Warping Reality: Creating and Countering Next-Gen Linux Rootkits
PatH demonstrates utilizing extended Berkeley Packet Filters (eBPF) to create kernel rootkits without writing kernel modules, presenting defensive detection mechanisms.
Summary
The Risks and Evolution of Kernel-Level Rootkits
Traditional Loadable Kernel Module (LKM) rootkits provide complete system control but risk crashing the operating system when kernel versions or memory offsets change.
Repurposing eBPF for Stealthy In-Kernel Persistence
PatH explores how extended Berkeley Packet Filters (eBPF)—designed for high-performance tracing and observability—can be subverted to manipulate kernel memory and hook system calls safely.
Manipulating Process State and Concealing Activity
Weaponized eBPF programs can dynamically alter file read operations, conceal processes from `ps` and `top`, and redirect network socket traffic without modifying kernel code sections.
Detecting and Countering Offensive eBPF Deployments
The author provides incident responders with auditing tools and kernel integrity verification frameworks to detect unauthorized eBPF program attachments.
Related talks
Main Stage·49 min
Guillaume Fournier · Sylvain Afchain · Sylvain Baubeau
Security researchers demonstrate offensive and defensive eBPF capabilities, manipulating kernel tracing data to conceal attacks and building resilient detectors.
botconf eu·34 min
David Álvarez Pérez
David Álvarez Pérez analyzes Syslogk Linux Kernel Rootkit - Executing Bots via “Magic Packets”.
RSA Conference (RSAC)·51 min
Examines eBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee and evaluates key implications for security practitioners.