Dependency Driven Data Exfiltration Prevention via eBPF for 3rd Party Libraries
摘要
This initial investigation addresses the challenge of data exfiltration through compromised third-party libraries by leveraging the extended Berkeley Packet Filter (eBPF), and system calls abstraction. The research integrates network access control lists to enforce authorized operations strictly, enhancing the security framework against this specific attack vector. It examines process isolation via mandatory access control mechanisms such as SELinux or AppArmor, alongside discretionary controls through setgid and sudoers. Additionally, the study discusses the implementation of a build file within an isolated Linux container confined within a restricted namespace. The use of eBPF is pivotal, enabling the compilation process in a privileged kernel context and utilizing the Berkeley Packet Filter to control network traffic meticulously. This includes establishing stringent egress and ingress rules to block malicious external calls and incoming requests linked to third-party library vulnerabilities. Although the research is in its nascent stages, preliminary results demonstrate a promising approach to mitigating risks associated with third-party libraries in modern computing environments.