Carol. Thanks, Shameel.


All right. Talk is going to be a little bit about a container escape. Those of you that are unaware. Enjoy. What's up, Defcon? Yeah, mice are hot now. After that, I think we're going to do great. All right. I'm Dagan. Hi, I'm Will Klein. So we're all here as, you know, we're mostly like SRE, DevOps type people, setting up clusters. We're not pentesters. So, you know, but when we're going through setting up these clusters, we notice some things and kind of repeating patterns of, you know, security issues that aren't being talked about enough. And that's kind of what we decide to put this talk together for. You don't have to be a Kubernetes developer to understand what we're talking about here, but you just got to think like one and there's no zero days today here. This has all been disclosed properly. And we're going to have three different demos that we're going to run through different types of exploits that we want to tell everyone about. With that being said, with our demos at the end, I have a GitHub URL. The demo environment is set up in a local laptop using make and that file is available. So anybody that wants to can go and just clone that repo. You'll be able to step through each of the demos we do today yourself on your laptop. And there's also a step-by-step walkthrough. All right, let's get started.  I like to think of Kubernetes as the operating system for the cloud. It takes anywhere from one to several thousand nodes or individual servers and turns it into a single orchestrated system. That system can span an entire data center. It can span multiple data centers and multiple clouds. It's the ultimate shift left platform. As a Kubernetes developer, not only are you able to take advantage of containerization to bring your file system and all of your dependencies with your application. You're also able to declare the exact way that your application should be instantiated. You can say I want to run this command with these args. You can include your configuration. You can say I want five instances of it and I don't want any of those instances running in the same availability zone. You can go further and declare how much CPU time should be allotted to each of your applications, how much memory is reserved for your applications. You can say this is what I want you to do to monitor the health of the application and how to respond when it becomes unhealthy. Even how to scale the application. Kubernetes is an extraordinarily powerful system. The other thing that's really nice about Kubernetes is that you basically have decades of Google's experience and other large cloud providers' experience in setting up these large scale systems. They've distilled all that down in a series of APIs to help you at any scale you want, whether it's like a Raspberry Pi up to as big as Google, deploy these applications and manage them. You get a lot of lessons learned out of that. It's really powerful system for managing your systems. Today we're going to talk about pining a cluster. I want to just think about what we consider this pining a cluster. Basically, with all of that power to schedule workloads, spin up new instances, manage the networking, what does pining mean here? We're talking about running your own workloads. This could be as simple as Bitcoin miners. This could be something that you're using as more of an implant to pivot to other containers in the cluster, stuff like that. We're modifying existing workloads. That could be if I'm running some application that's managing throughput from user data. If I can manage to modify the configuration of that pod in a way that makes it vulnerable to further exploitation, that's called pining. We're going to talk about hijacking traffic. One of the tools that we talk about a little bit is Istio, which is the most robust and interesting man in the middle proxy you've ever seen in your life. It's incredibly powerful. If you can take control of that, you can man in middle literally anything in the cluster. It's really powerful. Finally, the fourth one here is breaking out so that you're executing code on the host as root. At that point, you control everything and that's the pop calc up on the Windows box and prove you owned it. We're going to talk about three different attack angles today. Realistically, this is not a real cluster that we're going to throw all this through. These vulnerabilities probably could have existed at the same time, but it's not like we ran into a cluster that had all of these at the same time. Again, no zero days today. We're going to start with phase one here. No more secrets. I mentioned earlier Istio is a giant man in the middle proxy. Basically, the idea is that we're going to inject something into every time we launch a container. We're going to hook onto it to take all of this traffic through IP tables. We're going to use MTLS mutual TLS authentication so that when you as a developer writing a service, you don't have to figure out how to make MTLS work. You just run your pod in a system with Istio and you get the benefit of all that. That's kind of where Kubernetes