Coping with Zero Days with Cilium Tetragon
summary
Cilium Tetragon uses eBPF to detect and forensically trace zero‑day exploitation by matching kernel events to specific vulnerable artifacts, for example hooks security_mmap_file to spot sshd mapping a compromised liblzma (the XZ backdoor), emits compact JSON with process ancestry and Kubernetes metadata, and can actively stop exploitation by kills process with SIGKILL. Policies deploy as a daemonset without restarting workloads, operators see events or metrics and expect <2–3% CPU overhead> for baseline monitoring.
AI-written summary · about
chapters (11)
- 0:00Tetragon and zero-day vulnerabilities
- 1:51What is eBPF and security
- 5:45Tetragon basics and monitoring
- 12:32Detecting zero-day exploits
- 15:20Demo: XZ utils backdoor exploit
- 20:49Blocking exploits with policies
- 25:31Runtime vs build-time detection
- 28:01Low-overhead runtime security
- 32:16Kubernetes process hierarchy
- 35:50Tetragon at scale and GitHub
- 36:58Q&A
related talks
44mCoping with Zero Days with Cilium Tetragon
42mCoping with Zero Days with Cilium Tetragon
33mDetecting Compromised CI With eBPF and Cilium Tetragon
33meBPF for Security
32mReal Time Security - eBPF for Preventing attacks
31meBPF-Driven Security for Kubernetes: The Tetragon Story
22mOne Project, Different Angles: How to Secure and Observe with Cilium
44mCilium - Container Security and Networking Using BPF and XDP