Hey, security guy here that has worked on something like this for about 2 years. This is cool but has some vulnerabilities upon a brief 10min code review. I'll see if I can circle back in about 2 weeks and make a list of what vulnerabilities EBPFSnitch has.
EBPFSnitch: An eBPF based Linux Application Firewall
41–50 of 71 posts
Re: EBPFSnitch: An eBPF based Linux Application Firewall
#42I get the point of it, but I think it's a distraction from the solutions we really need. The whole idea of app firewalls is "do/don't let an arbitrary network communication happen unless I know about it". The problem is, what if what you allow still involves an attacker? Say you allow some network connection from application A to site Z using protocols B,C. And say that you even inspect the connection using DLP. Ther…
Spot on. Firewall are becoming less and less useful in the time of cloud.
We need holistic solutions where we can control traffic by entity, domain, role, application, not IP address and port.
> There will come a point where the attacker will position themselves to appear exactly like legitimate traffic.
It's been happening for decades: botnet C&C servers use HTTPS and run on public clouds, mimicking legitimate websites.
Re: EBPFSnitch: An eBPF based Linux Application Firewall
#43Hey, security guy here that has worked on something like this for about 2 years. This is cool but has some vulnerabilities upon a brief 10min code review. I'll see if I can circle back in about 2 weeks and make a list of what vulnerabilities EBPFSnitch has.
When you say vulnerabilities what do you mean? RCE? Privesc? Software can bypass the firewall?
Also, based on your recent HN comments you seem to have claimed to find vulns in several projects, but to date have provided no proof of such claims, so I'll have to admit I'm a little skeptical.
Re: EBPFSnitch: An eBPF based Linux Application Firewall
#44If you're interested in this, you may be interested in this as well: https://github.com/evilsocket/opensnitch It has a GUI interface as well.
From https://github.com/evilsocket/opensnitch/wiki/Why-OpenSnitch...:
> Why OpenSnitch does not intercept application XXX
>
> tl;dr
>
> - because we don't use eBPF.
> - a process is opening connections too fast (nmap for example, firefox sometimes...).
> - the system has a high load and we're unable to find the process in time.
> ...
Re: EBPFSnitch: An eBPF based Linux Application Firewall
#45Hey, security guy here that has worked on something like this for about 2 years. This is cool but has some vulnerabilities upon a brief 10min code review. I'll see if I can circle back in about 2 weeks and make a list of what vulnerabilities EBPFSnitch has.
When you say vulnerabilities what do you mean? RCE? Privesc? Software can bypass the firewall? Also, based on your recent HN comments you seem to have claimed to find vulns in several projects, but to date have provided no proof of such claims, so I'll have to admit I'm a little skeptical.
Software that can bypass the firewall for certain, and a possible local privesc (I don't want to promise the LPE yet, I've only looked for 10min). Some skepticism is understandable. I've followed up on a few of the replies here outside of HN (such as the Guix project, I found a root LPE they will be releasing a fix for in the coming weeks). For 10 years or so I've not disclosed any vulnerabilities I found. Publicly unverifiable claims are necessary in security, if I were to release the POC before Guix (for instance) can patch it it'll affect their users.
Re: EBPFSnitch: An eBPF based Linux Application Firewall
#46Why does this need nf_queue? Wouldn't it be sufficient to directly filter the connect syscalls using eBPF? Dropping packets using netfilter makes many applications wait for a timeout. I prefer reject to filter unwanted outbound connections so that applications don't wait.
This uses NFQUEUE to get real-time userspace access to the ability to decide which connections to allow. NFQUEUE users must return a verdict on the packet (skb? I don't recall) before the packet continues to flow through the system. Using seccomp you don't get the opportunity to pass that up to a user to decide which action to take. Using other eBPF consumers are similar (since it represents a risk).
Re: EBPFSnitch: An eBPF based Linux Application Firewall
#47When I tested out eBPF a couple weeks ago I immediately had LittleSnitch in mind! Great to see that someone had the same idea and also the time to make it happen.
There's much more that can be done as well, I really highly recommend taking a look at eBPF!
Re: EBPFSnitch: An eBPF based Linux Application Firewall
#48Earlier quoted context omitted.
They're both pretty bad for something so simple. Tons of dependencies, complexity that shouldn't be there and perplexing code. evilsocket/opensnitch is worse but EBPFSnitch could also be a lot better.
If they're both "pretty bad for something so simple"... then it seems like a classic example of a problem that you could just release a solution for; then there would be a non-sucky solution available! Unless it's actually not that simple? You could at least make constructive criticism instead of just dismissively saying that all solutions suck. ("Tons of dependencies", "complexity", and "perplexing" are not actionab…
I don't know anything about this project, but it's okay to criticize large dependency trees and complexity. It sounds like you're looking for suggestions on how to fix that or the other. Neither of those things is trivially fixable, they're pretty fundamental problems. Sometimes a rewrite can do it.
Re: EBPFSnitch: An eBPF based Linux Application Firewall
#49This looks spectacular! Finally! This is functionality I've desperately wanted on Linux desktop. Link that up with with some of the SELinux on-demand tools and you have a plausible way to run untrusted binaries without the overhead of completely containerizing them up front.
without the overhead of completely containerizing them up front. What overhead? `docker run --rm -it -v $PWD/untrustedprogram:/untrustedprogram:ro ubuntu:latest`, done. Use x11docker if needed.
So Docker is a zero cost solution now?
Re: EBPFSnitch: An eBPF based Linux Application Firewall
#50For those who're unaware.
ebpf: extended berkeley packet filter
Unfortunately, even the website https://ebpf.io/what-is-ebpf doesn't mention this. Interestingly, I was unable to find the words packet filter used together as well or firewall. I might be wrong.
I know that if you know what it is you'd know but trying to explain that to my partner here just glancing at my screen wasn't easy.