eBPF sock_ops and fake TLS ClientHello PoC shows new path to fool DPI

What surfaced

It has been reported that a proof-of-concept project on GitHub (gecit by boratanrikulu) demonstrates a way to evade deep packet inspection (DPI) by using Linux eBPF sock_ops to inject a fake TLS ClientHello. The code, discussed on Lobsters and published openly, uses in-kernel hooks to present a forged handshake to middleboxes while the real client traffic continues — a clever bit of sleight-of-hand that targets how many DPI systems identify TLS flows.

How the trick works, in plain language

At a high level the PoC leverages eBPF’s ability to run small programs in the kernel and intercept socket operations. By injecting or modifying the initial ClientHello that a DPI appliance sees, the attacker can change fingerprints (JA3-style signatures) or hide SNI information, allegedly causing the middlebox to misclassify or ignore the connection. The magic (and the danger) is that this happens at kernel level, so the visible handshake can be decoupled from what the user-space application actually sends — tricky to spot if you’re only looking at the network stream.

Why defenders should care

This is a reminder that eBPF, a feature once celebrated for observability and performance, is also an expanding attack surface. Kernel-level manipulation breaks assumptions baked into many network defenses: if the “first hello” can be forged, DPI heuristics that rely on that hello become brittle. Network operators should watch for mismatches between observed ClientHello fingerprints and subsequent TLS behavior; vendors should consider countermeasures and stricter eBPF policy controls. It has been reported that the author’s repo is public — whether disclosures to affected vendors happened first is not clear — and that uncertainty is the very uncomfortable part.

The bigger picture

So what now? Tighten the ship or accept an awkward truth: powerful tools invite creative abuse. This PoC isn’t just another exploit write-up — it’s a wake-up call about trusting what the kernel tells you. For operators and kernel watchers alike, the question isn’t if there will be more of these techniques, but how quickly defenses and policy frameworks adapt. See the repository and discussion here: https://github.com/boratanrikulu/gecit (discussion on Lobsters linked from that thread).

Sources: github.com/boratanrikulu, Lobsters