eBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee
summary
eBPF-based detection demonstrates concrete, reproducible methods: install a kprobe on do_init_module to catch fileless finit_module/init_module loads and capture bytecode buffers for forensics; periodically compare the three kernel module lists to emit a hidden_kernel_module event; flag syscall table hooks by checking syscall pointers against s_text/e_text; extract used helpers (bpf_probe_write_user, override_return, skb_ , send_signal) from verifier logs to spot eBPF tampering; rules and artifact capture are implemented in Tracee*, with claimed single-digit CPU overhead and behavioral signatures for HiddenWasp, Diamorphine, Drovorub and Reptile.
AI-written summary · about
chapters (25)
- 0:00Introduction to Rootkits
- 1:25Linux server playground
- 3:15Tracing methods criteria
- 5:08eBPF architecture explained
- 6:50Tracee open source tool
- 7:55What is a Rootkit
- 10:51HiddenWasp Rootkit demo
- 12:35Kernel module Rootkits overview
- 14:00Loading kernel modules
- 15:27Diamorphine Rootkit demo
- 16:54Hiding kernel modules
- 18:46Hook placement techniques
- 22:37File operation hooking
- 24:49Drovorub Rootkit analysis
- 26:56Communication channels
- 27:41Command execution methods
- 29:08Reptile Rootkit example
- 31:18eBPF Rootkits emergence
- 32:21Loading eBPF Rootkits
- 34:06Probe placement in eBPF
- 38:27Hiding eBPF programs
- 39:30Communication and payloads
- 40:36Threat protection methods
- 42:25Community and research
- 43:09Q&A session
related talks
40mExploring Runtime Security and Forensic using eBPF
38mLinux Kernel Tracing Using eBPF
42mKernel Analysis Using eBPF
40mThreat From The Inside: Investigate eBPF Malware
25mKernel tracing with BPF
42mResolving Performance and Security Issues with eBPF
36meBPF for Runtime Security
20mThink eBPF for Kernel Security Monitoring