3 ms·
The idea is quite interesting, but it would be more useful if we could perform an action when a threat is detected. For example, in the network module, we can u
by JacobiX 3y ago
The idea is quite interesting, but it would be more useful if we could perform an action when a threat is detected. For example, in the network module, we can use the eBPF-provided actions: drop, forward, or log.
- giovannialb 3y agoTrue! Would be a very interesting addition to the project
- tptacek 3y agoSomeone remarked upthread about Artem's very excellent Trail post, which you can sum up as "attackers can create conditions where eBPF events might not be generated, or where eBPF probes won't be able to see the requisite data". In a pure logging monitoring situation, those problems aren't that big of a deal (the things you'd have to do to force those conditions will be noisier than the events you'd be trying to generate, and, more importantly, the things you'd do instead of eBPF to do that kind of monitoring have their own gruesome limitations). But as soon as you add a "drop" response to events, you've switched from a monitoring tool to a reference monitor; at that point, this stuff has to work.
- elesiuta 3y agoYep, and from my experience too (made a tool that monitors network traffic with eBPF [1]) in addition to those issues there is also a sizable latency hit. [1] https://github.com/elesiuta/picosnitch https://github.com/elesiuta/picosnitch
- insanitybit 3y agoUsually any policy you'd be able to implement as a reaction can just be implemented as a pre-emptive policy to prevent the action.