Listen to your Engine
summary
Demonstrates that system call streams yield high‑fidelity indicators of compromise: running a vulnerable Apache Struts in Docker, attaching strace/ptrace, and firing a Metasploit reverse‑shell produces ~60,000 syscalls in 30s but the exploit reduces to four useful events (chmod, exec, connect, open) and a dropped payload that lives 0.01s. Shows practical collection via kprobes and tracepoints and in‑kernel filtering with eBPF via BCC tools, notes noise, kernel‑version limits, and container ID tracking as the main hurdles.
AI-written summary · about
chapters (17)
- 0:00Introduction and background
- 1:08System calls primer
- 3:18Profiling vs tracing
- 4:42Security monitoring basics
- 5:45Why monitor system calls
- 7:07Live demo setup
- 9:11Analyzing system call data
- 10:59Key attack indicators
- 12:24Limitations of system call monitoring
- 13:50Data collection methods
- 16:39Kprobes vs tracepoints
- 17:42Ftrace and perf overview
- 18:45Extended BPF introduction
- 21:35BPF tools and trade-offs
- 22:41Containerization challenges
- 24:04Summary and resources
- 24:26Q&A session
related talks
45mThe Container Escape Room: An Exploration of Container Escapes
39mInsecure Containers? Continuous Defense Against Open Source Exploits
26mContainers: Your Ally in Improving Security
34mHow Clusters Fail Under Attack and How We Detect It at Runtime with eBPF signals
36mObservability and performance analysis with BPF
45mTrace to Triage: How to Connect Product Vulnerabilities to Security Paths
32mContainer Escape Paths Nobody Monitors: Abusing Linux Debug Interfaces
31mFantastic tracepoints and where to find them