Posted by
Hemos
on from the crushing-them-beneath-your-heel dept.
A reader writes:"There's a story on ZDNet that describes how Theo de Raadt & co. are hoping to eliminate buffer-overrun exploits for good. On closer inspection, it's a scheme to stop a buffer-overrun leading to executable code. It doesn't stop the buffer-overrun itself."
Already slashdotted
by
Anonymous Coward
·
· Score: 3, Informative
Software tweak may make operating systems safer 09:43 Monday 14th April 2003 Robert Lemos, CNET News.com
The OpenBSD project is making changes in its latest operating system release that it believes could eliminate a class of security bugs that has plagued computers for decades
The OpenBSD project hopes new changes to its latest release will eliminate "buffer overflows", a software issue that has been plaguing security experts for more than three decades.
Theo de Raadt, the project leader for the group, believes that the group's latest improvements to the Unix variant, due to be released on 1 May, will make causing a buffer overflow extremely difficult, if not impossible. A buffer overflow is a memory error in software that allows an attacker to run a malicious program.
"I could say that I am killing buffer overflows, but I am in the security community, so I have to put it in quotes," he told attendees at the CanSecWest security show on Thursday.
The memory bugs have resisted extermination for almost 30 years, and de Raadt said that any claims that an open-source group has done so would need to be tested.
Some attendees are already incredulous that the changes will eliminate buffer overflows. "It's just adding another layer" to the security, said Nicolas Fischbach, senior manager for security at Colt Telecom, a European communications provider. "It won't make a huge difference because there are always bugs that are found in software."
An overflow exploit generally works when an attacker sends a program requesting too much information. The data usually includes two components: one that crashes the application and one that's either a program or a memory address that points to a program that the attacker would like to run. When the application crashes due to the first component, the operating system will execute the second.
The OpenBSD team hardened the operating system to this type of attack using three tactics.
The group randomised where in memory the "stack" -- a structure that holds applications and their data -- resides, so that code designed to exploit buffer overflows will have to be tailored to the system's memory layout.
"Buffer overflows take advantage of a certain memory layout," de Raadt said. "It's a tiny waste of memory, with very little overhead, but it makes things a little bit more difficult. We are trying to make the (code) crackers work a little bit more."
In addition, the group restructured how critical addresses are stored on the stack, so that it's harder to get buffer overflows to result in a running program. The team placed a small tag, called a canary, in the memory structure to detect if addresses had been modified, a common method hackers use to get a legitimate program to run malicious code.
Finally, the group found a way to hack the BSD file system and divide main memory into a writable portion and an executable portion. Pieces of programs and data, known as pages, that are stored to memory will be placed into one of the two areas.
"We want to make sure that no page is both executable or writable simultaneously," he said. "The goal is that no hackers should be able to write code and then execute it."
The problem for the OpenBSD group is that while 64-bit processors have such memory protections available, the most-popular 32-bit processors don't. So the group has had to work around the issue and break up a computer's memory into writable and executable areas.
"You can draw a line in the sand -- before that line you can execute, above you can't," de Raadt said.
While the other security features will be available in the 1 May release, the protected memory page structure for 32-bit processors -- such as Intel x86 chips and the PowerPC chips -- won't be ready for another six months, he said.
The research was funded by a $2.3m (about £1.5m) grant from the Defense Advanced Research Projects Agency (DARPA) to the OpenBSD Project, but the latest changes go be
Includes ProPolice
by
dwheeler
·
· Score: 4, Informative
The buffer overflow work is based on StackGuard,
which was originally developed as a gcc extension
and tried out in Immunix (a Linux distribution).
However, instead of StackGuard, they're using
IBM's ProPolice. ProPolice implements the same
basic idea, but the patch itself works more cleanly
across CPU architectures. Also, ProPolice has
a simple optimization - it only enables the
canary protection if the function has a
char (like) array. This is a heuristic, but
a reasonable one - most buffer overflow attacks
exploit such arrays, and by doing this
ProPolice has a lower performance overhead
(without losing much in the way of protection).
Libsafe only protects a few built-in functions;
it's not a bad idea, but it's FAR less
effective than StackGuard or ProPolice.
The Openwall kernel patch is actually a
collection of nifty capabilities.
The "no executable stack" option is probably
what you mean, but it turns out that there's
a trivial way around it... so that part is
only effective BECAUSE few people use it.
Openwall has other stuff that's nice, though.
I think the reason these capabilities aren't
in use everywhere (yet) is the
conservatism of most distributions.
Many distributions worry about any performance
loss or compatibility loss. OpenBSD's
primary focus is on security, so losing
performance or backwards compatibility is
not as serious an issue for them.
I have hopes that these features will become
more mainstream.
better yet, strlcpy and strlcat and their brethren. they're becoming more common on more and more platforms. solaris has them.
-- vodka, straight up, thank you!
Mandrake has provided these for a while
by
OneInEveryCrowd
·
· Score: 2, Informative
The Mandrake distribution provides the Grsecurity package in 9.1. Prior to that they had the openwall patch with some others. These aren't in the standard kernel but you can compile them in yourself or use the kernel-secure rpm. The libsafe package has been provided at least since 8.1, all you have to do is type "urpmi libsafe". Libsafe used to break the hardware clock reset feature in the shutdown scripts but they may have fixed it.
I used all this stuff in Mandrake 8.1 and there was a noticeable performance hit in some situations but I left in it anyway.
Re:buffer over flow exploits not truly eliminated
by
cdn-programmer
·
· Score: 2, Informative
I think you are mistaken. They have put in "canary" values in the call. The function prologue and epilog code has been modified. What happens is that there is a random value placed essentually as an "extra" parameter in the call. When the function does a return this value is tested and if the value has changed then the function stops instead of returning. Yes a DOS is still possible but you cannot smash the stack and expect to succeed.
