News for hackers. Stuff that matters.

A comment on eBPF for Cybersecurity – Part 1.

Re:eBPF for Cybersecurity – Part 1 by drtgh on Sunday June 04, 2023 @08:51PM (#36191035)
bypass eBPF, just the first search,

https://www.form3.tech/engineering/content/bypassing-ebpf-to...

"Executing the program in the demo pod allows us to confirm that the system call is not detected"

https://news.ycombinator.com/item?id=33235434

[ Parent | on HN ]
Re:eBPF for Cybersecurity – Part 1 by tptacek on Sunday June 04, 2023 @09:54PM (#36191389)
This isn't a bypass of "eBPF", so much as it is a bypass of a detection system that watches only the write(2) system call, and not writev(2), sendfile(2), or io_uring.
[ Parent | on HN ]
Re:eBPF for Cybersecurity – Part 1 by drtgh on Monday June 05, 2023 @02:33PM (#36200893)
eBPF, I thought we were friends! https://www.youtube.com/watch?v=5zixNDolLrg

eBPF, A new frontier for malware https://redcanary.com/blog/ebpf-malware/

How Hackers Use eBPF https://cymulate.com/blog/ebpf_hacking/

Linux eBPF Stack Trace Hack https://www.brendangregg.com/blog/2016-01-18/ebpf-stack-trac...

[ Parent | on HN ]