4 ms·
Don't disagree, but there are eBPF mitigations that work as alternatives to unloading kernel modules.
by atgreen 4mo ago
Don't disagree, but there are eBPF mitigations that work as alternatives to unloading kernel modules.
- cassianoleal 4mo agoCan you elaborate on that?
- atgreen 4mo agoHave a look at https://github.com/atgreen/rhel-block-copyfail https://github.com/atgreen/rhel-block-copyfail
- cassianoleal 4mo agoThanks! From the sound of it, the same mitigations for Copy Fail 1 are also effective here.
- atgreen 4mo agoNo, they are different. I just bundled them together for convenience in this POC. The only real thing in common is that they both use eBPF.
- cassianoleal 4mo agoGot it, thanks!
- JeremyNT 4mo agoI was aware of commercial antivirus vendors (Crowdstrike) doing something like this, but this is the first I've seen it published by somebody in the open! Have you considered writing up a blog post and submitting this to HN?