Analyzing volatile memory on a Google Kubernetes Engine node
Marcus Hallberg
BSides NYC 2023 (0x04) · Day 1 · Talk - Blue
In this insightful talk at BSides NYC, Marcus Hallberg, a Detection Engineer at Spotify, unveiled a novel approach to conducting volatile memory analysis on Google Kubernetes Engine (GKE) nodes. The presentation addressed a critical gap in cloud-native forensics: gaining deep visibility into the runtime state of containerized applications and the underlying host when traditional logging mechanisms fall short or direct host access is restricted. Hallberg demonstrated how a combination of open-source tools—**avml**, **dwarf2json**, and **Volatility 3**—can be leveraged to capture and analyze memory snapshots from GKE nodes running Container Optimized OS (COS).
AI review
Hallberg brings a concrete, reproducible open-source methodology for volatile memory forensics on GKE COS nodes — a genuinely underserved problem space. The undocumented-but-public Google API for fetching the VM Linux binary is the kind of specific, hard-won discovery that separates real research from blog-post padding.