becomes really powerful because we can take all of these lessons learned and hard cryptographic problems and boil it down so the developers don't have to think about it. It's kind of like just bolt on end to end encryption and it works really well most of the time. One of the other great things about it is this Keali tool, which is visualization. So now that you're intercepting all the traffic and watching it through the network, you can really figure out what you're doing and how your network is working. A quick shout out to JWT's pronounced jot JSON web token. Obviously, we're not talking that much about it, but I just want to bring it up as a concept of when you see this, it's a very common authentication protocol, how these little cookies are made. Jot.io is a really great website for if you ever get one of those and you have to interpret it. And the important part here is that it gets h-macked at the end. So as everyone knows, cryptography is perfect and very easy to implement. So we're going to talk a little bit about something we noticed. You guys ready to hear about a vulnerability? Yeah. So one day, Dagen's setting up Keali on one of these clusters and we're bringing it up, bringing it down. He's tweaking all the parameters in the Helm chart to figure out how to deploy it right. And after doing that the first time, it stands out the first time, you get that login page, hot damn, got it. And then the next time you don't get the login page and eventually he notices that he's taking these pods up and down and the login page doesn't refresh. He doesn't have to log in each time. So in Kubernetes, pods are generally ephemeral, which means that they're not storing data between sessions. And there's ways to store persistent data in Kubernetes. So we started digging into it like, okay, if it's keeping my session alive, it's storing that information, that cryptography to do the HMAC signing. So I dug in. And in Kubernetes, there's a lot of ways that you can persist data as what we're saying. In this particular case, what I would have expected to see is a Kubernetes secret where you install Keali for the first time, it looks for the secret, it doesn't exist, so it creates it. From then on it would see that same secret and use that as its signing key for the job. But there was no secret. I would delete the entire namespace, anything associated with it, and I was still logged in. The only piece of persistence was the cookie that was sitting in my browser, which meant there was two possibilities, equally terrifying. The first is there's no authentication of the cookie whatsoever. You just simply say, hey, I'm admin, and Keali's like, I'll take your word for it. The other is a hard-coded secret that's being used to sign the key. So I dug through the code and you can see the bottom-right corner. Keali, hello. Let's see how we're doing on time. I got a couple of minutes. Anyway, I went over to Jot.io, and I threw that in, and I was able to just recreate or fabricate a perfectly valid Jot that would allow me to access Keali as an admin. The reason that that happened is because they had an insecure default. It could be configured and overwritten in the Helm chart to specify, but nowhere did anybody take the time to say, when you're installing this application, you should definitely do this. So nowhere did it actually happen. So let's take a look. So here's the Keali login page. I'll go ahead and refresh it just to show I'm not logged in.  I'm going to come over to Jot.io and fabricate a Jot. The sample on the left isn't signed because there's no secret in here. I'll put in Keali as a secret. I now have a signed Jot. Just going to copy that onto the clipboard. Using developer tools on my browser, I'll add a cookie. It's just called Keali-token, and the contents of the cookie are just the Jot, which is totally valid, assuming it wasn't already signed by a completely hard-coded secret. Now when I refresh the page... Fortunately, from the attacker, Keali is extraordinarily powerful. There's a lot that I can do here. It's a powerful service mesh that allows me to completely rewrite how traffic gets managed. If I want to send 10% of your login traffic to my server instead, I can do that. If I want to add entirely new ingress points to things that shouldn't be secure or shouldn't be exposed, I can do that. I can pretty much do anything that I want to do. So, Dagen, we were sitting at the bar that day and you were telling me the story about this. One of the things you mentioned was that when you kept reloading the page the next day and the next day, it still stayed up. How did you make that work? Well, my talk on security ramifications of time travel was rejected, but I'll explain. So, here's the code that Keali uses to authenticate a cookie. Sorry, a Jot. The line 67 there, it's the second one from the top. It just says to the library, hey, can you parse this token and if it's valid, give me back the claims. What developers didn't understand is that particular library, it didn't care what time it was. It just said, yes, this is a validly signed Jot. What's not on there is any attempt to say, well, the expiration date is that in the past? It wasn't there. So, you could do a replay attack with this, no problem. So, if we imagine our fictitious cluster here, we're able to get to this Keali service, we're able to forge credentials, and with that, we can pretty much read anything in the cluster and we can write to Istio, which is the networking, you know, throbbing the nervous system of this cluster, and we can reroute that wherever we want. You know, the default for installing Keali is not read-only. So, at this point, we can manage the middle proxy, literally anything we want.  