Real Time Security - eBPF for Preventing attacks
summary
eBPF already enforces network policy via Cilium uses eBPF to enforce NetworkPolicy and seccomp-bpf limits syscalls, while Falco currently only alerts. The talk demos a kernel-level bypass called Phantom attacks that defeats syscall-entry hooks and shows using BPF LSM (or other long-lived kernel hooks) to inspect kernel-copied parameters. A new open source tool Tetragon kills in-kernel loads eBPF policies that can detect file/network/privilege abuse and synchronously SIGKILL a process (demo: intercepted and prevented a password-file write).
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:52Overview
- 2:15Types of activity
- 4:31LD Preload
- 6:39K Probe
- 10:35Linux Security Modules
- 12:36eBPF Program
- 14:46Tetragon
- 17:33Tetragoniska
- 18:20Context
- 19:04Prevention
- 20:35Demo
- 26:44On the stand
- 28:21Security observability
- 29:11Questions
related talks
36meBPF for Runtime Security
33meBPF for Security
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
40mExploring Runtime Security and Forensic using eBPF
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
42mResolving Performance and Security Issues with eBPF
33mYou and Your Security Profiles; Generating Security Policies with the Help of eBPF
14mWill eBPF Save Us From the Next Global Outage?