Bestand wählen

Introducing ASLR in FreeBSD

Zitierlink des Filmsegments
Embed Code

Automatisierte Medienanalyse

Erkannte Entitäten
on the card but if you projects and the and is a lot is 1 of the projects that we took on on and what people are joining
in 4 people are still found in my followed have egotistical moments and the talk was about me on my mobile big fans sauce 1 9 8 started learning how programme was like 12 were so I'd and have a computer on the a road in sealed like a piece of paper anything release of and so did my code of but I'm a big fan of open sauce from England guy computer family got on Monday of look at me look at other people sauce code and mothers of the help of a pile of previous teensiest tests on great technologies and previously 0 fesses amazing from such a found ways of best player to have a running on my will never looked on which can sell makes it a little bit slow but it works on and passion about security for the 1st time idealised house like 14 and I'd spent the whole want convinced parents that we need a 50 dialup and we don't online music free trial of parallel found out about men 0 and Senate 0 and you know they provide free dial service they did at the time but they had made it so that you had to instal address system so that it would be a programme that could displays just a little rectangular image with add unlike did this takes up a lot of my purchased Alabama icon deal with it and so my 1st experience with security was downloading and exited the and looking at how of the strings and the hell of the style of a program authenticated and and gripping through using streams to look at all the although 800 Delap numbers so I didn't have to call on distant either and and so it found out how would numbers that uses and how it authenticates with the service and the and the script in my own world Delap connexions clients so that they would have to use a at work so that was profound on my submitted few patches to free I on by far a sell are is the biggest honour and maintain a review previously ports of mainly dealing with Giles and go and and triple and the author of live hijacked a hat that the had a stroke last year last year about a on its a tool that makes a shirt library demands Runtime crosses infection easy on Wednesday previously on this is a pretty cool tool on inject Chalco the game as little as 8 lines of see on spring if the 1 my friends right now spotting are free linux usually hopefully we'll get a will use with hijacked for a lot of security things on entry places on Blue disclaimers on the 4th side have to put to to satisfy the legal Department on many things but ideas tools for global below their flight only Ansel tracks not any my previous employers my current employers were future employer so I'm sure on my own for i am representing celebrates here today because they don't have Hobbiton project donated resources the critical
Soaring Israel start off with a few definitions are going to start off with a try to get on the same page with with what a celery is in the history behind it on the volley and talk about previously secret strength and the weakness is things need to be approved by Narina talk about what we can learn from other because previous is pre match the last and a price operating system to implement a sort on and so we have been Ecopa tunity to learn from the strength and mistakes of others the number to talk about how we've implemented is a large and very kind of high levels of detail because I've only of 45 minutes on a nasal alatas but they saw touches quite a few different places in the system in the sauce code by don't have the time to go in depth and by a man scheme to files modified and and what we do and and talk about how to use a Islam previously and what used to happen next like a lifetime high did sacrifice 3 point 5 its to them about and the Gobi was bought
on the sofa definitions on security its would Sony amount talks have in common is that the really securities just and and onion that made up of ever increasing layers and the more layers you have the more time and resources to the taking to successfully expletive system so we have many different players among those laser different explanation technologies techniques and and and explain occasion technique is a method or take techniques prevent the successful expectation of secret vulnerability Howard computer 7 millions among the millions of lines of code and these all these programs tens of the dozens of programs hundreds of programmes we're are computer and we don't know where the vulnerabilities life but in attack a dedicated Taqa's going to use whatever means possible to to publish on a box and so on next explain occasion technologies allow you to securing the system from the and unknown at least help in On and giving you more time to be able to dress security ability is a as it is is 1 such explicated the technology is addressed base-layer randomisation so a happens this without a as a lot on your application that you want around like Foxford sample said the operating system Eichstatt to below loaded at this address my dated here Imedi here if it's not here I'm in a crash and so on so you programs loaded