So, at this point, it's faced to say, we pretty much pwned that cluster. You know, not much left to do there. So, that's all right, thanks for coming to our DefCon talk. But, Dagan, we've promised them three demos. So, what if, what if I said earlier the default wasn't that it was read-only. Let's say it was read-only. What do we do with read-only now? Okay, that is admittedly a little bit of a challenge, but fortunately, this talk doesn't end there. So, let's go back and we'll say, we're going to make this harder on ourselves, and let's say that somebody responsible named Will Klein set up this instance of Keali, and so it is in view-only mode. What could we do? Enter my friend, Fleet. So, is anybody out there familiar with Fleet with Rancher? Okay, so you guys know? Two victims. Do you work for Rancher? Listen up. So, this was responsibly disclosed, and it has been resolved. But, Fleet is GitOps. So, for those not familiar with GitOps, it's essentially a really popular and great way, genuinely a good way of administering cloud infrastructure, where you put your configuration, you put whatever the manifest that you need to deploy into your cluster into a Git repository. And then you can have multiple clusters pointed at the same Git repository, and it's an easy way to build at scale. Also, it's Git, so it's actually very auditable, and you can go back and say, hey, Will, you deployed this thing. Why did you do that? There's other instances of GitOps tools for Kubernetes. Flux is a popular one. Argo CD is a little bit more mature. But anyway, that's Fleet. Well, the other thing that's great about GitOps tools like Fleet is you can basically, you know, everyone's had the situation if you're any sort of cloud admin, where you set something up, it's running good, and then, you know, somebody comes along and says, oops, needed to expand that disk a little bit, and oops, needed to redirect that and change labels here.  GitOps tools will constantly be syncing that and looking at it and saying like, nope, back to what Git says. Nope, back to what Git says. So you always can quickly understand what's running in your cluster and how it's being deployed, and that's just generally a really good thing. It makes life easy. Makes sense. Let's talk about logging. I've been professionally developing for about 15 years, and one of the things that I've come to learn is that developers either whisper or they shout when it comes to logging. Unfortunately, in this case, Fleet was one that was more of a shouter, and as I was digging through the logs one day, in fact, it's even a little bit worse than that. When you're running Fleet with multiple clusters, and that's not what we're doing in our demo, but just so you know how bad this was, if there's an error message, it gets displayed in the UI within a product called Rancher Dashboard, and so it's very, very helpful. And I was working with Fleet, and I tried to deploy something and it didn't work, so there was an error message that popped up that said, I tried to get this Git repo, and I wasn't able to. The problem was, Fleet uses a library called GoGetter from Hashicorp, and the way that GoGetter works is you provide a URL that tells it everything it needs to know to go and get whatever file you're asking for. It can work with Git repositories. It's a very valuable tool. But in order to get the Git repository, you need to give credentials. And so those credentials need to be embedded in the URL. And when the error comes back and says, I couldn't get this entire URL, and the credentials are in it, the error message that gets logged includes the credentials to the Git repository, which we just said you can use to deploy anything you want to all of your clusters. So what could we do with something like that? So as previously mentioned, Keali is super powerful. One of the things that lets you do is look at logs of individual workloads. So I'm going to take a look at the Fleet agent logs. And oh my goodness, is that a Base64 encoded SSH private key? Fortunately, it's encoded, so nobody knows how to get access to this now. It's perfectly safe. This is my actual GitHub private key, by the way. Of course, you're running low on entropy, so you only have one. Let's see, Base64 to code. Oh my gosh, it's an actual private key. So what else could I do with this? Well, one of the things that it did that the log message told me also is the actual URL to the Git repo that it was trying to read. Could I perhaps clone that and see