Open & Secure: Novel Sandboxing Technique for Any Open Source Library

Open & Secure: Novel Sandboxing Technique for Any Open Source Library

Speakers: Gal Elbaz, CTO, Oligo Security

Conference: BSides NYC

YouTube: https://www.youtube.com/watch?v=U0j6V1CDLV4

Overview

In this compelling talk at BSides NYC, Gal Elbaz, CTO and co-founder of Oligo Security, unveiled a groundbreaking approach to securing the ubiquitous world of open-source software. The presentation, titled "Open & Secure: Novel Sandboxing Technique for Any Open Source Library," addresses a critical vulnerability in modern application development: the inherent trust placed in third-party code. Elbaz highlights how a single vulnerability in an open-source package can grant an attacker full control over an application, simply because these libraries inherit all of the host application's permissions.

Elbaz, drawing from his extensive background leading Checkpoint's research group and discovering zero-days (including a notable Instagram hack), argues that current security paradigms—both "shift-left" (pre-deployment scanning) and "shift-right" (runtime protection)—fall short in addressing this nuanced problem. The core of his proposed solution involves a novel sandboxing technique leveraging eBPF (Extended Berkeley Packet Filter) to monitor and control the behavior of open-source libraries at runtime, without sacrificing performance or stability. This innovative method aims to redefine how organizations protect against zero-day exploits and "shadow vulnerabilities" that traditional tools often miss.

The talk provides a deep dive into the capabilities of eBPF, explaining how this powerful kernel technology can be harnessed to create a robust, non-intrusive security layer. By establishing a behavioral baseline for open-source components, the system can detect and prevent any deviation in real-time, effectively creating a sandbox around each library. This paradigm shift offers a promising path forward for securing the 90% of production applications now composed of open-source software, moving beyond reactive, signature-based defenses to a proactive, behavior-driven model.

Background

▶ Watch: Introduction and speaker's background (0:00)

The landscape of modern software development is overwhelmingly dominated by open-source software (OSS), with Elbaz stating that 90% of production applications are built upon it. While this reliance accelerates development and innovation, it also introduces significant security risks. Traditionally, the industry has attempted to mitigate these risks through two primary approaches: "shift-left" and "shift-right" security.

The shift-left approach, originating in the 1990s with IBM, focuses on identifying vulnerabilities early in the software development lifecycle. This involves scanning repositories, analyzing dependencies, and checking for known risks. However, Elbaz argues that this approach often generates excessive noise and "theoretical risk," making it difficult for security teams to identify actual exploitable vulnerabilities amidst a sea of alerts. The sheer volume of sub-dependencies and inherited risks creates a "needle in a haystack" problem, failing to provide clear, actionable intelligence on real attack vectors.

The limitations of shift-left led to a renewed emphasis on shift-right security, aiming to protect applications in runtime. Early attempts included Runtime Application Self-Protection (RASP) solutions. RASP involved instrumenting running applications with code designed to monitor and block malicious activity. However, RASP largely failed due to critical drawbacks:

1. Stability Issues: Injecting code into a running application frequently led to crashes and harmed application stability.
2. Performance Overhead: RASP solutions often introduced significant performance degradation, consuming excessive resources.
3. Deployment Friction: They required deep developer expertise, were often tied to specific application repositories, and proved difficult to deploy and maintain at scale.

Beyond RASP, other runtime security tools have emerged. Network security tools like Web Application Firewalls (WAFs) and API security solutions operate at the network perimeter, protecting applications from external threats. However, they lack visibility into the internal workings of an application. Similarly, Host Intrusion Detection Systems (HIDS) and traditional antiviruses monitor processes at the operating system level, but they are "not aware to the app level." As Elbaz succinctly puts it, these tools don't know "whether a process is running Java or Python or Go or Node."

This fundamental lack of application-level awareness was dramatically exposed by events like Log4Shell, which Elbaz describes as "the biggest hack in history." Log4Shell, a critical vulnerability in a single open-source library, bypassed network and host-level defenses because the attack occurred inside the application. This incident underscored a profound gap: existing security tools could not effectively block attacks stemming from compromised open-source components at the application layer, highlighting the urgent need for a new, non-intrusive, and application-aware protection mechanism.

Key Findings

▶ Watch: Open source libraries inherit all application permissions (0:40)

The central finding presented by Gal Elbaz is that eBPF (Extended Berkeley Packet Filter) offers a revolutionary technological foundation for achieving non-intrusive, performant, and stable runtime application protection. This capability directly addresses the shortcomings of previous runtime security solutions like RASP and the blind spots of network and host-based defenses.

