Checking your cryptography usage with eBPF
summary
Uses eBPF with a small C program embedded in Python to attach probes (uprobes or USDT probes) to crypto libs and increment a kernel hash map keyed by cipher IDs, so no program modification or stopping is needed. Runs a collector that prints counts; an overnight run shows less than half of connections use TLS 1.3, ~25% use 256‑bit ciphers and most use 128‑bit, and uncovers unexpected OpenSSL client activity. Works reliably and is safer than systemtap.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:54How do we learn
- 2:37What is eBPF
- 3:31Why use eBPF
- 4:23What to monitor
- 4:48Probes
- 7:08USDT Programs
- 8:04Packages
- 8:41Gathering data
- 9:08Custom C programs
- 9:27eBPF code
- 10:17Load eBPF into kernel
- 11:11Use cipher use
- 11:35NSS library
- 18:47Future of eBPF
related talks
29mAre Our Systems Using up-to-Date Cryptography?
25mAre our systems using up to date cryptography
33mTracing SSL/TLS Encrypted Microservices with eBPF
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
20mThink eBPF for Kernel Security Monitoring
38mLinux Kernel Tracing Using eBPF
51meBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee
42mKernel Analysis Using eBPF