eBPF Forensic Tools
The extended Berkeley Packet Filter (eBPF) is a relatively new technology that makes it possible to run sandboxed programs in kernel mode without modifying the kernel itself. Although this technology offers many advantages, it can also be misused by malicious parties. From a security perspective, it is therefore essential to be able to detect attacks that use eBPF.
Detection of malicious use of eBPF
The forensic tool Volatility can be used to detect malicious use of eBPF by attackers in memory dumps. However, to date, there has been insufficient evaluation to demonstrate that Volatility is capable of detecting all possible eBPF-related attacks. Case and Richard III previously conducted research with the aim of detecting system calls from eBPF programs using Volatility. This research builds on their work by evaluating how well Volatility can detect a sophisticated attack that exploits eBPF.
Improving Volatility for eBPF Detection
If it was determined that Volatility could not detect the attack correctly, the goal was to develop a plugin for Volatility that would make this possible. In addition, there are other forensic tools that are potentially suitable for detecting eBPF attacks. Therefore, this research also focused on evaluating an alternative tool, such as Red Hat's Crash utility, and comparing it with Volatility.
Detection of eBPF attacks
The core problem addressed in this research is that eBPF is a relatively new technology, which means that there is limited research available on the effectiveness of Volatility in detecting eBPF attacks. Because eBPF allows users to execute code directly in the kernel, this technology can be exploited by attackers. This poses a serious risk, as it allows them to gain direct access to all system resources. For this reason, it is essential that attacks using eBPF can be reliably detected with memory dump inspection tools such as Volatility.
Evaluation of detection capabilities
The research focused on evaluating Volatility's ability to detect an attack that exploits eBPF. When Volatility was unable to adequately detect the attack, the goal was to remedy this deficiency by expanding Volatility's plugin set.
Comparison between Volatility and Red Hat Crash
In addition, the study aimed to compare Volatility with another forensic tool, such as Red Hat Crash, to provide a broader understanding of the strengths and weaknesses of these tools in the context of eBPF attacks.
Results and contributions
This study attempted to detect an existing attack that exploits eBPF using Volatility and evaluated how effective the tool was in doing so. Based on the findings, areas for improvement were identified. Furthermore, this research contributes to improving the detection of eBPF exploits and increasing overall system security through forensic tools.
