Bestand wählen
Merken

Are all BSDs created equally?

Zitierlink des Filmsegments
Embed Code

Automatisierte Medienanalyse

Beta
Erkannte Entitäten
Sprachtranskript
that was and
and and and if the let's have a bigger and for a year bond scramble few also with it so yes was used missions without was Oral-B these great a survey of musical abilities of sort of rely when aims to impose a no I work for chemical active but I did spend the last 5 years of in America but I recently moved back to build a couple weeks ago but my stomach through much apprentice could review I I break stuff profit profit from having going to see Congress since 1983 out in a while this will be a couple times before ominously way 7 return and what's see other scouts and bite so there this sort of split into the forest pieces was intro which will be the next slide and then that is a little bit of data and I'll show and and the lack of data so it has to go things and then once I've tested and that guy gets results on Oprah's and my results and conclusions don't are right so is odd about physical horrible is number 2 comparison between different current B is the flavors of astro expect from the audience and if you of expecting basic Unix kernel which knowledge that too deep but that some would be nice and people I think might appreciate soccer in all of your low-level securities yes of use the abuse the key in then fury list I might like this to that and generally people are curious about was internal security thing might enjoy his presentation from from all estimates and you have some people that I call this the initial giants because you don't do this by yourself you build upon work by others so that there's number people that have done interesting musical security research over the last decade and a half maybe 2 decades of some of them might even be a Congress also so you know I I watch others that did some really interesting work and so really what this this this with some of the uh opposed to me it was years and years ago by 2 of the artist who feel no we use is the main guy behind obviously the and they're reading this 12 years ago and it's been sort of stuck in my head since then and as we see caught from that the aware goes you know if the large people actually cared about quality you know as still residual do but they wouldn't they would not have had as many local roots holes as they had last year which is that year which is a thousand 5 India goes how that like 20 or so but and so I think that was a you know we make that sort of still 20 or so I was like really you know is that true is it was to the idea that can we look at some of this and that's so obviously sort looking at the last almost 20 years of his probabilities and what the numbers are and so I went to see the details and they basically keep a record of stuff and then it goes back to like 99 and and if you look at at you know the 1st 3 or 4 years it's you know in the teens and then sorted out and fortified search on top goes up to 100 and in the end of this section is this table is from July of this year so 20 numbers on correct and so it in July 2017 was 346 list released but as of today I checked where was 444 this probabilities from a so you see these numbers have a kind of sort of growing and now some the needles of them have the same numbers for and like B is the kernel on issues they have like general view the numbers but that that's all encompassing DOS and I want a specific b is equal across numbers and so it is as a restricted free means you'll be using a B is the numbers a sort of put into a little table and if you look at the tables here from a to B is these you'll see at the 1st couple years trainable part would expert and the links 1 kind of explode as amended that to be the ones will sort of more or less stayed the same either single digits or low teens uh dozen legal or 17 and that's that we see a year ago and so if you these numbers of T is observation was pretty is pretty astute observation but the fact that 20 was a low estimates and it turns out it was if we more of it so you see the numbers from using words over years or not the same word out on same level on this so f is already on equal footing like so obviously the such really largely beyond literal if you look at the the B is these is you know that's a small group of small recruit refuses to the using things and compiling themselves and so forth but as I wonder if if if that is if that's really were there's a reason what numbers are the same or is it really is as you said it's good quality it obviously wording Exeter's well maybe it's too many eyeballs thing uh I know there's a mental thing is still a very convoluted thing but but there's some truth to that and and so as a warning if the substitute in this case of the 1 the only way to really do that is to that of the test that have to go and see what what what the what the code really like and then I'm sure a guide that that this 15 years ago Soviet and thereby conversation about this and thousand 3 14 years ago and then uh basically they didn't want it of to be using this kernel as through some clues from that and what the things that he said was he said well there really isn't much of a string of the girl and the kernels in terms of the secure guarding and they're equally ish broken it's easy enough to find bugs Board of them in the same kind of box and belt that was 15 years ago no doubt have things changed since then and there they said was that and it was the properties of the of the than 3 months on the Linux of and so on if you would spend longer on the Beasties would that have you got more about your refer of hit the limit right and that there was already a few as presentation and this 50 years ago but he most