BREAKING EBPF SECURITY: HOW KERNEL ROOTKITS BLIND OBSERVABILITY TOOLS

Summary from the TLDR InfoSec newsletter

Research has shown that kernel rootkits can systematically blind eBPF-based security tools by using ftrace to hook the data-delivery plumbing, BPF iterators, ring buffers, perf events, and map operations, rather than targeting the eBPF programs themselves. The Singularity rootkit selectively filters hidden processes and network connections at the kernel-to-userspace boundary, causing security tools to operate on a fabricated view of system state while believing they have complete visibility. The findings underscore that eBPF observability assumes a trusted kernel, and defenders must prioritize preventing kernel compromise through Secure Boot, signed module enforcement, and layered out-of-host detection rather than relying solely on kernel-level telemetry.