The cool part about eBPF-based rootkits is portability.
A kernel module–based rootkit needs to be rebuilt when a new kernel is deployed.
Conversation
Using eBPF solves that: the interfaces are stable. Targeted userspace apps might change, but this shouldn't be hard to handle considering the script-like nature of eBPF.
1
10
1
7
"eBPF, I thought we were friends!" by Guillaume Fournier and Sylvain Afchain
Video: youtube.com/watch?v=5zixND
Slides: media.defcon.org/DEF%20CON%2029
1
7
41
"Warping Reality: Creating and Countering the Next Generation of Linux Rootkits" by
Video: youtube.com/watch?v=g6SKWT
Slides: media.defcon.org/DEF%20CON%2029
Replying to
TL;DR: They build a rootkit via malicious eBPF programs. The programs are constrained to what the verifier permits (i.e., no AARW), but the allowed functionality is enough to mess with userspace daemons for LPE and with network packets for C&C.
1
1
16