Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EBPFSnitch: An eBPF based Linux Application Firewall

github.com

Post reply on HN
Print view View original

61–70 of 71 posts

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#61

Post by krageon »

coder543 wrote: post #34
creamytaco wrote: post #20

Earlier quoted context omitted.

They're both pretty bad for something so simple. Tons of dependencies, complexity that shouldn't be there and perplexing code. evilsocket/opensnitch is worse but EBPFSnitch could also be a lot better.

If they're both "pretty bad for something so simple"... then it seems like a classic example of a problem that you could just release a solution for; then there would be a non-sucky solution available! Unless it's actually not that simple? You could at least make constructive criticism instead of just dismissively saying that all solutions suck. ("Tons of dependencies", "complexity", and "perplexing" are not actionab…

> Unless it's actually not that simple?

Recognising that given sufficient domain knowledge you could minimise and optimise dependencies and actually having that domain knowledge for this specific field are not the same thing. For the former, you just need to be a professional. For the latter, you need to be in luck for this specific subject.

You don't fix that by being snarky. Ironic, because in the last paragraph you do ask for constructive criticism! The least you could do is materially reciprocate in doing so.

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#62

Post by dhaavi »

netsec_burn wrote: post #45
cmeacham98 wrote: post #43

Earlier quoted context omitted.

When you say vulnerabilities what do you mean? RCE? Privesc? Software can bypass the firewall? Also, based on your recent HN comments you seem to have claimed to find vulns in several projects, but to date have provided no proof of such claims, so I'll have to admit I'm a little skeptical.

Software that can bypass the firewall for certain, and a possible local privesc (I don't want to promise the LPE yet, I've only looked for 10min). Some skepticism is understandable. I've followed up on a few of the replies here outside of HN (such as the Guix project, I found a root LPE they will be releasing a fix for in the coming weeks). For 10 years or so I've not disclosed any vulnerabilities I found. Publicly u…

If you publish your findings somewhere, I'd love to read what you have found! We are also building a FOSS application firewall for Linux and I would like to see what problems you have found and how we are doing in that regard. Ref: https://safing.io/portmaster/

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#63

Post by dhaavi »

sandGorgon wrote: post #59

This is very cool. Something like this can be a full blown commercial product. > The control interface is implemented in Python 3 utilizing Qt5 I would recommend moving away from this and instead run the controls using a web interface. A small django/flask/fastapi app (maybe even running through docker). U can see how that could run on a raspberry Pi and be accessible on the network through the browser.

This is pretty much what we are doing with the Portmaster: https://safing.io/portmaster/

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#64

Post by dhaavi »

sloshnmosh wrote: post #30
EMM_386 wrote: post #24

Earlier quoted context omitted.

On Windows, Malwarebytes (now BiniSoft) still maintains a decent free product called Windows Firewall Control that works in a similar way. It augments the existing firewall. https://www.binisoft.org/wfc

WFC is an excellent Windows based firewall. It also has the option to see the location of the executable trying to access the web and to also upload a hash of the file to VirusTotal. I have been using this back before when it was a paid program (I think it was only $15 for lifetime use) and before it was purchased by MalwareBytes. I no longer use any Windows computers but I install it on all my friends and families W…

We are building the Portmaster, which can do some of these things already. Currently looking for testers: https://safing.io/portmaster/

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#65

Post by dhaavi »

squarefoot wrote: post #40
spyc wrote: post #12

Reminds me of good old Kerio Personal Firewall on Windows back in the 90s. If the UI gets some more love, I see ebpfsnitch take off like a rocket :)

> Reminds me of good old Kerio Personal Firewall on Windows back in the 90s. That was my first thought as well. Back then Kerio Personal Firewall was a godsend, and seeing live how much software (which on windows was 99.9% closed) was attempting to phone home behind the user, became an eye opener to many of us.

If you'd like to try a modern version of that - we are looking for testers: https://safing.io/portmaster/

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#66

Post by ohazi »

pratio wrote: post #50

For those who're unaware. ebpf: extended berkeley packet filter Unfortunately, even the website https://ebpf.io/what-is-ebpf doesn't mention this. Interestingly, I was unable to find the words packet filter used together as well or firewall. I might be wrong. I know that if you know what it is you'd know but trying to explain that to my partner here just glancing at my screen wasn't easy.