and and deterministic way so authors of allowable function and there is a peace deal that an attackers interested in either vulnerable function or passwords Stoughton memory a Social Security number critic for a number of whatever it is that the attack knows exactly how to reach that point and memory and trigger that vulnerability ways are does as it randomizes where the programme and its dependencies are loaded and memory the attack or doesn't know detected knows that there is a vulnerability but it he doesn't know where memories are so the programme like far Fox saying for example will tell the operates a stoppage Ikon below that loaded anywhere memory that's fine of my data can be loaded anywhere in memory on the PC to interest only were unloaded and and will make amends so a are held protect against a very low level of attacks buffer overflows return to lives in New makes that with like for for mass ringbone abilities an intra awful now really low level things Islam doesn't help protect protect against peach part peach Ellis find are Siegel injection attacks and across the scripting all at once the amount on that's too high levels on for a slot so I'll were really just talking about really low level vulnerabilities here on begin think of exploits like Stuxnet and flying and and even Hopley even though a slot would help them the Hockley case but the same kind of low level the game will be history this
is all Wikipedia so thanks Wikipedia University but just to get on the same page fell into thousand 1 on we now know know that the packs team is just a single person but at the time we did not use 1 person or more for people so we still call Isolde column the packs seemed just because that's always called them over the year to date implemented has a 3rd party patch is lawfully and and into thousand for open biassed I picked up the patch and it took to open to the idea of a within hours wrote well into thousand for open biassed Sir implemented as a lot of thinking like maybe not based on fact that lies the current Implementations based on tax are believed to be really care are on the verge of but not on the night of the road but there are at what went something so how long it took opened is the for year's to implement Islam but to their credit they had a long more work to do that the change a whole lot of stuff on in order to support its loss of because were coming at this for a long but behind we'll have to change much stuffed the snow or not as a prerequisite for implementing his or for us but it sorted but in 2 thousand 5 Linux grips taxes is a lot and they done the down called more secure a ins and did a lot of politics Booker their on all talk a bit about the more about Linux and an hour learning from other slide on into dozens in 2 thousand 7 Microsoft introduced window a lot into it was system but there is a lot initially Isla implementation was scrapped very easy to bypass extremely easy to use privileges of babies and design a knock attachà decisions that were more mistake that the last will today because they have to bask in fields of Pete headed to say will talk about the way out but the introduced its long thousands of it took Apple 5 players to finish up there is a law work for over 10 which referred to thousand 7 in 2 does 11 some or work alone of remember with what your Oracle points on but they introduced its to slurs 11 and 2 thousand 14 all of a painter and I'm submitted call for testing emails to the meaning that for hours Islam fomentation on previously
intrigued I previously has long security strength of previous security mainly relies on policy basic 3 decisions on the Mac framework and at 1st the for 4 success Hills Ruibal the state and jails and you can think of Jillson beehive sort of a policy based on security because the same trust this applications but previous he has can a hybrid policy based and on and explain mitigation technologies and Boxing called known as capsicum on the Supreme implementation said botanist critical on so I'll have that was on the side of the for the capsicum seems to be pretty useful pretty promising for future but non technology or non policy technologies for these are explication technologies not stacked for in the 64 and putridity below fact as the pre peaches restrictions prevents slip Eiger from working so how on
previous he does have a few weaknesses the word of the non that stack that means that you can you can put yourself on the back you can when you are exploiting application in New York and goes to run or a tree code Michelle code on but you can store on the 2nd just not needed to run on the stuff and previously has that but it doesn't its and not working on all platforms address replied and supposedly it's a ports non exact stacked but it does so on once were finish with a slot patch itself were in I'm going to go back and take a look and see why not that is being obeyed on on are and so we it went things that goes hand in hand with a slot is called position independent executable support and a minute call that high because it's a lot easier to say than position independent executable so are we it is a large really to to be effective means Taesup or so that that's the part that tells the open system kayaking but that the programme be loaded anywhere in memory of and so phrase lobby effective Taesup August happened base and I'm actually work on the right now and hoping to get a patch up the Prime tonight to be merged into head so that will become images of Causer's noise along previously that's why talking about it and G or said is a 3rd party patched Linux Kernel the part and the other colonel and the USA went on might and goal is to be caught all the features that makes sense for free the to free biassed so so to learn from other