what's there? Yep, I can. And it turns out it's a Helm chart, which I can do some interesting things with. It turns out the reason that there was an error is if you look at the branches listed, it's only main. Main is the only branch that exists, but this is looking for the develop branch. So what would happen if I created a develop branch, put my payload into it, and pushed it back up to the Git repo? Well, let's find out. I'll just create a job, and I'm going to put my malicious payload into that job. This one's set to just pop a reverse shell. Apparently I have right permissions, and now it's a waiting game. GitOps does its thing, and I have my reverse shell. So to keep this sort of going, we're going to add some more contrivances. Again, Fleet has global permissions. I could install anything that I wanted at this point. I truly own this cluster. But what if, again, somebody named will client set this up and actually constrained the default cluster role that Fleet runs under, so it can only do some things. It can deploy a pod, which would be pretty smart. Yeah, so basically, we're looking at this cluster now. If we think about it, we've gone in, and we've taken a service that's generally like kind of an available thing. We've gotten past that. We kind of locked it down a little bit retroactively there, but we can see the logs now of all the pods. We're looking at Fleet. We managed to get access to the GitOps.  Well, GitOps happens pretty often, especially with GitLab tokens, where the developer will go in and generate a personal token with read-write access instead of going in and creating a deploy token with only read access. If we only had read access, this would be a lot harder to do, but there's a lot that you can do with that information. Once we have write access to the GitOps repo, now we can push and we can do whatever we want just like we were the cluster admin. It's really convenient for cluster admins, and it's also really convenient for anybody else so really, at this point, it's kind of pwned because we could literally run anything we want because the GitOps tool is just bobsledding whatever we put in to get into your cluster, and that's how it works, and it's working as planned. So what went wrong is the developers at Rancher were using a library, and they used it properly, but they didn't fully understand what contents would be in that error message, so they got an error and they logged the error, which is normally a reasonable thing to do, but sometimes that can turn into an information disclosure. It's kind of understandable to be fair. When I traced it, the error was passed up through nine different call stacks, so it was just like, here's an error, here's an error, here's an error, and when you get to the very top one, it was like, I don't know, log it. That way we know what went wrong. All right, and so we're going to talk about phase three here, so let's pretend that we had, in this fictitious cluster, we have a read-only Keali, we have a super locked-down RBAC around our GitOps tool, but let's look around and see what we can find there. So, in this cluster we're working on together, we were using this tool called Longhorn. Now, when I said earlier that Kubernetes is this whole API, really the API describes how to do all the things you want to do in your cluster, like, I want to launch a service, or I want to have an endpoint, right? But there's actually the API-specific implementations, vary cluster to cluster. So, there's a thing called the container storage interface. It represents how is persistent data going to be stored on the cluster. You know, normally the pods are completely ephemeral, so you lose it, you lose it. Longhorn is a microservice-based storage system that runs on Kubernetes, so at this point you have Kubernetes storage feeding Kubernetes storage, so it's a pretty neat project in that sense. It's made by Rancher, and you know, there's basically, there's a couple different pods running, but there are two ones that we want to talk about today. One of them is an instance manager, which means that, which is running on every single node as a daemon set, and the daemon set says, you know, when a new auto-scaled node pops up, I want to launch my pod on that one and do some things. So, it's running everywhere in the cluster, this daemon set, and then there's also the Longhorn manager, which kind of wrangles all of those instance managers running all the different instances. So, these have a communication between them, and they manage the provisioning of storage and all the different actions. So, as part of our, you know, hardening, getting things ready, you know, I pull up Longhorn, and I'm looking at some of the pod security policies, PSPs, those are being deprecated, but that's a talk for KubeCon. And I'm looking at the default ones, and I'm just like, wow, they're basically allowing everything, there's a requirement, there is a PSP, but you've done everything you can to disable anything useful in it. So, it's like having the firewall and everything's left open to all the ports, right? What's the point of having a