4 ms·
> "Well if someone ... then its game over". They are not entirely wrong They're not at all wrong, and your argument has no merit. As a defender, I'd pray that
by armitron 4y ago
> "Well if someone ... then its game over". They are not entirely wrong
They're not at all wrong, and your argument has no merit. As a defender, I'd pray that attackers use toolkits like the ones you linked that are essentialy utter trash and trivially detected (as is anything ebpf-based).
Good kernel/userspace rootkits do not use ebpf and can be very very hard to detect.
- NavinF 4y agoYep, dunno why you've been downvoted. Kernel rootkits are just normal dkms kernel modules. Why would the attacker use these new eBPF rootkits when the old open source ones are far more sophisticated and need similar privileges?