linux is really political to territorial pissing contest becomes to chemist on what they did was being the new this all taxes work but they didn't want and Implementation from and and on author we didn't know that the Linux guys didn't know who wrote of taxes is a lot of mentation and so they wanted something of their own and that instead of trying to figure out who it was in contact them know there is an actual email address for them that just began on the day ripped access code and on the Downing called more secure and the 1 thing that drives me previously more than anything by Load produces is the 1 thing that drives me previously over everything is the lack of poultry all that would have head got many comes to this time say a at a time when you buy sat down with the speed of the day and was can escape also this is the 1st time the had a major patch review and and that it is more about is more but the technology is not yet some ideas and suggestions in striking got patch that school we'd get this end of the 1st lipstick situation you now it's more about the technology was previously than the Territorial pissing encounter and that's been might period seen out of other people's screens and very but that's been might Varin's wins many patches and and and helping out the prettiest approach its not nearly as well as the mind numbing as it is with Linux and so on technologically speaking Linux's Aysel are so I'm not talk about taxes on Linux is actually Islam mentation is pretty weak and pretty down on its I the turned a slalom Globalia turned off globally so she won a slot you want this explication technology on system we have 1 application that is closer lost no like clash audience video binaries that can 1 1 yes if it is and and applications that is misbehaving under 18 under Islamic its crashing or the other but that he had of this law turned out for the whole systems so that stupid on so the 2 things took away from this is that on when you to randomise enough but because that's a Prime with Linux is that 1 of the problems with Linux is a start but not randomise enough but there is no way to control company but you want randomized so far and the snow waited Hogwood on propagation basis that kind of half but not really does this command their that said Otford their iata's specificity after USEC command every single time I run this application that you want his or disabled for and scan steep on so if you like an application that it started the year in its but if to build on a finite scripts to to disable so every time you updated the package for that yes to back Alierta modifications let the package update and then reinserted modifications stupid some so 1 thing's learn from Lennox's we 1 more flexible were dynamic windows on now with Windows 7 1 0 6 on the other pretty decent technical implementation the biggest issues there is individual deals and yet have is a lot turned on or off on so any exceed both the season and deals are just paedophiles and there is a bit inside the paedophile that Sir foreign this object of a slot is turned on world and and so you can have and yet see that depends on what 6 5 0 for example will say that I he has a slaughtered and 4 per turned on and for out of the 5 tilleuls have a slot off means 1 the 1 below has a slaughter and or so of the Islamic did applied the windows will play a lot to the sea and the for deals and is wanted applied to 1 2 also will be become hybrid state where it is Laura's kind of applied the time now and that is a big issue on because for example just recently icon in the manner but there was 1 vendors who if you use windows to probe early user suffered a or nearly everyday socially for looking at documentation are they they had found they had just released a new version of the site for an independent on quite a few different deal and it is just that exacting scenario that compiled Applications with its loss of pawn all the deal else except for 1 there was a vulnerability and 1 of the day locals that had is a lot turned on and but the recalls that was that on the control flow could be could be on controlled via that the deal that saw turned up in because they could use that deal well that on the head with a large and off because of loaded in a deterministic way the attackers were able to successfully exploit the application of using nothing more than just the standard exploitation techniques so on so that can be a major issue we still have that kind of on issue with L with the L file for on previous the but that's because of file for close was designed near the media's India's way before a solar was even thought so that's why piste support is really important because of the wise to not randomizing all of the address based randomizing if you don't have a as a loss of over piste for for that application your still randomizing where the dependencies the shirt objects get loaded but not the binary itself still kind of had that deal issue Justin reverse so
