2 ms·
Maybe you could do this with HTTPS if you’re using Kernel TLS offloading?
by chatmasta 2y ago
Maybe you could do this with HTTPS if you’re using Kernel TLS offloading?
- tptacek 2y agoYou can instrument userland binaries with eBPF, so as long as you have probes built for the TLS library your target is using, you're fine.
- Arnavion 2y agoYes, if the server uses kTLS, it'll be easy for such a probe to get the plaintext, because the syscalls themselves will contain the plaintext. It won't have to do TLS library-specific shenanigans to hook userspace functions or extract the key material like this submission does.