Elbaz and Oligo Security's core contribution is the development of a novel sandboxing technique built upon eBPF that can effectively monitor and control any open-source library. This technique involves:

1. Behavioral Baselining: Creating a "knowledge base of how open source libraries should behave" by profiling their normal execution patterns in various environments over time. This leverages "the network effect and crowd wisdom" to establish expected behaviors.
2. Real-time Deviation Detection: Using eBPF to observe the live execution of libraries and detect any "deviation in real time" from their established baseline.
3. Preventative Measures: The ability not only to observe but also to block malicious actions, effectively sandboxing the library.

This approach delivers several key benefits:

• Zero-Day and Shadow Vulnerability Detection: It can detect attacks exploiting unknown vulnerabilities (zero-days) or "shadow vulnerabilities" (insecure by design libraries, backdoors) without requiring prior knowledge, signatures, or CVEs. The example of the XZ Backdoor demonstrates this capability, where the system could detect a compression library executing arbitrary code simply because it deviated from its expected compression-only behavior.
• Non-Intrusive and Stable: By operating within the kernel via eBPF's safe-by-design architecture, the solution avoids the stability and performance issues that plagued RASP. It monitors applications without requiring code changes, reboots, or significant overhead.
• Granular Application-Level Visibility: Unlike network or host-level tools, eBPF allows for deep insight into application-specific events, bridging the gap between kernel operations and user-space application logic.
• Scalability and Deployability: Leveraging the ubiquitous nature of Linux and eBPF's efficiency, the solution is designed for production-grade, scalable deployment with minimal developer friction.

In essence, Elbaz proposes that eBPF revives the promise of runtime application protection by providing the "much better technology" needed to make it seamless, frictionless, stable, and comprehensive, ultimately enabling a new form of "sandboxing open source libraries" that fundamentally changes the game for application security.

Technical Deep Dive

▶ Watch: Inefficiency and noise of traditional 'shift-left' scanning (2:00)

The technical core of Elbaz's proposed solution lies in eBPF (Extended Berkeley Packet Filter), which he describes as "much more than just a buzzword" and "the answer to all of that" for modern runtime protection challenges.

What is eBPF?

Originating in 1990 as BPF (Berkeley Packet Filter) for network packet filtering (famously used by tools like TCPdump and Wireshark), eBPF is its "extended" successor. It represents a revolutionary shift, effectively creating a new programming language within the Linux kernel. This language allows users to safely and dynamically extend the kernel's capabilities without modifying kernel source code or loading traditional kernel modules. Elbaz highlights its significance by stating it "completely replaced what we all know as kernel drivers."

Key Characteristics of eBPF:

• Safe by Design: This is a paramount feature. The eBPF verifier is a critical component that statically analyzes eBPF programs before they are loaded into the kernel. It ensures programs:
• Do not access invalid memory.
• Do not enter infinite loops, which could block or crash the kernel.
• Adhere to basic security guidelines, preventing system hangs or instability.

This safety mechanism directly addresses the stability issues that plagued previous runtime solutions like RASP. Elbaz references the 2023 CloudStack outage, attributed to a kernel driver bug, as a stark reminder of the risks eBPF mitigates, quoting Brendan Gregg's "No more Blue Fridays."

• Dynamic and Ubiquitous: eBPF is present on "every Linux machine out there," allowing dynamic hooking into specific places in the OS without requiring reboots or application restarts.
• High Performance: eBPF programs execute directly within the kernel, benefiting from:
• Just-In-Time (JIT) Compilation: Programs are compiled into native machine code for optimal execution speed.
• No Context Switches: Operating in the kernel context eliminates the overhead of switching between user and kernel space, resulting in "very low latency." This efficiency makes it suitable for "production scale grade" monitoring.
• Widespread Adoption: Major tech companies like Google (for security), Meta (network security, load balancing), and Netflix (performance monitoring in AWS) are already leveraging eBPF in production environments, demonstrating its maturity and reliability.

eBPF Probes and Observability:

eBPF offers an astonishing level of visibility into the operating system. There are over 120,000 different probes across the Linux kernel that can be observed dynamically. These probes cover virtually every aspect of system operation, including:

