Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Using eBPF to see through encryption without a proxy

github.com

Post reply on HN
Print view View original

21–30 of 80 posts

Re: Show HN: Using eBPF to see through encryption without a proxy

#21

Post by jonfriesen »

nikolayasdf123 wrote: post #16

sounds like a security breach. how you ensure this does not become link in some next complex CVE?

This is a great point, and Qtap itself does need to be used with care. The company behind Qtap (Qpoint.io) provides full inventory and alerting for this sort of scenario.

That said, the eBPF verifier has robust security guarantees and runs on every load. So arbitrary mem access for example isn't possible. Qtap runs exclusively on your nodes, so you control what it captures and where that data goes. Our paid offering provides more functionality with a Control Plane solutions that provides dashboards, alerting, and live config updates. However, all sensitive information, like captured http bodies, are uploaded to a S3 compliant bucket that you control. This could be S3, Minio, or anything else that supports the S3 API. We never see this information.

It's intentionally designed for deployment within your infra and abides by the security policies you set within your org.

Re: Show HN: Using eBPF to see through encryption without a proxy

#22

Post by yonatan8070 »

compscidr wrote: post #13
PcChip wrote: post #7

Earlier quoted context omitted.

I'm curious what your product does I've seen that type of behavior for apps that inject ads and add affiliate marketing links

Its an internet sharing app that uses Wi-Fi direct and BLE The wireshark stuff is only for when I'm debugging

That sounds like a hotspot with extra steps, what does it do differently?

Re: Show HN: Using eBPF to see through encryption without a proxy

#23

Post by jonfriesen »

0nethacker1 wrote: post #20

I like the fact this doesn't impact performance like MITM solutions do.

That was one of our biggest motivators when dreaming up Qtap.

How can we remove the impact that proxies have on connections, AND see the content without having to manage a custom certificate authority, AND not have to instrument all of our code.

Re: Show HN: Using eBPF to see through encryption without a proxy

#24

Post by pclmulqdq »

tylerflint wrote: post #6
pclmulqdq wrote: post #5

To hook into OpenSSL, don't you either need dynamic linking or userspace programs to compile your hooks in? Go and many Rust and C++ binaries tend to prefer static linking, so I wonder if this solution is workable there.

Great point! Yes it supports both scenarios. Qtap scans the binary ELF (curl, rust, etc) and looks for the TLS symbols. If they were statically compiled the eBPF probes will be attached directly to the binary, if dynamically linked the probes will be attached to the symbols in the library (.so).

Yeah, so -O2 and -O3 are likely to be problems for you, and the ELF surgery is very invasive.

Re: Show HN: Using eBPF to see through encryption without a proxy

#25

Post by captainbland »

jonfriesen wrote: post #21
nikolayasdf123 wrote: post #16

sounds like a security breach. how you ensure this does not become link in some next complex CVE?

This is a great point, and Qtap itself does need to be used with care. The company behind Qtap (Qpoint.io) provides full inventory and alerting for this sort of scenario. That said, the eBPF verifier has robust security guarantees and runs on every load. So arbitrary mem access for example isn't possible. Qtap runs exclusively on your nodes, so you control what it captures and where that data goes. Our paid offering…

What's the recommended way of locking down communications for this application? With a MITM based solution it's fairly clear you can lock its egress down to precisely what it needs at the network policy level at least, whereas it's a bit trickier with this as it necessarily shares an instance with other processes.

Is uploading clear text encrypted in flight data to another system even a good idea in most cases? In some cases that won't even be allowed because you'd end up storing regulated information in a way that auditors won't approve of (e.g. sometimes there is a requirement for field level encryption when data is in storage/at rest)

Re: Show HN: Using eBPF to see through encryption without a proxy

#27

Post by eptcyka »

I know that arguing that SSLKEYLOGFILE is all you need will just be a different version of the rsync/dropbox comment, but I do wonder under what circumstances is one able to strace a binary and isn’t able to make it dump session keys? I read the headline and set high hopes on finding a nifty way to mitm apps on Android - alas, I’m not sure this would work there necessarily.

Re: Show HN: Using eBPF to see through encryption without a proxy

#28

Post by jonfriesen »

pclmulqdq wrote: post #24
tylerflint wrote: post #6

Earlier quoted context omitted.

Great point! Yes it supports both scenarios. Qtap scans the binary ELF (curl, rust, etc) and looks for the TLS symbols. If they were statically compiled the eBPF probes will be attached directly to the binary, if dynamically linked the probes will be attached to the symbols in the library (.so).

Yeah, so -O2 and -O3 are likely to be problems for you, and the ELF surgery is very invasive.

Fair point on -O2 and -O3 optimized bins. We've approached this by building custom bin utils that are optimized for blazingly fast symbol recognition. Traditional ELF tools that focus on providing comprehensive context for debugging, we are strip away everything that is not the symbol locations we need.

We've also added caching so frequently used bins don't require multiple scans. Shared libraries as well. This has proven effective with optimized binaries, especially bins that are optimized, start, make a super quick network call, then exit, which was the bane of our existence for a little while.

Re: Show HN: Using eBPF to see through encryption without a proxy

#30

Post by jonfriesen »

captainbland wrote: post #25
jonfriesen wrote: post #21

Earlier quoted context omitted.

This is a great point, and Qtap itself does need to be used with care. The company behind Qtap (Qpoint.io) provides full inventory and alerting for this sort of scenario. That said, the eBPF verifier has robust security guarantees and runs on every load. So arbitrary mem access for example isn't possible. Qtap runs exclusively on your nodes, so you control what it captures and where that data goes. Our paid offering…

What's the recommended way of locking down communications for this application? With a MITM based solution it's fairly clear you can lock its egress down to precisely what it needs at the network policy level at least, whereas it's a bit trickier with this as it necessarily shares an instance with other processes. Is uploading clear text encrypted in flight data to another system even a good idea in most cases? In so…

You've definitely hit on a point that we've talked about at length and have come to terms that different organizations have different requirements, especially when it comes to regulatory and compliance.

Qtap can be locked down with local firewalls or perimeter firewalls like other applications running within a network. The TLS inspection can also be disabled with a `--tls-probes=none` flag on startup.

Even without inspection enabled, Qtap provides rich context when it comes to connections to processes. For example, source/destination information, bandwidth usage, SNI information, container meta, even Kubernetes pod and namespace meta. All of this can paint a thorough picture of what's happening with zero instrumentation.

When it comes down to it, some orgs may not be able to use the TLS inspection or require specific methods of persisting data. If we can't support this today, our goal is to address these as they come up and hopefully help devs and ops folks working in these constrained environments get what they need while maintaining compliance.

Post reply on HN