look for a and mostly found that truly flows and and InfoLynx nothing else and so we only had to modify expanded number about to look for 1 of your look for in that race conditions and things like that and and so the data is interesting but it's kind of a little bit outdated and and the the 2 women at and at the time I think it was perfect but have for today's purposes that's not quite good enough time and so the only way to really figure out And it those numbers but up predominant up with reason and this is at the beginning myself and so I spend April May June July of this year I'm looking at the is a critical I don't know exactly how a has been each 1 of them but I would say there more or less equal and so on and so is the way it is I ask myself if I was going to look for bugs where would the bugs p where do I think they would make mistakes and and so I made a list sort of attack surfaces that I want to go look at moment and not the the article surprising obviously the the common stuff is like galaxy and take a look at some 2 scores and I'll take a look at at each the stack and then tickets in various local tobacco trap and was in the file systems and you know what the network and stuff and this is a standard for the issue months look at that time that's all I will do that would jump over some of the things that you need to those areas that I found in his a discussed at some briefly and I have a couple of demos in here as well and it was ever run through that and also of run you through my results were conclusions from Seattle it's tied system calls and obviously this is prototype attack surface so I don't think to reuse rights anybody that you know if you're looking for 3 but the 1st thing you would do look assistant calls because that's the thing where user talks to kernel and the 1st thing that that you can see OK good service that uh among the 3 big B is the stress the difference in the amounts to calls at the Musée has well over 500 that these years almost 100 then will as he has you know about 300 and change and so right then and there there's a clear difference between attack surface between the 3 of them right and but even serve regards the attack my assumption was given that these were so obvious and so well tested and they're are less likely to contain surety bonds and so you I'd go along the sort look in a certain locus is called a certain thing wouldn't and insurance this is no we system call and it is the census log in you give you number of bytes in BC that gets passed on eventually to Milwaukee in them but the about a ancient views the code obese has is if you pass an unbound linked melody you get group and sure enough that's what happens if you do syslog individual value thing goes up from there she have a demo of this and
that has been workin screens even get to work of wrong I you yeah of it yeah
the yeah yeah OK grab that
is not very much research going to the students will on the but so is only using
this is meiosis 1 example it sure enough room that cause across the image who were here
um so you have a that's this is large enough to prevent area and so what happens basically of uses the the syslog just call can you pass around value and causes a panic in and this is no music from 1 on a little little ones are nodes and fixed and on but it's it's it's been there's so reason put your sort of fairly recent blog and so and
here's an example this is a system call on previously called that kill the stat which basically gives you statistics about loaded up for all drivers and then this thing basically and creates as this that but from the stack and filtered out and then links in the back to use but I thought evidence we get on this lies bytes in there and this is in uh I fell if you use 11 but it's been there for about over it was just over decades from dozens when the size of a structure in which the suspect that to you and and what I promise you
can show this in the
this is killed dealing in its yeah and MAC all these by tyrannicides commemorated specially flashing or screen it yeah yeah this so that's
the that's reasonable number 2 where you to basically the whole bunch of of about 1 such from memory and so basically by the assumption was wrong right what I said that I assume that because the system calls so well tested and that is like with like the bugs animal that turns out to be entirely wrong but you can find bugs and in positive these and wouldn't you know fear fairly quickly fairly easily in books and on to the esoteric too too weird a fairly straight chain for bugs and especially newly as calls but even the old stuff as you can see the attenuation voluntary privacy and still had a truly and fully so those things do occur right so that we know that their bugs and system calls and the phrase find that's who wanted to be set so this 1 again my assumption is through all test the less like about because you'll load the usage of the SEC has been around for ages since the eighties at least and it's incredibly well tested in um highly unlikely to find bugs in there and frozen notice at the SEC is as things like before every 6 near the fetus PIC P IP saccade at and things like that and it's around forever and and so my assumptions unlike the habits and so around in a sign that something old receive his secretaries we the the forces p purely packets and then that it's little bit convoluted I guess but basically the idea is that you take a package for passing it and then if it that contains the exact right tag and and the right error message and basically it is usually does this thing that were also the only in in the B is the is the way to the exact works they have this thing called and boss and it's basically it's buffer management around data that you send it out of its little and guys right and the idea is that if you don't you guessed correctly I think of you really want a so in this case you see this thing called and out then basically and if and pulled fails but it will free above you pass that this case you'll see all them of filters spare code a imported on and on and on this week and 3 above except if tooting failed the idea of oscillatory and so this is even other codes will become colored 3 it's relatively easy but the trigger and that affects only the 6 . 