• System Calls (syscalls): The primary mechanism for user-mode processes to interact with the kernel. eBPF can hook before (sys_enter) or after (sys_exit) a syscall. Attackers "cannot avoid doing system calls" to interact with the host, making them a crucial monitoring point. However, Elbaz notes that "not all system calls were born equally," and simply observing syscalls doesn't reveal enough about application-level behavior.
• IO Events, Sockets, Networking (UDP, TCP), Memory Access, Context Switches: A comprehensive array of kernel events.
• User Statically Defined Tracing (USDT): This allows for gaining visibility into the application level by hooking into predefined points within user-space code, provided the code is instrumented with these symbols. Elbaz gives examples of observing Python exec calls or internal function entries.
• Express Data Path (XDP): A specialized eBPF mode that runs directly on the network card itself, allowing for processing and dropping raw packets before they even reach the Linux network stack. This enables extremely efficient network security, used by companies like Celium for firewalls and routers, and CloudFlare for data protection. XDP IP tables can "slap the packet, don't let it in," significantly reducing compute requirements compared to processing packets on the host.

Challenges and eBPF for Security:

Despite its power, eBPF is a programming language, and building robust applications with it presents challenges:

• Proficiency in Linux Kernel: It requires expertise in Linux internals and the eBPF ecosystem.
• Production-Grade Development: Moving from simple observation to a scalable, production-grade security product that doesn't impact performance is complex. Elbaz highlights Brendan Gregg's distinction: "performance tools are not security tools." He cites Astrace, a fundamental Linux performance tool, which has a 10-year-old bug demonstrating that tracing processes can significantly slow them down, making it unsuitable for production security.

However, a significant trend is emerging in using eBPF for security. Tools like Falco (by Sysdig) and Tetragon (by Isovalent) are at the forefront. A particularly powerful development is KRSI (Kernel Runtime Security Instrumentation), which combines eBPF with LSM (Linux Security Modules), the underlying mechanism for enforcement tools like SELinux and AppArmor. This allows eBPF not just to observe but also to block and take preventative measures, leveraging around 200 security-designated hooks inside the kernel.

Elbaz illustrates the potential with examples: monitoring every exec syscall, counting network packets, or even reading arbitrary memory within an application like Firefox to observe "plain text HTTP bytes" before they are executed. This level of granular, in-kernel visibility enables the creation of highly efficient and application-aware security controls, far beyond what traditional WAFs or HIDS can achieve.

The ultimate application of this technical capability, as presented by Elbaz, is the ability to build a behavioral baseline for open-source libraries. By profiling "the same pieces of code at enough environment for enough time," a robust understanding of normal behavior can be formed. Any deviation from this baseline—such as a compression library suddenly attempting to execute system commands—can then be detected and blocked in real-time, regardless of whether a CVE exists or the vulnerability is a known zero-day.

Demo / Proof of Concept

▶ Watch: Historical failures: RASP, WAF, and HIDS limitations (4:00)

While the speaker mentioned a planned live demonstration of an exploit, he regretfully noted that time constraints prevented it from being shown during the talk. However, the core proof of concept for the proposed eBPF-based sandboxing technique was thoroughly illustrated through the analysis of a real-world, high-impact zero-day event: the XZ Backdoor.

The XZ Backdoor, discovered in March 2024, was a sophisticated supply chain attack that nearly compromised most Linux distributions. It involved malicious code injected into the XZ Utils data compression library, specifically targeting a sub-library called liblzma. This backdoor was designed to execute arbitrary system commands, granting unauthorized remote access.

Elbaz explained how his eBPF-based approach could have detected this attack without any prior knowledge, specific rules, or signatures. The core principle is behavioral anomaly detection: a compression library like liblzma is expected to perform compression-related tasks. Its normal behavior does not include invoking system commands or attempting to execute external code. By establishing a behavioral baseline for liblzma through eBPF profiling, any attempt by the library to perform an exec system call would be flagged as a critical deviation.

Therefore, the system would have identified that the liblzma library, whose expected function is "only compress files," was "suddenly it executes code." This detection would occur "without being aware of the attack, without even having any rules or special stuff in order to detect it, and even without being aware of it." The ability to detect such a sophisticated attack purely by observing the library's runtime behavior, irrespective of CVEs or traditional threat intelligence, serves as a powerful testament to the efficacy of this novel sandboxing technique.

