eBPF, I Thought We Were Friends!
Security researchers demonstrate offensive and defensive eBPF capabilities, manipulating kernel tracing data to conceal attacks and building resilient detectors.
Summary
The Dual Nature of eBPF in Modern Linux
Extended Berkeley Packet Filter (eBPF) has transformed Linux observability, monitoring, and security tooling by allowing sandboxed programs to run inside the kernel.
Manipulating Kernel Telemetry from Offensive eBPF
Guillaume Fournier, Sylvain Afchain, and Sylvain Baubeau illustrate how attackers can load malicious eBPF programs to overwrite function return values, manipulate socket buffers, and blind monitoring agents.
Building Resilient eBPF Security Monitors
To counter offensive abuse, the authors demonstrate designing tamper-resistant eBPF security frameworks that verify probe integrity and detect runtime code modifications.
Open-Source Detection Tooling Release
The authors release open-source eBPF monitoring tools to help incident responders detect unauthorized eBPF attachments in production Linux environments.
Related talks
Main Stage·43 min
PatH
PatH demonstrates utilizing extended Berkeley Packet Filters (eBPF) to create kernel rootkits without writing kernel modules, presenting defensive detection mechanisms.
botconf eu·34 min
David Álvarez Pérez
David Álvarez Pérez analyzes Syslogk Linux Kernel Rootkit - Executing Bots via “Magic Packets”.
RSA Conference (RSAC)·51 min
Examines eBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee and evaluates key implications for security practitioners.