Using eBPF for Effective High-Interaction Honeypots
These days, people and businesses rely heavily on connected information systems (the internet). This is not without risk: a large proportion of people and organizations face cyberattacks every year. How well you secure an information system depends heavily on how well you understand existing and emerging threats. To do this, you need to gather information about malicious activities. Honeypots are tools that collect that information: they allow themselves to be deliberately compromised by attackers and log their actions. This gives you insight into the behavior and motives of attackers. The power of honeypots lies in the fact that they not only collect information about known attacks but also about as-yet-unknown zero-day attacks.
High-interaction honeypots and eBPF
There are different types of honeypots: some allow very little interaction with attackers, while others allow a great deal. This study focused on high-interaction honeypots. One way to build them is to use an entire system as a honeypot and track the attacker’s actions after they gain access through that system’s kernel. In the past, kernel modules were typically used for this purpose. Recently, a new technology called eBPF (extended Berkeley Packet Filter) has been used to extend the capabilities of the Linux kernel.
Building Effective High-Interaction Honeypots
With eBPF, programs run in a sandbox within the kernel’s privileged context. They extend the kernel’s functionality without being directly tied to a specific kernel version. As a result, the risk of a corrupted kernel is lower than with traditional kernel modules. This research focused on building effective high-interaction honeypots using eBPF. Through an analysis of gray literature, the capabilities of eBPF were examined in terms of system observability, honeypot concealment, and secure log retrieval. Open-source eBPF projects were also reviewed, such as those for intrusion detection and malware analysis, as they incorporate techniques that are also applicable to honeypots.
Proof-of-concept and detection tests
In addition, an eBPF honeypot was built as a proof-of-concept to demonstrate that the techniques identified in the literature review are applicable in practice. Testing all possible techniques proved impractical. The proof-of-concept therefore uses a single method for system monitoring, a single technique to conceal the honeypot, and a single approach for retrieving logs.
For the final sub-question, detection methods that work against honeypots based on kernel modules—specifically Sebek—were tested in the proof-of-concept. This was done to determine whether eBPF blocks these detection techniques on its own.