how on a slot is available on for free is available on all a detective freebies support with something we don't have part offer all are detectives of so mileage made very on we actively test on a knee 64 by 3 6 are and kind of Sparse 64 of Manila previously just previously 11 current without this patches at all of has issues on stock 64 side haven't been able to test that is lost to much on Xbox's spot 64 so we have exacting stream isation piling on I'm still working on the pipe actions were and hopefully get the the in based here by might On the and into some issues with a Bingham compiled so that can emporium on so to my favourite features on if an application you were in a half 3 ways they can't talk gold is a lot for individual binary on 1 1 is implemented yet that is the best extended atrebates sick said next and Adaptive for the binary in the West that they don't a place Laura when your executing this application and other ways to if your Applications disputing new congenial that application and have a slaughter not just for that she says is slaughtered on through a host Weston all your other Giles before Justice Jail you can have a slaughter not and my favourite feature overall is the I've tied into the file system far will known as you Judith W witches per framework that allows you to specify Dynamic rules as like IPI of W style rules for Controlling his or her binary and even like per user for group a basis tools prickle so what is this world
leaders in less by a on
from windows about a week they but the real itself without As yet it's kind of an on in Windows case on command and individual deal well on that doesn't have a slaughter non and previous the case it would be the binary itself not shirt object Richard of it is but it's not it's it's already shirt objects are compiled such that there are already randomise a ball that's the nature of a shot object to can be loaded anywhere in memory and so previously without this sort patches shirt objects for getting loaded in deterministic where their Austin of the same address even though they could be relocated they were so that's part of it is this that has a lot to do that for shirt objects called off by the close with the loss of all but the load of air is not of the and night now it's the reverse on Journal objects full allways get randomized of less is lost turned off for the binary or in the gym so on if binaries not compiled as a position independent executable but compiling as a position independent executable turned 0 executable into a shirt object pretty much so if here executable itself is not compiled was high than the executable will be loaded added deterministic address indeterministic where so on so we can have the opposite on of the same type of Windows from but in the opposite way so on its so area in all show you how
that all work on so here all the settings all this is the Chilton Wills on the status tuneable said the street different values for that integer based 1 is you have to have your application out via the right now just 3 the New Judith W or on setting it to set up doubt means that Applications all applications will have a slot applied except for the ones who say they want to opt out of and 3 means that its enabled globally there were for says lobby turned on everywhere for every applications and the and
so on really my favourite feature is the you just W integration because seeking create far more rules that apply per usurper group per file upper filed or per on per hour object meeting the final object as not while but is different different ways you can take a look at the rampage through objects of its really cool to very powerful on but there are there is some data and Capio breakage with so if you a 3rd party developer on any build based on the with new Judith W on stop than the and there is Load with a baby British to recompile your application of 8 Shiite Thurs No 8 Shiite breakage Soliar function calls itself will remain the same but enough to change the underlying structures so on An example rule would be for me a foul on the disabled on a slot for this test application then Adoral for my user only when my run this Test applications that small innings disabled is a lot Celeste critical and the producer of the the show
