Jeff Dileo - Evil eBPF: Practical Abuses of In-Kernel Bytecode Runtime
Demonstrates how eBPF programs can be weaponized to create undetectable Linux kernel rootkits with full privilege and persistent covert channels.
Summary
eBPF as an Offensive Primitive
Jeff Dileo presents research on abusing the Linux eBPF subsystem — a technology designed for safe kernel instrumentation — as an offensive capability for rootkits, privilege escalation, and detection evasion.
eBPF Background
Extended Berkeley Packet Filter allows loading small, sandboxed programs into the Linux kernel via the bpf() syscall, with the kernel verifier ensuring memory safety. eBPF is widely deployed for observability (perf, bcc), networking (XDP, TC), and security (Falco, Seccomp).
Weaponizing eBPF
Dileo demonstrates loading eBPF programs that hook system calls (via kprobe/tracepoint attachments) to intercept and modify kernel operations without modifiable kernel code — creating a rootkit that hides files, network connections, and processes from standard Linux observation tools while evading loadable kernel module detection.
Privilege Escalation
eBPF programs loaded with CAP_BPF (available in Linux 5.8+) can read arbitrary kernel memory and overwrite cred structures to escalate to root, bypassing traditional SUID binary requirements.
Related talks
Main Stage·36 min
Agostino Panico
Examines vulnerability patterns in the Linux eBPF verifier and JIT compiler, demonstrating root privilege escalation via memory corruption.
Main Stage·43 min
PatH
PatH demonstrates utilizing extended Berkeley Packet Filters (eBPF) to create kernel rootkits without writing kernel modules, presenting defensive detection mechanisms.
Main Stage·49 min
Barak Sternberg
Barak Sternberg exposes vulnerabilities in browser extensions, demonstrating how to weaponize privileged extension APIs into persistent browser rootkits.