1 but but it has been there since 2004 so out for over a decade now at always look at this and found the bug I checked the it turns out that these 2 guys have the same blood but they fixed it but they never releasing can advise you for it that so clearly had ever told you we as about it and so uh and they fix all the film easier to a fixed value of about them and so this that was the only fuel you for and this was Alderley's defined and so again my presumption was wrong and bugs and should stacked do occur with some frequency I particularly cold but also I turns out and thus are hard and very complicated it's error-prone DPI overly consistent on behalf of the sort of when they feel the freedom of theater have when a field free about things like that where I and it turns out that if you have to use them buffs uh it's it's not quite that easy yes you know you're doing it in there there's a number of cases that fell where that doesn't have and the author of circle back to the at them buffer and misused or later on when talk about life I stack them but anyway it is every 2nd that result has bugs and but a moving on I I look at 2 drivers obviously because it turns out that there's a whole lot virus among the disease but for all sorts of things really haven't been given that you existing revving the file to where you find drivers you go to Devin and devil have some name in any you can you find you open them in a unified operations on on on that thing right so open read-write causes of 40 but obviously artful and is the 1 that that you will look at because that's generally where most of the inching will be and so this is the this is the idea of crypto on that p is the 1 which has this thing what a in which we have to say very very true and flowed in here you memory corruption and in is not this is was the if you look at the actual fiber it's like a apple command but after the ransom by have commencing but summary times the same true in visual for shows up but when a new notion of the trigger for the 1 workshop was the sign up for a while but the several others and then again when you see if I can condemn others
only the the running so I mean in Italy from word limit the limit time on 1 monitored crashed because the there is here to bear just on the size world the
so this is an the NN control flow and whom the moment this year the reduction plan
of the
few but yeah so this is this is the class usual forming new reduction this is that it's portable and and then this is a a
similar dry was previously this is the driver called the case in which basically gives you access it shows you curl symbol for free that's not very remote and there is
missing thing where you know the due date able at of indeed you open it basically in the the the driver files driver files for specific data basically take a copy of a pointer that that's 1st to think that to your process and and then we do and mapping they find that pointer and they basically use and there is an interesting issue here which by pointers where if you if I open about the device and then I passed that files for prolonged 2 different processes that killed ritual process and then that of a process doesn't and that it's basically using that ritual pointer to usual process but there's a process is dead so you have as while put it being used and this is essentially expired pointed out that this is very problematic turns out but because you BCI using a well-connected when anywhere to read or write to them then and I want to actively there wasn't alive because my what kind of sucks it takes 3 4 days to actually at the book and I could probably optimizing that is having done so you have to do it in a screenshot but this is essentially what happens if you at about 9 inches of body ifyou because your time uh 9 days of 1 hour so too many sex at about that but I didn't have a factor that's it through the virus stuff in there are many many many more variables than if you choose not the so called that in these were basically and they allow the US to sort of Emilia different West so if you have a binary that you compile for Linux and you run on freebies the initial freebies you lose about about English layer and then you make sure that you have to write your resist of salt but then you lose by the will run perfectly were more or less perfectly someone on your free music or order is the time and so they have these kind of the of the any of these was beavers for different operations and so especially that the the has quite a few of them a free b he has less of them in an old news promote your most of but it's essentially their Frieda different was or all of residue as Soriano so you have 6 forbidden years supporting the tube at residue as that that all that stuff about layer of MAC of that's obviously as will but system costs and and when you that I found really nice quote by uh TO about about layers where says well you know the people at that layers don't care enough to maintain it and the people who work on lessons don't care about about layers because they don't use them and cultures are aligned in the same direction but in this says Cappelli rot very quickly this action true and so options example this is this is
