Blackhat 2021: With Friends Like eBPF, Who Needs Enemies?
Talk about an eBPF rootkit and how the capabilities of eBPF could be abused. The rootkit was also the object of a talk at Defcon, eBPF, I thought we were friends !.
- from
- eBPF
- added
- 2026-10-10
- likes
- 0
similar
-
ebpfkit github.com
A rootkit that leverages multiple eBPF features to implement offensive security techniques.
-
Bad BPF github.com
A collection of malicious eBPF programs that make use of eBPF's ability to read and write user data in between the usermode program and the kernel.
-
Embrace The Red: Offensive BPF! embracethered.com
A series of posts around the introduction into BPF with a focus to an offensive setting, and also how its misuse can be detected. Posts include discussions on the rootkit capabilities of eBPF, or on which tracing type is needed for different use cases.
-
TripleCross github.com
A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
-
eBPF - Rethinking the Linux Kernel docs.google.com
eBPF JavaScript-like capabilities to the Linux Kernel.
-
eBPF: “Talk about an eBPF rootkit and how the capabilities of eBPF could be abused. The rootkit was also the object of a talk at Defcon, eBPF, I thought we were friends !.”