YoVDO

Detecting Kernel Exploits with eBPF

Offered By: Black Hat via YouTube

Tags

Black Hat Courses Control-Flow Integrity Courses eBPF Courses

Course Description

Overview

Explore the potential of eBPF (extended Berkeley Packet Filter) for detecting kernel exploits in this 24-minute Black Hat conference talk. Delve into the rapid growth of eBPF within the Linux Kernel, its evolution from network monitoring to broader capabilities, and its approach to system safety and stability. Learn about eBPF probes, challenges, disabling methods, kpreps, kpro, Control Flow Integrity, enforcements, and performance considerations. Gain insights from presenter Guillaume Fournier on leveraging eBPF's expanding functionalities to enhance kernel security.

Syllabus

Introduction
Overview
Why eBPF
eBPF Probes
Problems with eBPF
How to disable eBPF
kpreps
kpro
Control Flow Integrity
Enforcements
Performance
Conclusion


Taught by

Black Hat

Related Courses

Enforcing Unique Code Target Property for Control-Flow Integrity
Association for Computing Machinery (ACM) via YouTube Current Status of RISC-V Security Mechanisms - Nick Kossifidis, FORTH
TheIACR via YouTube Two-Faces of WASM Security
Security BSides San Francisco via YouTube Taking Kernel Hardening to the Next Level
Black Hat via YouTube The Power of Data-Oriented Attacks - Bypassing Memory Mitigation Using Data-Only Exploitation Techniques
Black Hat via YouTube