SVR for compact code on a deputy as your for is ancient nobody was used at the probably 20 years but but it's there and they supported and this is this thing called streams which is it's kind like sockets but not and streams have been dead for a long time but that so supports it in this review for compact some this thing where um is the day is that the um this function that added in their gets called which has been
appointed and basically I'm the content of which the come is is defined by you and the what they do is initially you grab a value of off of it uses an offset and image feature directions thing read it out of that and so this is this the arbitrary you anything from every other boundary so that obviously can cause of a kernel crash were pledging fully but the really interesting thing about this because if you fall way up in you comment says yes this gross so they know the code selects this code as the ultimate 96 at that that but the the so it's been there for 2 years I mean there may be people in a room the younger than this but so that but yeah this is this through graphical this what the amendment said the come at run through quickly and they were 20th go they never look back it's they're probably and uses 1986 to and and and so I told him about it and they fix it that the log must basically said well we fixed the will to have holes this of which encode and then it said we should never enabled by default and and it's a minefield and so in the company do is then but if existing tools changed a crock of fake it turned to shit off by default on which you have but so that field that over the top loosening about proposes that the 2 Tribunals which interesting word in any kind of sort of exceptional faults which can be division by 0 losses corporate pointer and other actors were of very very long list of things this is essentially mostly this is the heart were sort of coming fewer since engaged in this kind of happen and you have you it and something triggered by use when some calorimetry our worst of poetry by kernel and that the coattail this induces is usually incredibly incredibly nasty so it's it's terrifying to just read a scholar can imagine writing it and it it is erotic specific like the other Intel was from the or what sort of from its and so on and even amongst you know the the Intel link earlier to leaders do many changes in between and this so I don't really feel I'm like a boy and his code because sigh by I like my city and and so I was like OK at what I just closet wall and then it comes out of will have you floors exceptions they're like well I don't really know how to do 1st of exceptions but what if I just excuse red instructions Shirley and those things will get some kind exceptions and there was a researchers I mean like super random like and you know the teachers are they see what I do is I read from the few random and I end up creating about fuel for before process function for 2 it with the prostitutes thing it will died using after section truth readings that up but you just keep that loop and loop and loop and and they generates all sorts of weird uh the traps that occur our stand and ventured off if you do this on the on the previous the value you make up about there's a as high as an already you know I was news and then there's some sense signal but all sorts weird things that happened so this is 1 of them this no 1 of
them I and I I could then would but I don't know the thing is because it's a random you never know when when it's on but essentially
this is all the core it takes i mean have more advantage of this but this is really all takes to cause and so his rights of like this and you run it on on the beauty in the of it will hit robots it the theory that
happens in Papua that his I want I capitalist and so yeah the next thing I was a bit of Out of file systems and they and so the vector of us and obviously the the easy part of the taxes this is sort of the all you know you know how use music whatever and and yes part of our system and that's true I believe in my view that's a factor but it turns out that in recent years and the significantly new taxes to file systems this comes in the form of refusal of yes no which uses essentially I use fossils and and so what that means is all sudden all unitary layers that have been around for many many years that the previous years worth of data from trusted drivers in kernel prettier structures were you know more West trusted like the data in there you figured it was more or less accurate because it was given to you by kernel all the satellite data is handed to the VMS layer by user and process and the assumption that the there's trusted is no longer valid and so the stroke diffusion basis for the beasties before the adult was like 0 was used to be the first one inflation and then they'll just say think what others intro turns out of all the we have these wrote their entirely different views mutations that there is no courtship RealTravel told different from my changes in my view of from wouldn't codes at the PC 1 is the most complete in terms of features of freebies you want seems to be the 1 where the 2 arguments on most controlled and constraints in terms of the matter validation being done in and you'll be as he was basically the has the most minimal amount of of in in Indonesia features implemented compared to the other 2 so that if you refuse it actually support out but also invasions of these do not know when the half of the table and pretty much any other office operations read write you know read here get activated at the user type stuff and and so affordable