that he has yet so aren't so this is downloadable details of the higher level version of the local details in compact start seeing that those adjusted their Kelpa functions and taxes laudesi is where of this is the tills or or a implemented in the UK the mass of Howard applying the its laws that are and image Duddell is where we were given the run-time linkers on randomise Asians and its where we implemented Taesup support so how that there is an issue there is a potential issue with compiling a supply in that sense randomizing the that the load address of the of the executable on you might end up with a non all address work well hour Implementation guarantees that you won't have no mapping so that stamp we meet we needed we double checked to make sure that isn't an issue no mappings will never happened with with hour Isla and implementation so this looks a little over a lot of data as today this 2 non stop that need to be set 1 user controlled and 1 as developer control on this the user control not numbers with piously put with high in your make Dukhan or soft or account if you just want sauce account of fuel only 4 based McDuck which globally on but application some Applications don't supporting compiled as a pilot and some applications can of her body when applicator when ran as about 1 ran as a prise so each application must this is the part that set of data on I'm turning this opted to opt out so by default applications and and based will compilers supplying except for those that have been known pipe people see some adding with are you in the shadow of the side cheque on the dirt at the moment there is a really any other way that will talk PPL Talk but don't authors any other way to do it other than no flag so on Thursday called on still utilise propaganda Colin change will 30 different files a half hour or so called had will see that's exactly the helping her like due to the different way but the helping with the bat and the world's with plenty to be like those 3 yourself from both the right and the good but he doesn't go go out of your way to a fact the and the and the laws of had but the next project is can be used in the demand for Trammer after this mass and approach to itself so it's a good thing that I've worked with some ports people whom just 20 feet away all over the world but that's cameraman next major
project is adding piste caught ports framework it's a heady is at time compiler from a with access all options right now is lost not and based so I have to apply patch so far worse on the call for testing phase on so applied patch sales Saudia Kernel precompile install eternal by default is Allawi turned on when you can biotech firm option and if you do if you use jails on child chills will inherit the potential setting so that means if you have a slot turned off for the parent them without the the need help but it is a lot will be turned off for the child so if you want take advantage of Taesup automatic Collier Applications with the Dutch client ash piracy flags and ideally also a dash tied to your LTY flexes what I'm
in escapist led because are a safe are protection which is recommended feature for a a but is not required were still working out the low level details about of 6 4 protectionism very difficult of things to are Ketek and were going between like 2 or 3 different designs a knock attaches for implementation so word still will be decided on how we want to implement the basic I would say for protection buses it on it pre it frustrates the attacker that is trying to determine the on the inner workings of a slot to see if there is any deterministically here so I like if there is a vulnerability that the that the attackers triggering a causes a sake Fault on an like this h t as each will restocked across the on automatically a crashes at exit part and in a tackle basically to in the past proved for subtract but in this case a staple Fault before Sept the sickle protection just adds a delay in to restoring the application to the old but also the world of the book and that's does really get to know I'd in Dundee loading whose commuter on is actually working on the site for protection features and solo bring met up with him so for future
work on and I hope with whom stuff and I don't know they are not attach a very well attended yesterday's are intro presentation as really helpful but by still the contract are so if you are available on the gold bones black a respite pipe and their willing to test the stuff out of date with me and on a well to help on the whole fully in between the price of 40 days after a remake only changes to mount didn't know how things are going well and we need testing many people assessed on my can run in the days lock patches on my books for pre match since its inception and on the hour a swamp mentation at least frame the 64 is solid on I've not had a single issue on might now have chrome the chromium project on compiled a supply and works great except for a Channel Five body on video doesn't work and more don't know why were so my and gold though it is 1 says celada is done and and base and Taesup order stunned and based and an ex support this fixed on non in the 64 and 3 6 or the pictures and then I'm going to work on a Mauger 2nd packs features and probably been work on W X Oryx next and and protect so on now is the demo through the 4th have taken
seen as this Test application basically all I'm doing is a governor of got pointed the points a some data and I'm just pointing out the address pretty not the address of the point so you can see this in the 3rd act of Laurie conceded
got under this law turned on I'm by him I'm while just bring for on I'm randomizing 21 bits of M mapped out calls and 21 bits of the exact based at 5 the exact lemons for pi so when my run this application Bill see that
