Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Just to clarify what this is probably about, for people who don't do security research (that's what Quarkslab does) --- this is mostly valuable information for people who need to instrument apps under test to see what they're doing.

Locked-down TLS is a pain for testers, because, of course, the whole idea is preventing third parties from seeing plaintext. But that's what app testers need to do (usually, to get enough information to write their own tooling-grade clients and servers to use to probe vulnerabilities with). There's a bunch of different tools people use for this purpose; Frida is probably the best-known example, for mobile and native clients.

But if your target under test is Linux, modern eBPF gives you enough tooling to capture plaintext without directly instrumenting binaries, which is handy.

This isn't, like, per se a vulnerability; they're not saying it is.



> This isn't, like, per se a vulnerability; they're not saying it is.

"Defeating" is a really poor choice of verb in the title for a post that isn't claiming a vulnerability.


Meh, I don't think so, any more than "defeating" content protection is a poor choice for an article about testing game and video playback systems. Defeating these things is just a step you have to take to test them.


"Inspecting TLS encryption with eBPF" would be better, IMHO, as it is less loaded. However the link is ~8 hours old so it is moot at this point.


The subtitle for the talk is "a security focused introduction to eBPF". I guess they changed it to give a bit of a heads-up for those just reading the posts title, but it's not the subtitle chosen by the author.


IMHO it would be a vulnerability if you can "defeat" TLS with non-root user (scale priv attack). AFAIK you must be root to run tracing BPF.

As you say, quarkslab's tool (Peetch) can be a user-friendly alternative to Wireshark and SSL logs workaround.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: