Slashdot Mirror
HardenedBSD Completes Strong ASLR Implementation
New submitter HardenedBSD writes: A relatively new fork of FreeBSD, HardenedBSD, has completed its Address Space Layout Randomization (ASLR) feature. Without ASLR, applications are loaded into memory in a deterministic manner. An attacker who knows where a vulnerability lies in memory can reliably exploit that vulnerability to manipulate the application into doing the attacker's bidding. ASLR removes the determinism, making it so that even if an attacker knows that a vulnerability exists, he doesn't know where that vulnerability lies in memory. HardenedBSD's particular implementation of ASLR is the strongest form ever implemented in any of the BSDs.
The next step is to update documentation and submit updates to the patches they have already submitted upstream to FreeBSD. ASLR is the first step in a long list of exploit mitigation technologies HardenedBSD plans to implement.
The next step is to update documentation and submit updates to the patches they have already submitted upstream to FreeBSD. ASLR is the first step in a long list of exploit mitigation technologies HardenedBSD plans to implement.
That's always my next step too
Pretty cool stuff. Nice to see more distros do this stuff. Personally I'm using openbsd for all my work these days because they have pretty much all these things turned on (and have had them for a long time)
Wouldn't it be easier to just import OpenBSD's implementation?
Adamantix over 10 years ago but got silent after version 2 or so. Tried to find their soure recently- impossible. Would have been great to get it to current HW compatibility. End of old story.
I believe OpenBSD already added this functionality. Yer or two ago. How is this implementation better than theirs?
My big question now...
Can I still run the debugger on running binaries, or does the debugger now need work done on it?
Same question, but for core dumps.
Perhaps they should call it "Getting Hard BSD".
Stasis is death. Embrace change.
The next step is to update documentation and submit updates to the patches they have already submitted upstream to FreeBSD
I don't understand what this has to do with videos of whispering women.
If this gets ported to FreeBSD I say hurrah and many thanks to HardenedBSD!
register and log in then maybe you'll be listened to - what are you scared of?
"The hands that help are better far than lips that pray." - Robert Ingersoll (1833-1899)
It took you more time to explain why you don't want an account that it'd have taken for you to make one. As for logging in every time, how about, I dunno, keeping your account logged in?
Conservatism: (n.) love of the existing evils. Liberalism: (n.) desire to substitute new evils for the existing ones.
Even if that's true there are a lot of exploits out there that can't deliver more than a few bytes of machine code.
You can't exploit stuff with less than say 100 bytes of code if you don't even have the offsets for functions that you need to call. You can with less than 30 bytes if You do(eg, socket, fork, some io).
It's not just a tick in the box.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion. -- Spazmania (174582)
I'd like to see it make it to PC-BSD. 11 maybe?
If you can read the address space you can defeat ASLR
Ohh, you mean segfault when you read unallocated memory? Even if you could, are you planning to read all 8,589,934,592GiB of the address space? with O(n) scaling, assuming a crazy low 1 clock cycle per address, it would take you about 35 years to scan the entire 2^63 user virtual address space at 4ghz.
I am not saying ASLR is perfect, I'm just saying it's not nearly as simple as you make it out to be.
PC-BSD is just a thin wrapper of scripts, wizards, and some decent tools over FreeBSD. You can upgrade and downgrade to/from PC-BSD/FreeBSD.
PC-BSD occasionally picks some patches to apply on top of a stock FreeBSD, but they try to keep it fairly small. I suspect that they're unlikely to pick up these for several reasons. First, there are still some random segfaults in applications caused by these patches that are not yet diagnosed. Second, the HardenedBSD team doesn't have a great track record for security, for example merging some insecure random number generator patches that were under review for FreeBSD and rejected over security issues and shipping them in production. Third, since the Blind ROP work from Stanford, ASLR is largely discredited as a security feature - it's a nice checkbox feature, but it doesn't really buy you much against a determined attacker. Fourth, the last iteration of the patches still had some very odd decisions about the interfaces for turning ASLR on and off (they also had a number of lock-order reversals, which are hopefully fixed in the latest version).
I am TheRaven on Soylent News
Read this paper if you want to know how easy it is.
I am TheRaven on Soylent News
From the documentation in the handbooks, I'm left w/ the impression that PC-BSD is what you get the moment you want X11 on top of FreeBSD. Or is there more to it than that?
mine stays logged in, no need to keep logging in. i think you don't want your opinions tracked. if you registered, logged in and posted (umlimited posts) we'd know if you are a troll or not.
"The hands that help are better far than lips that pray." - Robert Ingersoll (1833-1899)
BROP doesn't work against a proper ASLR implementation
Define 'proper'. Re-randomisation after every fork()? Good luck with that. PLTs at random offsets? Sure, if you're willing to pay the overhead of not being able to share any position-independent code between processes.
I am TheRaven on Soylent News