Bypass Falco
Talkat KubeCon + CloudNativeCon North America 2020 Virtual · on Friday, 2020-11-20· at 15:10· Intrado Virtual Event Platform,·
summary
Demonstrates concrete bypasses against Falco: an execveat syscall undetected demo shows a process spawning a shell without triggering rules, an apk symlink bypass lets Alpine package installs evade package-manager rules, and tampering with output.lua disables alerts so detections never reach operators. Explains Falco drivers (kernel module, eBPF, ptrace), gaps like missing copy_file_range and the added renameat2 support (PR 1654), and offers fixes: add syscall coverage, embed output handling in the binary, and apply defense‑in‑depth.
AI-written summary · about
chapters (10)
- 0:00Introduction to falco
- 1:13Security philosophy
- 3:53Software improvement
- 6:47Prevention and detection
- 10:08Runtime security mechanics
- 13:00Falco architecture
- 17:02System call bypass demo
- 21:12Extending syscall support
- 28:12Package manager bypass
- 32:52Output manipulation and wrap-up
related talks
34mBypassing Falco: How to Compromise a Cluster without Tripping the SOC
34mThe Eye of Falco: You Can Escape but Not Hide
25mUse Falco and eBPF to protect your applications
27mIntro: Falco
30mEvasive Maneuvers: Strategies to Overcome Runtime Detection Tools
39mDeep Dive: Falco
41mNavigating the Storm
36mIntro: Falco