Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Using eBPF to see through encryption without a proxy

github.com

Post reply on HN
Print view View original

11–20 of 80 posts

Re: Show HN: Using eBPF to see through encryption without a proxy

#11

Post by Retr0id »

lights0123 wrote: post #4
bbkane wrote: post #3

Does this work for Go binaries? My understanding is that Go programs do all the encryption "in the process" so the data is encrypted before eBPF can intercept it. I'd love to be wrong about that!

Most programs do encryption without syscalls! eBPF can intercept userspace execution, which they do as mentioned in the post: > The key idea is to hook into common TLS libraries (like OpenSSL) before encryption and after decryption

If I want to do something similar, do you know where the relevant parts of the eBPF docs are?

Re: Show HN: Using eBPF to see through encryption without a proxy

#12

Post by bbkane »

tylerflint wrote: post #8
bbkane wrote: post #3

Does this work for Go binaries? My understanding is that Go programs do all the encryption "in the process" so the data is encrypted before eBPF can intercept it. I'd love to be wrong about that!

We have Go support, but it is not open sourced yet. Go is a bit more complicated but we were able to get it after some cave diving in the ELF formats. To give you a little insight on how this works, because Go is statically linked, we need to pull several different offsets of the functions we are going to hook into. We do this by scanning every version of Go that is released to find offsets in the standard library th…

Ok, that's exciting, and thanks for the insight!

Re: Show HN: Using eBPF to see through encryption without a proxy

#13

Post by compscidr »

PcChip wrote: post #7
compscidr wrote: post #2

Have been following this project for a while, cool stuff! I work a bunch with vpn-like networking on Android phones and it would be cool to have a bit of info on how I might get something like working on phones. I guess its probably not your typical usecase. Currently since the project is a VPN client, I already intercept all of the packets, I have a pcap writer and can write to files or a tcp sockets and connect wir…

I'm curious what your product does I've seen that type of behavior for apps that inject ads and add affiliate marketing links

Its an internet sharing app that uses Wi-Fi direct and BLE

The wireshark stuff is only for when I'm debugging

Re: Show HN: Using eBPF to see through encryption without a proxy

#14

Post by tylerflint »

adampk wrote: post #9

How easy is the set up, does this need to be deeply integrated in each step of the life-cycle?

Just run the qtap agent on whatever Linux machine has apps running on it and it will see everything through the kernel vs eBPF.

You can customize config and/or integrate with existing observability pipelines, but initially you just need to turn it on for it to work. No app instrumentation required.

Re: Show HN: Using eBPF to see through encryption without a proxy

#15

Post by jonfriesen »

Retr0id wrote: post #11
lights0123 wrote: post #4

Earlier quoted context omitted.

Most programs do encryption without syscalls! eBPF can intercept userspace execution, which they do as mentioned in the post: > The key idea is to hook into common TLS libraries (like OpenSSL) before encryption and after decryption

If I want to do something similar, do you know where the relevant parts of the eBPF docs are?

Qtap scans binaries of processes as well known locations for OpenSSL on startup, then passes the offsets to eBPF where it hooks into the SSL_read and SSL_write to get the content before or after it's been encrypted.

This is the eBPF side: https://github.com/qpoint-io/qtap/blob/main/bpf/tap/openssl....

The Go side which indicates what we are scanning for is here: https://github.com/qpoint-io/qtap/blob/main/pkg/ebpf/tls/ope...

For more docs on the topic: - https://docs.ebpf.io/ is a must read - https://eunomia.dev/en/tutorials/30-sslsniff/ has a tutorial on cracking OpenSSL open and getting the content as well. The tutorials they have are fantastic in general

Re: Show HN: Using eBPF to see through encryption without a proxy

#17

Post by mberning »

nikolayasdf123 wrote: post #16

sounds like a security breach. how you ensure this does not become link in some next complex CVE?

My first thought was this is cool. My second thought was that this is going to be impossible to securely manage and administer.

Re: Show HN: Using eBPF to see through encryption without a proxy

#19

Post by tylerflint »

worldsavior wrote: post #18

Isn't there already mechanisms for patching specific SSL libraries to view encrypted requests (e.g. frida)? What is the benefit of using eBPF?

The main benefit is complete coverage. In production systems there are many different workloads with many different binaries, each with different build processes. Leveraging eBPF enables seeing everything on a system without having to adjust the build pipeline.
Post reply on HN