firewall? You're just checking a box that you have one at that point. So, we started going in and trying to figure out, like okay, what can I narrow this down for, and I'm going in and out, and we're launching it and tearing it down, and just, it's taking forever because every time I try to take the least amount of privileges away from it, it crashes and won't run. And so, we're piecing this apart and it's like, well, really, there is no reasonable PSP around this. It's doing all sorts of nasty things. It's bringing in directories from the root on the host into the container on the inside, and then it's also running itself as root, which, if you're in a container and you're mounting all the important directories inside your container and running as root, you're not really a container anymore. You're just a way to run code at that point. It nullifies any of the security advantages. So, we're looking at this thinking, okay, well, at least we can try to make the network layer secure because they didn't support any network policy or MTLS. So, I started digging into that now and just more of this weird behavior where the network policies are really difficult to write because every time it does something, it opens up a new port. And fun fact that a lot of people don't know that when you're declaring your pod spec, you specify which ports you have, that's more of just road signs and information. Your pod can listen on anything. That is absolutely not a firewall. That's not a firewall rule? So, we're looking at this for people where they literally thought that those were some sort of firewall that was blocking traffic. It's really just a convenient shorthand to help you locate the port. So, we can't lock it down. We can't, you know, the inside the container is a mess. The network king is a mess. And at some point, we start talking about, like, what is this pod doing and why is it literally root on every single host? So, we started digging into it a little bit and thinking about it. And having had our conversation about the Kiali thing before, we're like, okay, let's pick this apart and see how it's authenticating because we started noticing that we weren't seeing secrets in the cluster, which, you know, that was the same hint that we had for Kiali that Kiali was up to no good. So, we're digging around and we're not seeing anything that's storing the persistent data to, you know, how would these pods authenticate each other? And, like, if it worked with MTLS, we could kind of pretend that it was doing a good job because Istio can kind of fill that gap, but we couldn't get it to work with Istio because of this weird network behavior. So, we're digging around, and sure enough, we found that they actually weren't authenticating each other. It's just a GRPC that's listening on a standard port that's not declared and away it goes. Okay. So, GRPC, for those who may not be aware, is a remote procedure protocol from Google. It runs on top of HTTP2. It uses protocol buffers to encode data. I love it. It's a very cool protocol. You should absolutely be using GRPC, like, truthfully. One of the nice things about it is you don't have to write the server and client bits yourself. You write a protocol or a protocol that defines this is what my API looks like. If you're familiar with Swagger, it's a little bit like that. But then in addition, GRPC has plugins for all sorts of languages. So, you can run that plugin in your compiler and point it at your protocol and you actually get the server or the client. With the server, it expects you to have something that implements an actual interface that does the thing, but it gives you all the connective bits in between and it's really nice. It's particularly nice if you're an endpoint developer and you want to support people that are writing in different languages because you could write and go, somebody else could write in Java. I don't know why they'd write in Java, but they could write in Java, and then they could just run the plugin and they get a Java client for your API. It's also really nice because it's easy to read. So, I was really excited when I looked at Longhorn's repo and just saw these protocols in there. I was like, oh, I can read that. That's simple. So, I started pulling it apart and I saw this service that was called Create Process. And I thought, well, I hope that the Longhorn developers have a different meaning of process than what I have. So, let me look at the parameters that get passed to this service. And there was fun little bits in there, like binary and args. And I thought, surely this is not an API that allows anybody inside the cluster because remember, cluster's networking perimeter is the cluster. It's not at the namespace. So, no ability to add a network policy, no ability to use Istio to do MTLS enforcements, no authentication. This can't be the case. They must be doing authentication somehow. Now, Longhorn Manager does generate the pods itself and push them out there so it could be generating something as an environment variable, which wouldn't be the most secure thing, but it'd be okay-ish. No. No. It