6 ms·
Don't disagree, but there are eBPF mitigations that work as alternatives to unloading kernel modules.
by atgreen 5mo ago
Don't disagree, but there are eBPF mitigations that work as alternatives to unloading kernel modules.
- cassianoleal 5mo agoCan you elaborate on that?
- atgreen 5mo agoHave a look at https://github.com/atgreen/rhel-block-copyfail https://github.com/atgreen/rhel-block-copyfail
- cassianoleal 5mo agoThanks! From the sound of it, the same mitigations for Copy Fail 1 are also effective here.
- atgreen 5mo agoNo, they are different. I just bundled them together for convenience in this POC. The only real thing in common is that they both use eBPF.
- cassianoleal 5mo agoGot it, thanks!
- JeremyNT 5mo agoI was aware of commercial antivirus vendors (Crowdstrike) doing something like this, but this is the first I've seen it published by somebody in the open! Have you considered writing up a blog post and submitting this to HN?