Lesson 1.74: When eBPF is the hiding place
The same eBPF that lets defenders watch the kernel lets an attacker with root change what the kernel reports. A program attached to the getdents64 system call can remove entries from directory listings, so ls /proc, ps, top and even osquery stop showing a process, while the process keeps running and talking. In the lab the firewall still sees web07 talking to a command server, but nothing on the host does. You list the loaded eBPF programs, read the hider's map, decode the hidden PIDs, look at them directly through /proc, save the sample and unload the hider.
18 min
You will learn to
- Explain how an eBPF program can hide processes
- List eBPF programs and their owners with bpftool
- Dump an eBPF map and decode little-endian keys
- Reach hidden processes through /proc/PID directly
- Unload a hider: kill its loader and remove its pin
Key terms
- getdents64
- The system call that returns directory entries; ls and ps use it to list /proc.
- bpftool
- The kernel's tool for listing and inspecting eBPF programs and maps.
- eBPF map
- A key-value store shared between eBPF programs and user space.
- Pinning
- Keeping an eBPF object alive by giving it a path in /sys/fs/bpf.
- Little-endian
- Byte order where the least significant byte comes first (x86).
← Reading the journal across boots · All lessons · Reading e-mail headers →