wasn't authenticated at all. It took me... I work on the West Coast and Will works on the East Coast, so I have to wake up at 5 a.m. and start work. So, it was about 5.05 a.m. and I was looking at this and I'm awake now and I reached out to Will and we said, well, let's do a POC. Like, this can't be a thing. So, we started looking at it a little bit and I said, well, what can we do with this access? I mean, it's Sandbox. It's a container. Well, we'll go back to what Will was talking about, about the file systems from the host that were being mounted. So, there was two. Proc and Dev. Not the best two. And Will said, you know, in Proc, PID 1 root, that will always be the host's root file system. So, I wonder if we could just say something that's just going to touch something in host Proc 1 root. Let's get fun, Etsy, whatever, right? And so, because this was written in with GRPC, it took me about 25 minutes to slap together a real quick POC and go and run this thing and we're, you know, Will's sitting there, look at his SSH into the node and he's like, okay, you know, I just did an LS on Etsy, go, I go, I hit go, he refreshes, and there's a file that says, this should not exist. Owned by root. So, we took that a little bit further. We developed an exploit for it. It's called Rustler. It is available on GitHub. It basically allows you to point Rustler at a target that's running Longhorn and just say, do this for me, please, and it does every time. It's very reliable. Now, to Longhorn's credit, again, all the developers we worked with on this have been really amazing. We reached out to them. They pretty much immediately understood the problem and they worked to fix it. But before they did that, let's take a look at what we were able to do. Okay, so I'm back on my reverse proxy from the previous demo. I need to find Longhorn. I need to find something. So, I'm going to temporarily broadcast with NetMask. Ignore that. And I'm going to run a quick end map across the subnet that I'm working on, looking for anything listening on 8500, which is what instance manager listens on. It's not a big subnet, so it doesn't take long. There's two. I'll grab one. Remember, it's running Ubuntu as the base image. So, I have access to all of Ubuntu 20.04 that I can run commands against. So, I'm going to start up listening again, and I'm just going to do a really basic one-liner bash reverse shell. Who am I? I'm Root. So, going into the proc directory, if I change Root to host proc one root, now I'm Root on the host.  So, basically at this point, I can do whatever I want with your cluster. If this isn't enough fun for you, Longhorn has essentially two different modes that it's running in. There's everything, and then there's Longhorn Manager, which Will was talking about before, which is creating a lot of pods. It's doing a lot of things. So, it has very permissive RBAC rules. Like, it's allowed to do a lot of things. For some reason, it's allowed to do those in any namespace it wants. It's not isolated to the Longhorn system namespace. I don't know why that's the case. It doesn't seem to be necessary at all, but it is the case. Also, at least previously, even though there was two very different security modes of I need to do a lot of things and I basically need to do nothing, there's one service account. And that service account is shared across all of the pods. So, at this point, running an instance manager, I am able to run inside that pod, cube control and create pods. I can do fun things like read any secret that's in the cluster anywhere, create, read, update, delete on almost every type of resource. Even if I didn't have that, Fleet still got my back because Fleet's permissions are API versions, all of them. Resources, all of them. Verbs, all of them. So, anything that I want, I can do. Yeah. So, basically, once you have that little foothold in the cluster that we've gotten, and really, this is just a one way to do it, but a lot of people don't think about, they think about the containers as a security mechanism, and they assume that once your application is in a container, that's going to hold back an attacker, but realistically, because namespaces are not a security boundary and there's really nothing that's a firewall in this, Kubernetes makes service discovery really easy, which is why we were able to find Longhorn pods so quickly and there's nothing holding us back from talking to them. So, it's one of those things that when you're deploying a cluster, you need to be thinking about where are the actual security barriers and where are their kind of like shadows or of like insert security barrier here, right? Like you can write. Somebody's got this for me, right? Yeah, someday someone's going to insert into the security policy that blocks this, but building out your cluster, you really need to think about that. Basically, once we're on the host, there's very little that we can't do on that host as far as getting back to the master nodes or the control plane stuff, and we don't really need to do anything on the control plane because we can launch literally any pod we