On: Capturing Linux SSL/TLS plaintext without a CA cer...

[tptacek]

Deep instrumentation of running binaries, especially the kernel, and packet manipulation.

[SEJeff → tptacek]

Let’s not forget syscall filtering. Using custom eBPF for what is in effect a syscall firewall is something my coworkers did for one of our clients and it’s really slick. It’s like super seccomp.