this is and this is the only is the I get get CWD a system call gets comets is called the mycelium build adjusting what a goal to the view that later say get actually and then they fill out a survey of the actual structure of the band the assume every in Viet structure is more or less same because it came from the program of but given that you now use fuse all they in the is no longer trusted it's should be considered tainted inched valid of course they don't so we take this massive went value from that acid amour as and as I mentioned before FIL museum aliquots he's a very large value called prophetic and this right here was about and then if you look Lutheran in getting perceived wt and the latter call to fiercely this foppery dear and basically and they get this I'll just you structure back and then from previously when you when you they can reject but again it's it was the sparse India but but it was hear back from a having Professor prior so the structure was more or less trusted and in in this case through just about and a length of time and so the content because it now comes from user process is no longer trust trusted and so if you look at what search passing the name length of directory and it sort of just assumes that it's moralist ballots and then it uses that from a move on and that can cause the boundary of so basically the properties and I would imagine you see these links to behave look at is that what you're feeling you have if you if you do if you want to like use you have to modify your view that's later because the us new fearless layer has all these assumptions were assumes the data you gets from your file system is valid that's no longer true so that was sampled model is the and the abuses of very at similar box and this does this particular bug that the bug was there's thousand 6 but I I think fuses not quite at all so this is only recently been a real issue and obviously if you look at the actual fast them and where would you give it out of out of a blog data what amount so this is the x 2 Pasha of for free see this is I very brief decided not to exhaustive search but I was like you know breakfast distinct will be read they're like 0 well you looking for some kind of string and the string is and they're just panic was pretty bad this sitting judges give you a of most of the extra petition in this single cause attending and so obviously the defensive arches and In the disease or not but they should be be and I suspect if you simple fossil fostering because these things will blow up in all sorts of bizarre weird ways and I lose the 5 minutes on this nose like this is very very broken like a scooter assuming felt fossils and again justice but spend their frontal several years so that spec was certain Pamela thousands you you find more about yeah if right so so yeah networking beyond TCP-IP the stack of and I assume it's and a the federal but I really only some have Wi-Fi my slides here to a kind of throughout occupied and and get to it but when you the Wi-Fi attack surface there are some sort of a way to things you have to look at right 1 is the stack itself and in monitor the action Wi-Fi driver tried and ideally you would have this thing where you have only 1 stack animal rights report to it we should be assisted Elise hazardous to your is over Wi-Fi so that every gravity would so full stack of the likely which of passed that and there's all there's 1 stack for it for older drivers of so that the status of it it looks like we should be 2nd it's obviously for report calls but it's all embossed it's being out it's stuff that gets passed in the but back and forth on the main uh preferred to society Tripoli 0 to 11 which for input and then what is a ring that used to refine the entire you know it to 11 passing stack and that functions called from all over the wife drag and
social after serving that eventually finds function called like a clear to the 11 underscored people work unit for input and is basically do the bookies and it turns out if you look at the structure for this thing it actually is 2 different lengths ones like the ones peel length and this this this workflow function does validate Langton pale length but then that's used in colder than BoF pull up to do that is to say yes actually plot of the continues buffers nature is that which length and does this for a detailed length but not for the actual yodeling field and so it turns out that the actually tools used to actually read beyond think that the read buffer and so because of the plot isn't and unfurling before the pale link instead of if you link is bigger than your pale length then you could end up having outer boundaries and this can be triggered by a remote of what reference of so again this goes back to Member of mishit mishandling as I said previously in the step piece that part of a bus or heart so this I wasn't home users 2 4 1 1 of only about witches out the books been around for about 9 years some the drivers state that a lot of errors this is the interesting part and whether drivers or eaters so when there's maybe these reader PCI USB right and BCI you put a card of this is the main access but the US these different USPS packet-based right and so it comes out questions but where's like do you trust your Wi-Fi radio right whistling compromise the Wi-Fi radio and then from there on Christ on your West some of that so for the BCI when I was like OK well if if you're PCI OK thank you all they can do Diemen but that's so true when you use use of your it I wouldn't even you about but let's just assume that if it's PCI nearly wrong but if I am but when it comes down to the USB drives through to 11 but due to propose essentially packet-based and so you're USB host really we should be able to go past the packets correctly and not blow up if you get a bizarre use feedback from your life radio but it turns out that the premier at religion that and this leads to very very trivial