I really like eBPF, and I even know what the acronym stands for, but I'm still completely incapable of reading it as anything other than "e band pass filter"

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#67

Post by squarefoot »

dhaavi wrote: post #65
squarefoot wrote: post #40

Earlier quoted context omitted.

> Reminds me of good old Kerio Personal Firewall on Windows back in the 90s. That was my first thought as well. Back then Kerio Personal Firewall was a godsend, and seeing live how much software (which on windows was 99.9% closed) was attempting to phone home behind the user, became an eye opener to many of us.

If you'd like to try a modern version of that - we are looking for testers: https://safing.io/portmaster/

Doing that on my Debian rolling machine just now.

(Linux 5.7.0-1-amd64 #1 SMP Debian 5.7.6-1 (2020-06-24)

It installed flawlessly after satisfying the libnetfilter-queue1 dependency, currently I'm playing with it, I like the granularity that allows blocking/allowing different domains accesses from within a process, such as for example a tab in Firefox. I'm curious to test it in the next days with Windows closed software run under WINE to see what they do under the hood. So far it seems really well made, I believe it would deserve a full HN article.

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#68

Post by code-scope »

throw2737 wrote: post #5
arsome wrote: post #3

Earlier quoted context omitted.

Be careful with that one, this isn't as capable as the HIDS solutions available on Windows - it's not going to do things like detect exfiltration using other executables or modification of other files on your system. For example, if you allowed curl or Firefox, another executable can simply call one of them and send/receive whatever data they need to. It also can't do things like filter ptrace calls which could easil…

Windows app firewalls had similar problems, most common was to use explorer.exe

Just block explorer.exe with windows firewall - if really needed just enable out going access for internal subnet only.

There is not need for explorer to access internet!

I only allow windows defender, firefox and chrome to access internet in my home computer setup all other apps are blocked unless truly needed.

If you block svchost.exe from internet access with windows firewall, it will block the windows update. Enable it once in a while to allow the windows update to go thru when you feel the need.

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#69

Post by netsec_burn »

dhaavi wrote: post #62
netsec_burn wrote: post #45

Earlier quoted context omitted.

Software that can bypass the firewall for certain, and a possible local privesc (I don't want to promise the LPE yet, I've only looked for 10min). Some skepticism is understandable. I've followed up on a few of the replies here outside of HN (such as the Guix project, I found a root LPE they will be releasing a fix for in the coming weeks). For 10 years or so I've not disclosed any vulnerabilities I found. Publicly u…

If you publish your findings somewhere, I'd love to read what you have found! We are also building a FOSS application firewall for Linux and I would like to see what problems you have found and how we are doing in that regard. Ref: https://safing.io/portmaster/

Hey there. I did a second 10 minute code review on Portmaster. First I want to say, well done on your modular source tree. It made it very easy for me to go through your open source project. Second, Portmaster is more vulnerable than EBPFSnitch. There's a firewall bypass like EBPFSnitch and a possible auth bypass in the API. I need to verify if the auth bypass is exploitable. A blog post sounds interesting but I'd need to coordinate disclosure with you so your end users aren't affected. I'll circle back in an email thread, expect it in ~1mo.

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#70

Post by dhaavi »

netsec_burn wrote: post #69
dhaavi wrote: post #62

Earlier quoted context omitted.

If you publish your findings somewhere, I'd love to read what you have found! We are also building a FOSS application firewall for Linux and I would like to see what problems you have found and how we are doing in that regard. Ref: https://safing.io/portmaster/

Hey there. I did a second 10 minute code review on Portmaster. First I want to say, well done on your modular source tree. It made it very easy for me to go through your open source project. Second, Portmaster is more vulnerable than EBPFSnitch. There's a firewall bypass like EBPFSnitch and a possible auth bypass in the API. I need to verify if the auth bypass is exploitable. A blog post sounds interesting but I'd ne…

Wow, thank you for looking into it! I am very much looking forward to your email.
Post reply on HN