Cfgmgmtcamp 2024 — eBPF-based Security Observability & Runtime Enforcement with Cilium Tetragon.pdf

eBPF is used in several cloud native security tools. In this talk we’ll dive into demos and code to explore how eBPF can be used for the next generation of security enforcement tooling. This talk will cover:
- Why enforcing NetworkPolicy with eBPF has been in place for years, but preventive security for applications has taken longer.
- How Phantom attacks can compromise the use of basic system call hooks.
- How other eBPF attachment points, such as BPF LSM, can be used for preventive security.

Transcript

1. eBPF-based Security Observability & Runtime Enforcement with Cilium Tetragon Raphaël Pinson | @raphink — 🧪 Cilium Alchemist
2. with Cilium Tetragon eBPF-based Security Observability & Runtime Enforcement ⬢ Security Observability ⬢ eBPF ⬢ Cloud Native Metadata ⬢ Runtime Enforcement
3. with Cilium Tetragon eBPF-based Security Observability & Runtime Enforcement ⬢ Security Observability
4. Who am I Raphaël Pinson Cilium Alchemist @ Isovalent
5. Runtime Security - Security in Real Time Active protection while your workload is running → Detecting malicious activity in real time → Reporting when malicious events occur -> Even better, preventing them
7. What activity do we care about? • Network traffic • File & I/O activity • Running executables • System call activity • Changing privileges & namespace boundaries • …
8. How could we spot this activity? • LD_PRELOAD • ptrace • seccomp • LSM • eBPF
9. LD_PRELOAD • Standard C library, dynamically linked • System call API • Replace the “standard” library
10. LD_PRELOAD • Standard C library, dynamically linked • System call API • Replace the “standard” library • Bypassed by statically linked executables
11. Syscall checks within the kernel ptrace, seccomp, eBPF kprobes on syscall entry
12. TOCTTOU with syscalls For more details • Leo Di Donato & KP Singh at CN eBPF Day 2021 • Rex Guo & Junyuan Zeng at DEFCON 29 on Phantom attacks ptrace, seccomp, eBPF kprobes on syscall entry
13. Need to make the check at the right place
14. Linux Security Modules • Stable interface • Safe places to make checks
15. with Cilium Tetragon eBPF-based Security Observability & Runtime Enforcement ⬢ Security Observability ⬢ eBPF
17. Process Scheduler execve() Linux Kernel Syscall
18. How does it work? @raphink | @raphink@mastodon.social
19. How does it work? @raphink | @raphink@mastodon.social
20. How does it work? @raphink | @raphink@mastodon.social
21. How does it work? @raphink | @raphink@mastodon.social
22. How does it work? @raphink | @raphink@mastodon.social
23. How does it work? @raphink | @raphink@mastodon.social
24. How does it work? @raphink | @raphink@mastodon.social
25. How does it work? @raphink | @raphink@mastodon.social
27. BPF LSM • Stable interface • Safe places to make checks • eBPF makes it dynamic • Protect pre-existing processes
28. BPF LSM • Stable interface • Safe places to make checks • eBPF makes it dynamic • Protect pre-existing processes • Needs kernel 5.7+
29. Cilium Tetragon • eBPF makes it dynamic • Protect pre-existing processes • Uses kernel knowledge to hook into sufficiently stable functions
30. Cilium Tetragon • eBPF makes it dynamic • Protect pre-existing processes • Uses kernel knowledge to hook into sufficiently stable functions • Multiple co-ordinated eBPF programs
31. Cilium Tetragon • eBPF makes it dynamic • Protect pre-existing processes • Uses kernel knowledge to hook into sufficiently stable functions • Multiple co-ordinated eBPF programs • In-kernel event filtering
32. Observability • Deep Visibility ◦ System, network, protocols, filesystem, applications, … • Transparent ◦ App agonistic ◦ No changes to applications • Low-Overhead ◦ Minimal overhead ◦ Extensive filtering & aggregation • Integrations ◦ Prometheus, Grafana, SIEM, fluentd, OpenTelemetry, elasticsearch
33. with Cilium Tetragon eBPF-based Security Observability & Runtime Enforcement ⬢ Security Observability ⬢ eBPF ⬢ Cloud Native Metadata
34. Context is everything
35. Cloud Native Metadata
36. YAML Config Example
37. YAML/Kubernetes as Control Plane
38. Network Interface Metrics
39. TCP Latency (sRTT)
40. Traffic Accounting
41. TLS/SSL Visibility
42. Detecting weak/vulnerable TLS Versions
43. Observing DNS, HTTP, TCP, …
44. Audit Listening Ports
45. Detect DNS bypass attempts
46. Detecting Nmap Scans
47. Monitoring Process Execution & Syscalls
48. Combined Network & Runtime Visibility
49. Detect Late Process Execution
50. Monitoring File Access
51. Network Policy Compliance
52. Observing HTTP & gRPC
53. with Cilium Tetragon eBPF-based Security Observability & Runtime Enforcement ⬢ Security Observability ⬢ eBPF ⬢ Cloud Native Metadata ⬢ Runtime Enforcement
54. Runtime Enforcement • Preventive Security ◦ System, network, filesystem, and applications • Synchronous enforcement • Integrations ◦ Kubernetes CRD, JSON, OPA, … ◦ Convert from existing rule sets (Falco, PodSecurity Policies, …)
55. Preventative actions from user space
56. Preventative actions from kernel
57. Preventing Sensitive File Access
58. Detecting re-mount of root filesystem
59. Monitoring & Preventing Capabilities Abuse
60. Security Observability & Runtime Enforcement github.com/cilium/tetragon
61. Tetragon Tetragon Enterprise Advanced Visibility • Extended Network Visibility • DNS, HTTP, HTTPS, TLS • SIEM Integration • Process Ancestry Information • High-performance Protocol Parsers, Aggregation, & Filtering • File Integrity Monitoring (Digest SHA256) Advanced Enforcement • Extended Runtime Enforcement Capabilities • Threat Detection • Baseline Policies Visibility • Process & Syscall Visibility • L3-L4 Network Visibility • File Access Monitoring • Capabilities & Namespacing Enforcement • System call-based enforcement (kprobes, tracepoints)
62. Which eBee are you? @raphink | @raphink@mastodon.social Cloud Network Engineer Platform Engineer Platform Ops (Service Mesh) Security Professional Cloud Architect
64. Practical Labs … to become a Cilium & eBPF Jedi 🌐 https://labs-map.isovalent.com Get badges 🏅 @raphink | @raphink@mastodon.social
65. eBPF resources eCHO eBPF YouTube podcast: https://www.youtube.com/channel/UCJFUxkVQTBJh3LD1wYB WvuQ eBPF & Cilium Slack http://slack.cilium.io/ eCHO News Bi-weekly eBPF newsletter: https://cilium.io/newsletter/ @raphink | @raphink@mastodon.social
66. Thank you!