Defensive Implications

▶ Watch: Log4Shell: The catalyst for a new runtime solution (6:00)

The novel sandboxing technique leveraging eBPF, as presented by Gal Elbaz, offers profound defensive implications for organizations grappling with the complexities of open-source software security. It fundamentally shifts the paradigm from reactive, signature-based defenses to proactive, behavior-driven protection, particularly for the critical and often overlooked risks within third-party libraries.

1. Proactive Zero-Day and Shadow Vulnerability Protection: The most significant implication is the ability to defend against zero-day exploits and "shadow vulnerabilities" (insecure-by-design components, backdoors, or logic flaws without CVEs) without requiring prior knowledge or signatures. By baselining the expected behavior of every open-source library, security teams can detect and prevent malicious activities the moment they occur, even if the vulnerability is brand new or deeply hidden within the code. This moves organizations beyond the constant race to patch known CVEs.

1. Reduced Alert Fatigue and Improved Signal-to-Noise Ratio: Traditional "shift-left" tools like SCA (Software Composition Analysis) and SAST (Static Application Security Testing) often generate a high volume of alerts, many of which represent theoretical or non-exploitable risks. By focusing on actual runtime behavior and deviations, this eBPF-based approach provides a much clearer signal, highlighting only the activities that genuinely indicate an active compromise or malicious intent. This can significantly reduce alert fatigue for security teams.

1. Application-Level Sandboxing for Open Source: This technique effectively creates a runtime sandbox around individual open-source components. Instead of relying on the application's overall permissions, each library's interactions with the operating system and other components are constrained to its known, benign behavior. This limits the blast radius of a compromised library, preventing it from escalating privileges or executing arbitrary commands beyond its intended function.

1. Non-Intrusive and Performant Runtime Protection: The eBPF foundation ensures that this runtime protection is both highly stable and performant. Unlike previous RASP solutions that often introduced instability and significant overhead, eBPF operates in the kernel without modifying application code, requiring reboots, or causing noticeable performance degradation. This makes it viable for widespread deployment in production environments.

1. Enhanced Supply Chain Security: Given the increasing sophistication of supply chain attacks (like the XZ Backdoor), this solution provides a critical layer of defense. By monitoring the runtime behavior of all third-party components, organizations can detect if a seemingly benign library has been tampered with or contains malicious implants that alter its intended functionality.

1. Granular Visibility and Enforcement: Defenders gain unprecedented granular visibility into how open-source libraries interact with the kernel, file system, network, and other processes. Coupled with eBPF's ability to enforce policies via LSMs, this allows for precise control, enabling security teams to block specific malicious actions while allowing legitimate operations to proceed.

In essence, this novel eBPF-driven sandboxing technique empowers defenders to regain control over the open-source components within their applications. It offers a scalable, stable, and highly effective mechanism to protect against the most advanced and insidious threats, moving application security from a reactive patching cycle to a proactive, behavioral defense posture.

Key Takeaways

• Traditional application security models, including "shift-left" static analysis and "shift-right" network/host-based defenses (like WAFs and HIDS), are insufficient to protect against runtime exploits within open-source libraries, as demonstrated by incidents like Log4Shell.
• Previous attempts at runtime application self-protection (RASP) largely failed due to stability issues, performance overhead, and deployment friction, highlighting the need for a fundamentally better technology.
• eBPF (Extended Berkeley Packet Filter) provides a robust, non-intrusive, and high-performance mechanism for monitoring and controlling application behavior directly within the Linux kernel, without requiring code modifications or system reboots.
• A novel sandboxing technique leverages eBPF to profile the expected behavior of open-source libraries, creating a "knowledge base" against which real-time activity can be compared to detect deviations.
• This behavioral anomaly detection allows for the proactive identification and prevention of zero-day exploits, "shadow vulnerabilities," and backdoors (such as the XZ Backdoor) even without prior CVEs or threat intelligence.
• The approach offers a scalable, stable, and granular application-level security layer, effectively sandboxing open-source components to limit the blast radius of a compromise and providing a significant defensive advantage against modern supply chain attacks.

About the Speaker(s)

Gal Elbaz is the co-founder and CTO of Oligo Security, a company focused on securing open-source software. With a background in building and "baking software," Elbaz spent the past decade leading the research group at Checkpoint, a prominent cybersecurity company. During his tenure at Checkpoint, he specialized in discovering zero-day vulnerabilities, famously recounting an instance where he "hacked Instagram" using a single vulnerability in an open-source package. This experience profoundly shaped his understanding of the critical risks posed by open-source dependencies and motivated his work at Oligo Security to develop innovative runtime protection solutions.