The reason you cannot smash the stack is that when you overflow it you have no way of knowing what the canary value is, so the function will stop before it even executes the altered return.
Its a very good and painless feature and one that adds a MINIMAL amount of overhead.
IMHO the explaination that is quoted is misleading or just plain rong. I have never heard of a crash being able to cause an operating system to "execute the second". Well - perhaps in a debugger... but in the case of a debugger we are not in a normal environment.
Slashdot Mirror
Read this.
Software tweak may make operating systems safer
09:43 Monday 14th April 2003
Robert Lemos, CNET News.com
The OpenBSD project is making changes in its latest operating system release that it believes could eliminate a class of security bugs that has plagued computers for decades
The OpenBSD project hopes new changes to its latest release will eliminate "buffer overflows", a software issue that has been plaguing security experts for more than three decades.
Theo de Raadt, the project leader for the group, believes that the group's latest improvements to the Unix variant, due to be released on 1 May, will make causing a buffer overflow extremely difficult, if not impossible. A buffer overflow is a memory error in software that allows an attacker to run a malicious program.
"I could say that I am killing buffer overflows, but I am in the security community, so I have to put it in quotes," he told attendees at the CanSecWest security show on Thursday.
The memory bugs have resisted extermination for almost 30 years, and de Raadt said that any claims that an open-source group has done so would need to be tested.
Some attendees are already incredulous that the changes will eliminate buffer overflows. "It's just adding another layer" to the security, said Nicolas Fischbach, senior manager for security at Colt Telecom, a European communications provider. "It won't make a huge difference because there are always bugs that are found in software."
An overflow exploit generally works when an attacker sends a program requesting too much information. The data usually includes two components: one that crashes the application and one that's either a program or a memory address that points to a program that the attacker would like to run. When the application crashes due to the first component, the operating system will execute the second.
The OpenBSD team hardened the operating system to this type of attack using three tactics.
The group randomised where in memory the "stack" -- a structure that holds applications and their data -- resides, so that code designed to exploit buffer overflows will have to be tailored to the system's memory layout.
"Buffer overflows take advantage of a certain memory layout," de Raadt said. "It's a tiny waste of memory, with very little overhead, but it makes things a little bit more difficult. We are trying to make the (code) crackers work a little bit more."
In addition, the group restructured how critical addresses are stored on the stack, so that it's harder to get buffer overflows to result in a running program. The team placed a small tag, called a canary, in the memory structure to detect if addresses had been modified, a common method hackers use to get a legitimate program to run malicious code.
Finally, the group found a way to hack the BSD file system and divide main memory into a writable portion and an executable portion. Pieces of programs and data, known as pages, that are stored to memory will be placed into one of the two areas.
"We want to make sure that no page is both executable or writable simultaneously," he said. "The goal is that no hackers should be able to write code and then execute it."
The problem for the OpenBSD group is that while 64-bit processors have such memory protections available, the most-popular 32-bit processors don't. So the group has had to work around the issue and break up a computer's memory into writable and executable areas.
"You can draw a line in the sand -- before that line you can execute, above you can't," de Raadt said.
While the other security features will be available in the 1 May release, the protected memory page structure for 32-bit processors -- such as Intel x86 chips and the PowerPC chips -- won't be ready for another six months, he said.
The research was funded by a $2.3m (about £1.5m) grant from the Defense Advanced Research Projects Agency (DARPA) to the OpenBSD Project, but the latest changes go be
Libsafe only protects a few built-in functions; it's not a bad idea, but it's FAR less effective than StackGuard or ProPolice. The Openwall kernel patch is actually a collection of nifty capabilities. The "no executable stack" option is probably what you mean, but it turns out that there's a trivial way around it... so that part is only effective BECAUSE few people use it. Openwall has other stuff that's nice, though.
I think the reason these capabilities aren't in use everywhere (yet) is the conservatism of most distributions. Many distributions worry about any performance loss or compatibility loss. OpenBSD's primary focus is on security, so losing performance or backwards compatibility is not as serious an issue for them. I have hopes that these features will become more mainstream.
- David A. Wheeler (see my Secure Programming HOWTO)
better yet, strlcpy and strlcat and their brethren. they're becoming more common on more and more platforms. solaris has them.
vodka, straight up, thank you!
The Mandrake distribution provides the Grsecurity package in 9.1. Prior to that they had the openwall patch with some others. These aren't in the standard kernel but you can compile them in yourself or use the kernel-secure rpm. The libsafe package has been provided at least since 8.1, all you have to do is type "urpmi libsafe". Libsafe used to break the hardware clock reset feature in the shutdown scripts but they may have fixed it.
I used all this stuff in Mandrake 8.1 and there was a noticeable performance hit in some situations but I left in it anyway.
I think you are mistaken. They have put in "canary" values in the call. The function prologue and epilog code has been modified. What happens is that there is a random value placed essentually as an "extra" parameter in the call. When the function does a return this value is tested and if the value has changed then the function stops instead of returning. Yes a DOS is still possible but you cannot smash the stack and expect to succeed.
The reason you cannot smash the stack is that when you overflow it you have no way of knowing what the canary value is, so the function will stop before it even executes the altered return.
Its a very good and painless feature and one that adds a MINIMAL amount of overhead.
IMHO the explaination that is quoted is misleading or just plain rong. I have never heard of a crash being able to cause an operating system to "execute the second". Well - perhaps in a debugger... but in the case of a debugger we are not in a normal environment.