As a wise Chinese man said: good malware uses BPF
summary
The talk covers how attackers tied to China have been using BPF/eBPF to hide backdoors on Linux servers in telecom companies (e.g., in Turkey and Hong Kong). It explains analysis of multiple malware samples, categorization based on the classic BPF code they inject into the kernel, and warns that the backdoor remains active and the technique has spread to other malware, including in Brazil.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 3:12What is BPF and its origin
- 13:28Discovery of BPFDoor
- 17:08BPFDoor operation
- 22:08Static analysis of BPF code
- 26:45Detection and impact of BPFDoor
- 33:25BPFDoor evolution and variants
- 39:05BPFDoor in Brazil and victims
- 41:57Other malware: SimbIo
- 42:19Classic BPF vs eBPF
- 48:18BPF analysis tools
- 50:08Detecting BPF in Linux
- 51:31Summary and thanks
- 52:15Q&A
related talks
40mThreat From The Inside: Investigate eBPF Malware
40mExploring Runtime Security and Forensic using eBPF
32mReal Time Security - eBPF for Preventing attacks
14mWill eBPF Save Us From the Next Global Outage?
42mResolving Performance and Security Issues with eBPF
51meBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee
57mBPF and Security. Friends and Foes
20mThink eBPF for Kernel Security Monitoring