want, including more incredibly vulnerable pods that mounts very dangerous directories into them. So, there's really nothing we can't do in the cluster at that point. And if there are good pod security policies in place that prevent us from doing that, it's okay. We can deploy our own pod security policies that correct that for us. All right, so some big takeaways. One thing that we do really want to emphasize is Kubernetes itself is pretty damn great. The Kubernetes developers are absolutely amazing. There's a ton of them, and they're some of the most brilliant developers that I've ever had the pleasure of working with. But not everything in the Kubernetes ecosystem is written by those Kubernetes developers. And a lot of times, to be really fair, these projects, they start off as one developer's idea, and that turns into a proof of concept, and then someone goes, cool, ship it, it's mission critical, let's go. And we don't necessarily rewind and sort of rethink, is it secure? Is it what we need it to be? I mean, you have some bullet points.  One of the advantages of Kubernetes being the ultimate shift left capability is that developers get to work on deployments, but there's also people that have been working in system administration and building all of this cluster stuff out. A lot of lessons learned about how to have least privilege and the developers aren't necessarily thinking about that. So a lot of what times what happens is you'll see a perfectly good project was actually implemented pretty well on the coding part. Then when you go to deploy it with the Helm chart, like Bitnami has a lot of this, none of the defaults are anywhere near secure, and it's difficult to secure it because of the way things are written. So just because you have a really secure project like your MySQL, your Postgres, it's up to date, doesn't mean that the deployment of that system can't shoot you in the foot. So not that there's any attackers in the audience today, but if there were, what do you do? You got your hands on a Kubernetes cluster. Maybe you found an insecure application that lets you get just a toe in. How do you pivot? Understand some of the common mistakes that people make. What are the assumptions that are just, frankly, inaccurate in a Kubernetes environment? So again, going back to service discovery, there is unfortunately commonly a presumption that name spaces are network segmentation. They're not. So look for people that just have completely insecure APIs and don't be surprised if you find it. Secrets should exist somewhere. Somehow information needs to be shared across these different applications that need to be able to communicate with each other. If that doesn't exist, ask yourself, how is this being secured? Because it might not be. Additionally, GitOps is super fun to play with. If you can get access to a GitOps repo, you own not one cluster, but lots and lots of clusters in all likelihood. So watch for that. And then finally, for me at least, don't forget to check the logs. I go back to it. Some developers whispers, other developers definitely are shouting. I think one of the things that I want to wrap up on here is that Kubernetes is pretty damn great and it has all this great stuff in there. But a lot of the bad behaviors that people do on their local development machines just has a tendency to get embedded into the deployment systems and then end up through GitOps into the cluster. So in no world does GitOps, I used to joke a lot with people that like, SecDevOps is really just that we took the developers and fired all the ops team. There's a lot of lessons learned from traditional ops that can be applied to, through DevOps type stuff, to the deployment of applications on Kubernetes. And we can't let the devs just take over the whole process because we forgot to hire an ops team. Okay, so before we go to questions, again, I mentioned that the full demo environment is automated and available. The slides are available too, by the way. Any of the main tracks, if you go to media.devcon.org, you can get all these materials, the recording, all that's there. But feel free to go there to github.com slash dagan slash devcon 30. I promise to really actually try to support folks for at least the next couple of weeks. So if you have problems working through any of this, open an issue. It's pretty easy for folks to do. Also, today we talked a lot about what can go wrong in Kubernetes. And if you're interested in knowing how to protect your clusters from that, we're going to be doing a similar talk, but in, like, the defense side at QCon, CloudNativeCon in Detroit in October. So feel free to meet up with us there. With that being said, we have, I think, just under 10 minutes or so left. So if anybody has any questions, there's a goon back there with the microphone. We'll do our best to answer them for you. Thank you. Anybody with questions? I guess we covered it all. All right, well, we'll be hanging around for a little bit and then headed out that door. So if anybody wants to ask us anything directly, again, thank you all for your time. Thanks for coming out.