8 ms·
Am I reading this wrong, or is it a variant of "If you have kernel access you can mess with userland"?
by red_admiral 2y ago
Am I reading this wrong, or is it a variant of "If you have kernel access you can mess with userland"?
- fulafel 2y agoDo you mean having malware code already running in kernel space, or having system permissions to install new kernels? For the latter case, there are now mechanisms that aim to prevent root from modifying the kernel or otherwise getting ring 0 access, see eg https://www.man7.org/linux/man-pages/man7/kernel_lockdown.7.html https://www.man7.org/linux/man-pages/man7/kernel_lockdown.7.... But even in a non locked down mode, there are practical advantages for the adversary in using officially supported interfaces vs their own kernel module or leveraging some i/o path to access kernel memory.
- cwillu 2y agoNo, you're reading it right.
- tanelpoder 2y agoI guess one point of the article is that eBPF-injected programs are another place where malware can hide. But then again, it's easy to list all currently loaded eBPF programs (well, unless there's a way to somehow hide/disconnect them, but keep them running).
- psd1 2y agoIIUC TFA, you could hook the syscall that shows all eBPF programs
- s4mw1se 2y agonot a ebpf expert, just been on my radar lately because i’m going through a sysdig poc. To me It feels more like a reverse proxy for intercepting traffic going between user land and kernel space. As we move to k8s and classic EDR isn’t feasible i 100% understand the need. It still feels like a dumb thing humanity has done and will blow up in our face after having the kernel / user space security boundary beat into our heads for so long.