that address like its randomized each time so code the leader up at the time of the
0 so that is large enough globally In the addresses in
randomise tomorrow the through up to
date with the st so right now I'm
doing a design adding the day you just W Farmwald her file system by a wall of rule to disabled a a lot for that 1 applications actually want to see I'm in a disabled latest
large US for that application stop but the PP
quote should this most as eye read the file and executed tax flags built said the packs flags option witches is optional on the law case a innings a slurs is disabled for this applications below upper-case a means it enables sofa running an opt in basis using the capital label say I'm opting in this application that is a lot
so now we can see the became is
this the same but we can
see that the case laws enabled but it is
disabled for that application Sofya eyecup be tested testing so 2 different while we can see that it lost a
work and but for other files He rode his the are all other fire oral it is good for of all yes so running and as
a different user means a laws applied for the eidos 10 because it's nice to see a number
to remember now that IRA
notifiable role as loss
enabled so how on
that's really it for the presentation idea wanted to think
on a few people over pint a is the 1 who initially started development on a solar feature what happened was a pointed out wide posted on my will take blog on that hours going to start working on a slot for free biassed the and then he somehow saw that post and then contact means said Woods work together so I'd added that her Jail support Taesup support and the age after the start and he he did quite a few other also things Danilo again he is working on on the same day the God feature and ran Steinmetz is what of the ports commanders and paucity members that I've worked with is also and public inwardness this named Johann as makes their no clue that last name he convinced me to stay but to stand aside as support for the cause of the status approach which adult which got some people interested in an added more tested the 50 you on an for sold to soldier extra donating hot work all of them were over what sort this lawyers
along with just a text for all the boot open up with Brittany of what were Verheugen desertion references all although data
and for public so
Quelle <Physik>
Pi <Zahl>
Reverse Engineering
Gruppe <Mathematik>
Fahne <Mathematik>
Skript <Programm>
Kompakter Raum
Ordnung <Mathematik>
Verbindungsloser Server
Fächer <Mathematik>
Determiniertheit <Informatik>
Installation <Informatik>
Konvexe Hülle
Binder <Informatik>
Nabel <Mathematik>
Offene Menge
Wort <Informatik>
Natürliche Zahl
Familie <Mathematik>
Lineares Funktional
Physikalischer Effekt
Kommutator <Quantentheorie>
Konfiguration <Informatik>
Arithmetisches Mittel
Projektive Ebene
Web Site
Proxy Server
Bildgebendes Verfahren
Elektronischer Datenaustausch
Physikalisches System
Design by Contract
Objekt <Kategorie>
System F
Offenes Kommunikationssystem
Offene Menge
Kernel <Informatik>
Demo <Programm>
Gesetz <Physik>
Streaming <Kommunikationstechnik>
Metropolitan area network
Mobiles Internet
Schwach besetzte Matrix
Intelligentes Netz
Dienst <Informatik>
Rechter Winkel
Grundsätze ordnungsmäßiger Datenverarbeitung
Abgeschlossene Menge
Lesezeichen <Internet>
Verband <Mathematik>
Stochastische Abhängigkeit
Stochastische Abhängigkeit
Elektronische Publikation
Patch <Software>
Konfiguration <Informatik>
Web log
Windows Vista
Kartesische Koordinaten
Prozess <Informatik>
Funktion <Mathematik>
Ganze Zahl
Kombinatorische Gruppentheorie
Framework <Informatik>
Matching <Graphentheorie>
Diskretes System
Dämon <Informatik>
Mapping <Computergraphik>
Manufacturing Execution System


Formale Metadaten

Titel Introducing ASLR in FreeBSD
Serientitel The Technical BSD Conference 2014
Anzahl der Teile 24
Autor Webb, Shawn
Lizenz CC-Namensnennung 3.0 Unported:
Sie dürfen das Werk bzw. den Inhalt zu jedem legalen Zweck nutzen, verändern und in unveränderter oder veränderter Form vervielfältigen, verbreiten und öffentlich zugänglich machen, sofern Sie den Namen des Autors/Rechteinhabers in der von ihm festgelegten Weise nennen.
DOI 10.5446/15342
Herausgeber Berkeley System Distribution (BSD), Andrea Ross
Erscheinungsjahr 2014
Sprache Englisch
Produktionsjahr 2014
Produktionsort Ottawa, Canada

Inhaltliche Metadaten

Fachgebiet Informatik
Abstract Address-space layout randomization (ASLR) has existed in many operating systems for a number of years. The most famous implementation is the PaX patch for Linux's kernel. This presentation introduces and announces an ASLR implementation based on PaX for FreeBSD/amd64. Details regarding how ASLR has been ported to FreeBSD and some advanced features will be presented. FreeBSD will soon be getting a port of PaX to 11-CURRENT/amd64. This presentation details changes to how ELF executables are loaded in memory and innovative workarounds for legacy applications that don't support (or misbehave) ASLR. Jails can have their own ASLR settings. Misbehaving applications can be run in a jail with ASLR turned off, while ASLR remains turned on in the other jails and in the host.

Ähnliche Filme