How Clusters Fail Under Attack and How We Detect It at Runtime with eBPF signals
summary
Shows a practical runtime stack: eBPF programs (tracepoints, kprobes, LSM hooks) run in-kernel with low overhead (<1%) and map syscalls back to pod and container metadata, surviving a compromised container root. Demonstrations catch real behaviors: reverse shell detected by exec + outbound connect, privilege escalation via setuid/capset calls, and unexpected process execs that image scanners miss. Open source tools like Falco and Tetragon run in detect mode on kernels 5.7+ (LSM/BTF required), produce noisy but actionable signals for investigation and possible later enforcement.
AI-written summary · about
chapters (8)
- 0:00Introduction and motivation
- 3:03Real-world attack example
- 8:04Runtime security gap
- 15:15What is eBPF
- 23:54Detecting attacks with eBPF
- 30:47Runtime detection benefits
- 32:38Live detection demo
- 33:21Q&A and closing
related talks
40mExploring Runtime Security and Forensic using eBPF
32mReal Time Security - eBPF for Preventing attacks
32mContainer Escape Paths Nobody Monitors: Abusing Linux Debug Interfaces
36meBPF for Runtime Security
30mObservability in Kubernetes: Unlocking the Power of eBPF
45mThe Container Escape Room: An Exploration of Container Escapes
29mRuntime Security at Scale With EBPF: Hybrid Detection and Root Cause…
20mUncovering a Sophisticated Kubernetes Attack in Real-Time