he smashes I have I want to have 1 example but I really give you 5 examples of that the same thing and so this is 1 driver or they go like OK is a a link feel that can be up to page long and then OK we'll go do will create a number of cluster which which can be 2 thousand bytes long animals do women copy with that linked into that cluster without ever felt they knew that link is bigger the cluster that obviously that means that you get trivial memory corruption and this is a different life a driver missing OK let's grab is linked to a lot of the out of the USE the packet and will basically use that and copy into that and above that can be up to 2 thousand bytes and again 1st of all corruption above and then this is not a driver and it's very similar thing with name got length and this another driver person a thing where you landed unit and and copy the causes the other and and above the Gaussian but uh and and there's more of these but those are the ones were very trivial and so this is basically wide open fact surface across all these these across various different uh minutes and that no this real tectors and a whole bunch of these a lot of areas of of the deities the this code is very trusting of user feedback it just assumes the wording is on right and I think when when the sergeant where that nobody thought about the taxes on this 1 and and so that's more or less it for the for the attack surface I had but there's a few more things I looked at that kind would talk about but I like it in much detail about that so 2 things that that I showed up that that that sort of had that that that were seems like anybody know so 1 is that there appear to be of a certain amount of easy detectable drafts of interviews the them I spend some time looking at if reviews the I I did a very quick rep on on on the on that Debussy I suspect there's a similar about of all of that busy were basically so the way called Mel often these these basically you pass the flag and the flag is your base says no weights or a a sewing useful give is that it gives people the reason I always weights and with succeeds when it returns it always 6 succeeds it never fails from the but there's way to pass a flag which is no waiter can fail and what that means is if a kid in a fulfill the request within a certain maritime it returns and feels request right so we can use you visually graph flag see a time where there's a meltdown there surely is checked and you get an older and the reason is the shoppers because by default so that the pattern is not enough for about you and you think OK well let's Gneezy pattern and know if you run across but you never make a mistake except because that the general way in our scores where it could never fail and so there's almost never amount promote check them except you have use when you doing a new way to can fail edges out there is thinking and is out there are quite a few cases where when you do not know where can fail people watching from you and so I think it is that housewives and and I don't know when you haven't done this yet but there's quite a few uh did I brief so when the grapple maybe they like 15 or 20 I came long list was on the on the on on previously of for thing that was using sees the the these these have you noticed direct rendering of stuff in kernel right trigrams merger recommended triggering infrastructure for those all of these we see the graphics drivers there in kernel so when x 11 runs it sort of talks duties graph tribes and kernel and that the whole thing around is called DRM at your eyes um and so this sort of to the sort of came from the Open Desktop people it was initially developed separate and then a couple years ago it was moved into the Linux kernel and they would to be these it is the kind of 410 but it's essentially more or less the same court base so a so the B but to be the guess can have to have otherwise excellent we do much word is a and so it's interesting when you see the struggle evidence and if you look at the domain obesity develop responsible for maintaining during year I'm in all music he said well because all this list or that we're reporting that's not going to be reviewed by any of your mystique offers because they refuse to read any good it's not perform to the the kinase standard and and so you have all of these are rigorous code review standard practices will be is the example of your of your stuff but they will not touch it and so all the bad was kernel all that stuff is pretty much in be abusive freebies as well the OK so that was sort of it for running through a the sort of the the types of bugs level looking for the things I found them I mean I could spend I could try not to 3 hours but if you put a book but you would get pretty boring and so it uh so what was my results and after I was done about 3 years months but I about 115 bugs in total I dirty button freebies the about 25 bugs in the all means the end of the line shows deputy so about 6 years so in and that PC so it was a very wide spectrum of box B airing of under the sun they can right at a straight up the exact smashes race conditions expired pointers double freeze issues on flows signs logic but at a typo somewhere where the wrong verbal was used but it turns out that will exist at 2 and then it is weird things were the wrong thing was happening on the wrong structure because there was a typo and division by 0 item logic books in there I mean it any dimensions in there and it turns out that propose not by guards and the to make mistakes in the planning stakes actually and so I I I found busy bugs amongst all the beauty is amongst all detectors I mentioned and within that entire spectrum and is inching 1 cites you've got a grasp for all 3 of them and what was