Red Hat Eyeing Innovative eBPF Uses For Linux's HID Subsystem

[oiaohm]

Old article I know, but I wanted to make sure there is an actual bit of proof with all the eBPF apologism that eBPF was and is a very bad idea and should be ripped out. A JIT compiler in the kernel was absolutely effin stupid to begin with. I don't care the experienced kernel developers thought it was a good idea. Any person that thought it even half way through could tell this was a stupid idea.

If you don't believe me, look up BPFDoor which is PRC state sponsored malware specifically targeting the Linux eBPF mechanism and has gone undiscovered for the past 5 years. Essentially for as long as eBPF has been in the kernel.

Linux security has become the utter joke that Windows was back in the naughts.

https://qmonnet.github.io/whirl-offload/2017/02/11/implementing-openstate-with-ebpf/

The reality here the port knocking of BPFDoor is nothing special open source code documented how todo in 2017. The older pcap portkocking also bypassed all firewall protections.

Also in 2017 to be correct Linux kernel 4.13 included feature to list all running bpf/ebpf programs and the tools to check.

So its not that Linux kernel security is poor here. The functionality to detect this malware was include almost since day 1. Functionality to make implement this malware had was added with Linux kernel 5.8 Aug 2020 with added capabilities flag for BPF usage so now don't have to run processes that need other capabilities with BPF support.

There is a old saying you can lead a horse to water but you cannot make it drink.

No Linux is not like windows in the naughts. Windows in the naughts you had a stack of security faults that no matter what you did you were never close to safe right to down have ping of death faults and other remote exploits with no prevention or detection options. This is if configured right using the functionality provide the attack was detectable in 2017 and preventable in 2020.

JIT in kernel is still a lot safer than random binary blob kernel modules. There are a lot of Window backdoor kernel drivers that are very hard to detect. Yes a BPF program cannot filter the output of the list running BPF programs or hook that that function has been called and that is by design from 2017 so there was some thought to this problem in 2017.