3 ms·
Evil eBPF programs can hide their presence from the bpf syscall as well.
by ronsor 10mo ago
Evil eBPF programs can hide their presence from the bpf syscall as well.
- ignoramous 10mo agoInteresting. Any good read you'd recommend on the topic/attack? Thanks.
- ronsor 10mo agoLook up "eBPF rootkits" This is a good article about one found in the wild: https://www.synacktiv.com/en/publications/linkpro-ebpf-rootkit-analysis https://www.synacktiv.com/en/publications/linkpro-ebpf-rootk...