Open & Secure: Novel Sandboxing Technique for Any Open Source Library
summary
Claims a deployable runtime that fingerprints library behavior and detects deviations to stop exploits without CVEs, using eBPF plus Google’s KRSI hooks to block in-kernel actions. Demonstrates detection of the EXI backdoor by spotting liblzma executing system calls it never should, cites ~120,000 kernel probes and thousands of profiled OSS packages, and describes a crowd-learned Oligo Knowledge Base that flags anomalous library actions in real time.
AI-written summary · about
chapters (20)
- 0:00Introduction and speaker background
- 1:27Realization from Instagram hack
- 2:50Limitations of shift-left security
- 5:19Failure of RASP and first wave defenses
- 6:23Network and host-based security limits
- 8:07Need for application-level monitoring
- 9:12Requirements for new security tech
- 9:55Introduction to eBPF technology
- 13:06Why eBPF is revolutionary
- 15:12eBPF accessibility and limitations
- 16:37eBPF in network security
- 18:00Challenges of using eBPF
- 19:26eBPF for host intrusion detection
- 20:33Kernel runtime security instrumentation
- 21:38Detecting zero-day attacks with eBPF
- 23:43XZ backdoor case study
- 25:30Oligo's library behavior monitoring
- 27:17Demo: catching XZ backdoor attack
- 29:42Conclusion and future of runtime security
- 31:27Q&A session
related talks
38mSandboxing in Linux with zero lines of code
40mExploring Runtime Security and Forensic using eBPF
33mKernel Runtime Security Instrumentation
09mLightning Talk: Enabling “Safe” Use of Untrusted Open Source Dependencies with Sandboxing
36meBPF for Runtime Security
14mWill eBPF Save Us From the Next Global Outage?
22mSandboxes all the way down - A hitchhiker's guide to platform...
28mCompartmentalizing Vulnerable Kernel Components Without Stopping the Machine