The Next Log4jshell?! Preparing for CVEs with eBPF!
summary
Claims that eBPF plus an open source agent can detect and block a Log4j-style exploit in real time, using Tetragon to hook syscalls and kernel probes. Demo builds a vulnerable Java web app, a malicious LDAP→exploit.class server and a netcat reverse shell; Tetragon logs JSON events (process exec, file IO, TCP connect/close) and shows the reverse shell while exporting to SIEM. Preventive steps include DNS-based egress policies and captured TCP connect and exec events to create signatures and deny unexpected egress.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 0:43What is Log4j
- 3:15How Log4j enables remote code execution
- 5:24Log4j impact
- 6:25CVE detection challenges
- 7:06eBPF real-time visibility
- 10:35eBPF vs kernel changes
- 13:02eBPF attachment points
- 14:25eBPF user space comms
- 15:30eBPF dev/deploy advantages
- 16:11eBPF networking & observability
- 17:58eBPF container security
- 18:39Tetragon intro
- 21:29Detecting Log4j with Tetragon
- 23:21Demo setup
- 26:54Running the vulnerable web application
- 27:57Malicious LDAP server
- 28:40Log4j exploit execution
- 31:53Tetragon detection events
- 34:23Post-exploit detection
- 36:31Prevention with Tetragon
- 37:20Exporting to security systems
- 38:03Splunk detection signatures
- 39:28Blocking LDAP connections
- 40:54eBPF & Tetragon recap
- 41:56Contributing to Tetragon
- 42:27Q&A
related talks
51mLog4Shell Armageddon or Opportunity
33mLog4J, SpringShell and all that Jazz (or why bad things can happen to good software)
02h 38mJava application security the hard way - a workshop for the serious developer
51mDouble plus Ungood Why Log4Shell Is So Bad
46mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
46mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
17mLog4j - A Placement Student's Baptism by Fire
28mVanquishing Vulnerabilities in Valencia