Offensive BPF: Malicious bpftrace 🤯
Brief
This post is part of a series about Offensive BPF that I’m working on to learn about BPF to understand attacks and defenses, click the “ebpf” tag to see all relevant posts.
I’m learning BPF to understand how its use will impact offensive security, malware, and detection engineering.
One offsec idea that quickly comes to mind with BPF is to observe network traffic and act upon specific events. So, I wanted to see if/how bpftrace , a popular tool for running BPF programs, can be used to create potential backdoors, and what evidence to look for as defenders.