Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

probable false: net/ddos in datadog-agent-oci-compat-7.54 (synflood) #289

Closed
Tracked by #232
tstromberg opened this issue Jun 24, 2024 · 3 comments · Fixed by #299
Closed
Tracked by #232

probable false: net/ddos in datadog-agent-oci-compat-7.54 (synflood) #289

tstromberg opened this issue Jun 24, 2024 · 3 comments · Fixed by #299

Comments

@tstromberg
Copy link
Collaborator 

packages/x86_64/datadog-agent-oci-compat-7.54/opt/datadog-agent/embedded/share/system-probe/ebpf/co-re/tracer-fentry-debug.o [🚨 CRITICAL]
---------------------------------------------------------------------------------
RISK  KEY       DESCRIPTION                                            EVIDENCE  
---------------------------------------------------------------------------------
CRIT  net/ddos  Performs DDoS (distributed denial of service) attacks  synflood  
---------------------------------------------------------------------------------
@tstromberg tstromberg mentioned this issue Jun 26, 2024
Closed
9 tasks
@egibs
Copy link
Member

egibs commented Jun 29, 2024

After a bit of xxd wrangling:

000334a0: 0110010001100101 0110011001100101 0111001001011111 0110000101100011 0110001101100101 0111000001110100 0000000001110011 0111100101101110 0110011001101100 0110111101101111 0110010001011111 0111011101100001 0111001001101110 0110010101100100 0000000001111001 0110111101110101  defer_accept.synflood_warned.you

We can add a not for this 👍🏻

@egibs egibs mentioned this issue Jun 29, 2024
Merged
@tstromberg tstromberg reopened this Jul 2, 2024
@tstromberg
Copy link
Collaborator Author

I'm still seeing this with wolfi datadog packages & bincapz 0.13.2:

/home/t/packages/x86_64/datadog-agent-oci-compat-7.54/opt/datadog-agent/embedded/share/system-probe/ebpf/co-re/tcp-queue-length-debug.o [
🚨 CRITICAL]
---------------------------------------------------------------------------------
RISK  KEY       DESCRIPTION                                            EVIDENCE  
---------------------------------------------------------------------------------
CRIT  net/ddos  Performs DDoS (distributed denial of service) attacks  synflood  
---------------------------------------------------------------------------------

/home/t/packages/x86_64/datadog-agent-oci-compat-7.54/opt/datadog-agent/embedded/share/system-probe/ebpf/co-re/tcp-queue-length.o [🚨 CRIT
ICAL]
---------------------------------------------------------------------------------
RISK  KEY       DESCRIPTION                                            EVIDENCE  
---------------------------------------------------------------------------------
CRIT  net/ddos  Performs DDoS (distributed denial of service) attacks  synflood  
---------------------------------------------------------------------------------

/home/t/packages/x86_64/datadog-agent-oci-compat-7.54/opt/datadog-agent/embedded/share/system-probe/ebpf/co-re/tracer-debug.o [🚨 CRITICAL
]
---------------------------------------------------------------------------------
RISK  KEY       DESCRIPTION                                            EVIDENCE  
---------------------------------------------------------------------------------
CRIT  net/ddos  Performs DDoS (distributed denial of service) attacks  synflood  
---------------------------------------------------------------------------------

/home/t/packages/x86_64/datadog-agent-oci-compat-7.54/opt/datadog-agent/embedded/share/system-probe/ebpf/co-re/tracer-fentry-debug.o [🚨 C
RITICAL]
---------------------------------------------------------------------------------
RISK  KEY       DESCRIPTION                                            EVIDENCE  
---------------------------------------------------------------------------------
CRIT  net/ddos  Performs DDoS (distributed denial of service) attacks  synflood  
---------------------------------------------------------------------------------

/home/t/packages/x86_64/datadog-agent-oci-compat-7.54/opt/datadog-agent/embedded/share/system-probe/ebpf/co-re/tracer-fentry.o [🚨 CRITICA
L]
RISK  KEY       DESCRIPTION                                            EVIDENCE  
---------------------------------------------------------------------------------
CRIT  net/ddos  Performs DDoS (distributed denial of service) attacks  synflood  
---------------------------------------------------------------------------------

/home/t/packages/x86_64/datadog-agent-oci-compat-7.54/opt/datadog-agent/embedded/share/system-probe/ebpf/co-re/tracer.o [🚨 CRITICAL]
---------------------------------------------------------------------------------
RISK  KEY       DESCRIPTION                                            EVIDENCE  
---------------------------------------------------------------------------------
CRIT  net/ddos  Performs DDoS (distributed denial of service) attacks  synflood  
---------------------------------------------------------------------------------

We should take one of these samples and stick it in the Linux/clean directory. Based on this, my guess is we can add synflood_warned to the exceptions list:

% strings /home/t/packages/x86_64/datadog-agent-oci-compat-7.54/opt/datadog-agent/embedded/share/system-probe/ebpf/co-re/tracer.o |grep synflood
synflood_warned

@egibs
Copy link
Member

egibs commented Jul 2, 2024 •
edited
Loading

Looks like synflood_warned works:


/bincapz # go run . --min-level 3 /opt/datadog-agent/embedded/share/system-probe/ebpf/
/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime/conntrack.c [🔥 HIGH]
------------------------------------------------------------------------------------
RISK  KEY                   DESCRIPTION                       EVIDENCE
------------------------------------------------------------------------------------
HIGH  kernel/symbol/lookup  access unexported kernel symbols  kallsyms_lookup_name
------------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime/offsetguess-test.c [🔥 HIGH]
------------------------------------------------------------------------------------
RISK  KEY                   DESCRIPTION                       EVIDENCE
------------------------------------------------------------------------------------
HIGH  kernel/symbol/lookup  access unexported kernel symbols  kallsyms_lookup_name
------------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime/oom-kill.c [🔥 HIGH]
------------------------------------------------------------------------------------
RISK  KEY                   DESCRIPTION                       EVIDENCE
------------------------------------------------------------------------------------
HIGH  kernel/symbol/lookup  access unexported kernel symbols  kallsyms_lookup_name
------------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime/runtime-security.c [🔥 HIGH]
------------------------------------------------------------------------------------
RISK  KEY                   DESCRIPTION                       EVIDENCE
------------------------------------------------------------------------------------
HIGH  kernel/symbol/lookup  access unexported kernel symbols  kallsyms_lookup_name
------------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime/shared-libraries.c [🔥 HIGH]
------------------------------------------------------------------------------------
RISK  KEY                   DESCRIPTION                       EVIDENCE
------------------------------------------------------------------------------------
HIGH  kernel/symbol/lookup  access unexported kernel symbols  kallsyms_lookup_name
------------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime/tcp-queue-length.c [🔥 HIGH]
------------------------------------------------------------------------------------
RISK  KEY                   DESCRIPTION                       EVIDENCE
------------------------------------------------------------------------------------
HIGH  kernel/symbol/lookup  access unexported kernel symbols  kallsyms_lookup_name
------------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime/tracer.c [🔥 HIGH]
------------------------------------------------------------------------------------
RISK  KEY                   DESCRIPTION                       EVIDENCE
------------------------------------------------------------------------------------
HIGH  kernel/symbol/lookup  access unexported kernel symbols  kallsyms_lookup_name
------------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime/usm.c [🔥 HIGH]
------------------------------------------------------------------------------------
RISK  KEY                   DESCRIPTION                       EVIDENCE
------------------------------------------------------------------------------------
HIGH  kernel/symbol/lookup  access unexported kernel symbols  kallsyms_lookup_name
------------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime-security-fentry.o [🚨 CRITICAL]
-----------------------------------------------------------------------------------
RISK  KEY                        DESCRIPTION                             EVIDENCE
-----------------------------------------------------------------------------------
CRIT  evasion/fake/process/name  Pretends to be a kworker kernel thread  kworker
-----------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime-security-syscall-wrapper.o [🚨 CRITICAL]
-----------------------------------------------------------------------------------
RISK  KEY                        DESCRIPTION                             EVIDENCE
-----------------------------------------------------------------------------------
CRIT  evasion/fake/process/name  Pretends to be a kworker kernel thread  kworker
-----------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime-security.o [🚨 CRITICAL]
-----------------------------------------------------------------------------------
RISK  KEY                        DESCRIPTION                             EVIDENCE
-----------------------------------------------------------------------------------
CRIT  evasion/fake/process/name  Pretends to be a kworker kernel thread  kworker
-----------------------------------------------------------------------------------

/bincapz # go run . --min-level 1 /bincapz/samples/Linux/clean/tracer.o.aarch64
/bincapz/samples/Linux/clean/tracer.o.aarch64 [⚠️ MEDIUM]
------------------------------------------------------------------------------------------------------------------
RISK  KEY                               DESCRIPTION                                          EVIDENCE
------------------------------------------------------------------------------------------------------------------
LOW   kernel/acct                       switch process accounting on or off                  acct
LOW   net/ip/multicast/send             send data to multiple nodes simultaneously           multicast
LOW   net/socket/listen                 listen on a socket                                   accept
                                                                                             listen
                                                                                             socket
LOW   net/socket/receive                receive a message from a socket                      recvmsg
LOW   net/socket/send                   send a message to a socket                           sendmsg
MED   combo/recon/system_network        invasive recon val                                   ip6h.daddr
                                                                                             ip6h.saddr
                                                                                             ip_dynaddr
                                                                                             iph.daddr
                                                                                             iph.saddr
MED   databases/mysql                   accesses MySQL databases                             mysql
MED   net/bpf                           BPF (Berkeley Packet Filter)                         bpf
MED   net/http/post                     submit content to websites                           HTTP
                                                                                             POST
                                                                                             http
MED   net/stat                          Uses 'netstat' for network information               netstats
MED   net/syncookie                     references SYN cookies, used to resist DoS attacks   syncookie
MED   ref/ip_port                       mentions an IP and port                              add_port
                                                                                             dev_port
                                                                                             dsa_port
                                                                                             encap_port
                                                                                             func_ip
                                                                                             garp_port
                                                                                             if_port
                                                                                             local_port
                                                                                             …
MED   ref/words/heartbeat               references a 'heartbeat' - often used by background  tx_heartbeat_errors
                                        daemons
MED   security_controls/linux/iptables  interacts with the iptables/nftables firewall        nftables
------------------------------------------------------------------------------------------------------------------

This was referenced Jul 2, 2024
Merged
Merged
@egibs egibs closed this as completed Jul 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Resolve datadog-agent DDOS false positive egibs/malcontent
2 participants
@tstromberg @egibs