3 ms·

My ignorance, I had no idea eBPF tracing would make grabbing people's passwords so easy .. that's quite scary to me. I thought it was mostly good for telemetry

My ignorance, I had no idea eBPF tracing would make grabbing people's passwords so easy .. that's quite scary to me. I thought it was mostly good for telemetry and deep kernel metrics, but this seems like a serious security flaw to me. Anyone know of any tools to check for abuse?

AntiRush 4y ago
Unless you enable unprivileged eBPF, root is required to load a module. If a user has root there are plenty of ways to get passwords.
- frellus 4y ago
  Understood, and agreed once you have root access you can get passwords but I've not seen many that are this easy, and I'm now thinking there's something I need to understand about how to detect if certain traces are happening so I can detect a potential breach. Also seems prudent to get rid of passwords and move to Kerberos and SSH keys + 2FA. Anything else I'm missing?
  - MPSimmons 4y ago
    > Also seems prudent to get rid of passwords and move to Kerberos and SSH keys + 2FA. Anything else I'm missing? This is a good path to go down anyway, despite the fact that Kerberos, for instance, is totally susceptible to 'pass the hash'[1] type attacks. Concentrate on things like Yubikey-based authentication. You can do SAML/OIDC2/mTLS and SSH with Yubikeys. Eliminate passwords. [1] - https://www.beyondtrust.com/resources/glossary/pass-the-hash-pth-attack https://www.beyondtrust.com/resources/glossary/pass-the-hash...
  - mindwok 4y ago
    Looking for specific traces like this is a difficult (but still worthwhile) way of detecting a breach, as there’s potentially infinite things a root user could do once they have that level of access. Another approach is focusing on detecting the privilege escalation in the first place. You can use normal auth logs in Linux alongside things like auditd, or more complicated EDR tools that look for suspicious system calls etc to identify root logins that are suspicious, or when a process might have been exploited and elevated to root. Make sure you’re shipping your logs somewhere remotely so they are protected from tampering.
  - withinboredom 4y ago
    If you use GitHub, you have your public keys available: https://GitHub.com/withinboredom.keys https://GitHub.com/withinboredom.keys. Replace my username with yours or whoever. There’s an option in sshd to run a program that should output the contents of an authorized keys file: AuthorizedKeysCommand So you write a simple bash script or program to output authorized keys based on your own rules. If you want stronger auth, check out libnss-ato which can allow you to masquerade as root if the user is authorized. (In your authorized key script, check if the user is in your org and/or part of a certain team, if so, output their public keys, otherwise, output nothing). I really should open source my code, but it’s literally only 5-6 lines of code, and 3 lines of configuration.

AntiRush 4y ago

Unless you enable unprivileged eBPF, root is required to load a module. If a user has root there are plenty of ways to get passwords.

frellus 4y ago
Understood, and agreed once you have root access you can get passwords but I've not seen many that are this easy, and I'm now thinking there's something I need to understand about how to detect if certain traces are happening so I can detect a potential breach. Also seems prudent to get rid of passwords and move to Kerberos and SSH keys + 2FA. Anything else I'm missing?
- MPSimmons 4y ago
  > Also seems prudent to get rid of passwords and move to Kerberos and SSH keys + 2FA. Anything else I'm missing? This is a good path to go down anyway, despite the fact that Kerberos, for instance, is totally susceptible to 'pass the hash'[1] type attacks. Concentrate on things like Yubikey-based authentication. You can do SAML/OIDC2/mTLS and SSH with Yubikeys. Eliminate passwords. [1] - https://www.beyondtrust.com/resources/glossary/pass-the-hash-pth-attack https://www.beyondtrust.com/resources/glossary/pass-the-hash...
- mindwok 4y ago
  Looking for specific traces like this is a difficult (but still worthwhile) way of detecting a breach, as there’s potentially infinite things a root user could do once they have that level of access. Another approach is focusing on detecting the privilege escalation in the first place. You can use normal auth logs in Linux alongside things like auditd, or more complicated EDR tools that look for suspicious system calls etc to identify root logins that are suspicious, or when a process might have been exploited and elevated to root. Make sure you’re shipping your logs somewhere remotely so they are protected from tampering.
- withinboredom 4y ago
  If you use GitHub, you have your public keys available: https://GitHub.com/withinboredom.keys https://GitHub.com/withinboredom.keys. Replace my username with yours or whoever. There’s an option in sshd to run a program that should output the contents of an authorized keys file: AuthorizedKeysCommand So you write a simple bash script or program to output authorized keys based on your own rules. If you want stronger auth, check out libnss-ato which can allow you to masquerade as root if the user is authorized. (In your authorized key script, check if the user is in your org and/or part of a certain team, if so, output their public keys, otherwise, output nothing). I really should open source my code, but it’s literally only 5-6 lines of code, and 3 lines of configuration.