Coping with Zero Days with Cilium Tetragon
summary
Demo shows Cilium Tetragon using eBPF to detect and forensically log use of liblzma versions 5.6.0 and 5.6.1 tied to the XZ utils backdoor, emitting rich JSON with pod, container and process ancestry, and optionally killing the offending process synchronously to stop remote code execution. Policies run in-kernel to filter events so only matching activity reaches user space, keeping overhead low (benchmarks ~1–2%). Deploys as a privileged daemonset on each node.
AI-written summary · about
chapters (13)
- 0:00Introduction and background
- 1:02Cilium and Tetragon overview
- 3:11eBPF fundamentals for security
- 4:35Tetragon demo setup
- 6:17Default Tetragon event monitoring
- 8:46File access monitoring policy
- 12:00Zero-day vulnerabilities explained
- 15:11XZ utils backdoor demo
- 18:05Blocking malicious library use
- 23:30Runtime exploit detection benefits
- 25:15Performance and kernel filtering
- 28:10Kubernetes and forensic data
- 31:01Q&A session begins
related talks
44mCoping with Zero Days with Cilium Tetragon- 44mCoping with Zero Days with Cilium Tetragon
33mDetecting Compromised CI With eBPF and Cilium Tetragon
01h 12mTutorial: Sailing the Security Seas with Tetragon
33meBPF for Security
32mReal Time Security - eBPF for Preventing attacks
44mCilium - Container Security and Networking Using BPF and XDP
22mOne Project, Different Angles: How to Secure and Observe with Cilium