Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Using eBPF to see through encryption without a proxy

github.com

Post reply on HN
Print view View original

71–80 of 80 posts

Re: Show HN: Using eBPF to see through encryption without a proxy

#71

Post by opello »

tylerflint wrote: post #47
chatmasta wrote: post #45

Earlier quoted context omitted.

Great approach. I love the choice of practicality over generalization. Are these offsets consistent across compilation targets, and they vary only by version of the Go binary? Or do you need to do this scan for every architecture?

The short answer is that we only have to calculate the offset per go version, no expensive runtime scanning is required. The long answer is that the offsets are the byte alignment offsets for the go structs containing the pointers to the file descriptor and buffers. Fortunately we only have to calculate these for each version where the TLS structs within go actually change, so not even for every version. For instance…

Is the precomputation sufficiently resilient to cross-compilation where the system may be composed of significantly different versions than something mainstream like Debian might ship? I'm thinking of embedded targets built using the Yocto Project tooling.

Re: Show HN: Using eBPF to see through encryption without a proxy

#72

Post by compscidr »

yonatan8070 wrote: post #22
compscidr wrote: post #13

Earlier quoted context omitted.

Its an internet sharing app that uses Wi-Fi direct and BLE The wireshark stuff is only for when I'm debugging

That sounds like a hotspot with extra steps, what does it do differently?

It can do multi-hop. It can also automatically authenticate across any number of phones, sort of like how radius works with fixed wifi (android hotspots don't support radius - you can only connect with radius as a client). You can also earn money from sharing your internet.

Re: Show HN: Using eBPF to see through encryption without a proxy

#73

Post by lelanthran »

tylerflint wrote: post #8
bbkane wrote: post #3

Does this work for Go binaries? My understanding is that Go programs do all the encryption "in the process" so the data is encrypted before eBPF can intercept it. I'd love to be wrong about that!

We have Go support, but it is not open sourced yet. Go is a bit more complicated but we were able to get it after some cave diving in the ELF formats. To give you a little insight on how this works, because Go is statically linked, we need to pull several different offsets of the functions we are going to hook into. We do this by scanning every version of Go that is released to find offsets in the standard library th…

I think you only need to use the eBPF approach for statically linked programs.

ISTR, at some point in the far past, using LD_PRELOAD with my own shims to capture TLS traffic before encryption/after decryption. I might have it lying around somewhere here.

Re: Show HN: Using eBPF to see through encryption without a proxy

#74

Post by tecleandor »

jonfriesen wrote: post #52
tecleandor wrote: post #48

Can it output pcap files or anything similar I can import onto Wireshark or a similar tool? Haven't found anything checking the docs...

As of today, we don't output pcap or har files though these are additions I'd like to make in the future, they aren't currently on our near term roadmap.

Nice. Thanks for the response!

Re: Show HN: Using eBPF to see through encryption without a proxy

#75

Post by mrbluecoat »

dilyevsky wrote: post #68
zxilly wrote: post #38

There's a similiar tool https://github.com/gojue/ecapture

Grafana's Beyla also basically works the same way https://github.com/grafana/beyla

Thanks for sharing. I didn't know about this one.

> Beyla supports a wide range of programming languages (Go, Java, .NET, NodeJS, Python, Ruby, Rust, etc.)

Although "gRPC and HTTP2 are not supported at the moment"

https://grafana.com/docs/beyla/latest/distributed-traces/

Re: Show HN: Using eBPF to see through encryption without a proxy

#76

Post by arter4 »

jonfriesen wrote: post #21
nikolayasdf123 wrote: post #16

sounds like a security breach. how you ensure this does not become link in some next complex CVE?

This is a great point, and Qtap itself does need to be used with care. The company behind Qtap (Qpoint.io) provides full inventory and alerting for this sort of scenario. That said, the eBPF verifier has robust security guarantees and runs on every load. So arbitrary mem access for example isn't possible. Qtap runs exclusively on your nodes, so you control what it captures and where that data goes. Our paid offering…

>The company behind Qtap (Qpoint.io) provides full inventory and alerting for this sort of scenario.

Could you expand on this? I haven't seen anything on your company website that suggests detection of this kind of stuff. Also, could you explain how this could be detected? Through another eBPF program?

Re: Show HN: Using eBPF to see through encryption without a proxy

#78

Post by brendangregg »

tylerflint wrote: post #63
brendangregg wrote: post #62

To everyone building these things: Please add a disclaimer to say something like: "This is not a vulnerability: eBPF currently requires root access to do this. Also, eBPF makes this easy but does not make it possible, as debuggers, interposers/shims, and other tools can also attach to pre-encryption points, and therefore banning eBPF (as some people want to do after seeing projects like this) would not actually impro…

Great idea! On an unrelated note, your work has inspired most of my career in Solaris/Illumos/Linux systems and honestly this project likely wouldn't have happened if it wasn't for all of your books/blogs/projects to help me along the way. Thank you!

Thanks, glad it's useful!
Post reply on HN