Omar alzhrani
student
umm-alqura
Omar Alzhrani is a Computer Science student at Umm Al-Qura University with a passion for offensive security and low-level system design. Valuing practical skills over certifications, he is currently pursuing the CPTS to deepen his technical expertise. His journey through Rust, C, and networking led to the creation of "Arkenar," a public network scanner. Expanding into eBPF, he then developed "Hakam," an ambitious kernel-level firewall. Recognizing a gap in low-level security tools within the Saudi cyber landscape, Omar is dedicated to bridging kernel engineering with penetration testing, proudly remaining on a path of continuous learning.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
Hakam: A Kernel-Level eBPF Firewall for Single Hosts
"Assume breach" is the baseline posture in modern networks, but enforcing policy inside a host typically forces a choice: classic packet filters lack process context, while platforms that provide both are complex cluster infrastructure requiring an orchestrator and agents. Hakam takes the opposite approach. It is a single-host, single-binary eBPF firewall written in Rust, small enough to read end-to-end, layering three kernel enforcement points:
1-The wire: An XDP program drops blocklisted sources at the driver hook before sk_buff allocation, achieving a p50 48ns drop latency.
2-The syscall: A BPF-LSM hook on socket_connect returns EPERM on violating outbound connections inside the kernel. A reverse shell dies at connect(), before a packet exists.
3-The process: A sys_enter_connect tracepoint correlates blocks to the originating PID and process name.
A userspace engine closes the loop by matching TCP segments against 202 signatures (via an Aho-Corasick automaton), pushing hits into the kernel blocklist. Attendees will see the full loop live: an attack dropped at XDP, attributed to its process, and an exfiltration attempt denied at the syscall—one binary, one host, no orchestration.
- 16:20
- Tue
- 01 Dec
Stage:
Arsenal 3
Sessions Type:
Keynote