Trace Me If You Can: Bypassing Linux Syscall Tracing
Rex Guo and Junyuan Zeng present novel techniques that allow unprivileged user-mode Linux processes to execute hidden system calls, bypassing ptrace and auditd.
Summary
The Reliance on System Call Tracing in Linux Security
Linux security monitors, sandboxes, and behavioral audit frameworks (ptrace, seccomp, auditd) rely on intercepting system calls to validate process behavior.
Uncovering Architecture and Signal Handling Flaws
Rex Guo and Junyuan Zeng analyze x86/x64 syscall entry points, vDSO mechanisms, and asynchronous signal handling inside the Linux kernel.
Executing Covert Syscalls Without Triggering Trace Hooks
The authors demonstrate reliable techniques where an unprivileged program executes arbitrary system calls while blinding audit hooks and trace monitors.
Kernel Hardening and Robust Syscall Interception
The presentation reviews proposed kernel patches and alternative tracing architectures (eBPF probes, LSM hooks) to ensure tamper-proof telemetry.
Related talks
Main Stage·43 min
PatH
PatH demonstrates utilizing extended Berkeley Packet Filters (eBPF) to create kernel rootkits without writing kernel modules, presenting defensive detection mechanisms.
Main Stage·49 min
Guillaume Fournier · Sylvain Afchain · Sylvain Baubeau
Security researchers demonstrate offensive and defensive eBPF capabilities, manipulating kernel tracing data to conceal attacks and building resilient detectors.
Briefings·28 min
Lukas Maar · Lukas Giner
Presents a novel timing side-channel attack on the TLB, combined with kernel allocator massaging, to derandomize the location of security-critical kernel objects in the latest Linux kernel.