where and how was done and it's it's a that I think I can make some observations about co quality and then just look at about which is the numbers of the box right you can you can you can see the same thing right and that so the sort of thing called b is the when it comes to code quality in the kernel is to the clear winner right and then it comes uh the quote that I had from the original where says no it's called quality and that's part of it and I think that it's it's it became obvious to me it it's called quality but also Texas production this combination of those 2 that that seems to to be a winning formula and then be the there is enormous tax-reduction if you compare it with Europe either meetings they do not have they don't have little kernel modules they have relatively few devices they have virtually no compact code other removed it was compact or couple years ago and they altered tired of stack of that article sucked each deleted so that support of busy and this significantly less system calls they have more than 200 thousand calls less than 3 is the but in a cut support for a whole bunch of old architectures right now and in that in combination with call quality problems that I think is a winning a formula a little quality because it really does show if you the cold right the review low-hanging fruit stuff is almost entirely gone away is the usual flows that bloggers are virtually gone in all music is like the dome grammar suffer something worse founded because it was a taxes they never thought about the alleging that they know was attacked surface but if you it's highly likely financial flows there are signs but
simply because they know about them in a day and in the form of the developers about what that looks like and they have this so every every it gets cold reviewed by at least 1 or 2 people in these people exactly what is present like that too that when you process like that of usual flows simply don't occur surface and the thing is that they had to refill Eastern European cities the interval diffuser yet but doesn't use the emphatic you and these bugs in their 60 year to combine is less so yeah it was it was obviously not tons of lexical tones of compact code from the actors that when you have that like sing about when you have quotas would 96 and you have book that since the idea blogs and they have these I support calls there which I don't know of anybody actually uses those 2 states is really Asian caught from the eighties which is written by IBM and was important appears the that's been there ever since no 1 knows what it does but it's there have been a whole bunch of this really really all told and the idea that the court seems to be less consistent and which carry called satirical quality compared to Europeans these alike Musée they have tons and tons and ones of initial issues assigned bugs but the requirement is that where show that you know they Israel's right there and so so there's deftly that sort of code quality difference of don't mean that as this I mean I understand that the main building maintaining proving OS is really really hard and if you think it's easy you know try and so I understand that it's very arduous and but there is a clear difference between if you if you look along with the other you can see there's a there's a difference in code quality but when you look at the effectiveness of and freebies to somewhere between really and it's hard to place a bet that it's it's not a it's not a good quality isn't as bad as is the but it's not as good as obvious um so OK so obviously when I found these bugs and I talked to the team Célestin e-mails associate his was about to have yes prodigal find its success and sigh all audio me the guys in your tear gets back to me about a week or so later ever see that this is 0 I'm sorry to me we get back to you as a vacation and he says all the bugs look good this is the stuff with problematic which a fix these things and then he says my e-mails back the next to the eighties fixes sort of coming in their CVs and sure enough and that plays out about reported less than a week in the fictional right but yeah I think if if few have had a couple weeks later they will be the is the mean of the 2 patches and vise said OK if you have lead if you will be placed on museum you will fix these bugs here the patches his and do it and so I think that was great and that's perfect that so it's supposed to be right of Saudi you know within a week response few later fixes the affix someplace in like a week have that they're all the patches of publicly available of those advisories this is exactly the way of the through process should work but it will be easy as it done everything right so as far as um so previously tidak go well but it's or sort of similarly where I got a response within a couple days the week and I'm about back from these guys and say OK well we see your bugs and we found in our control but database this was July 14th inter enough this is from the male they're blacked out what has been fixed yet or what I'm not quite sure of this narrative the fixed right and so um since that e-mail but not all that much has happened right it's that's 5 months later on 2 advisers have been released and it's all views to books and fixed and then there's the 3rd 1 this oracle we had cats but I know I saw of a source EV estimate for that you know that was fixed all the others sigh it's up in the year I don't think the fixed that I quickly check CS right before I came here and they look like they're still in limbo somewhere and so you know this is this is where freebies the where Net B is the result when a of these bugs in a list 60 blogs from this ship of fixed overnight it's of seriously seriously few of this is obviously what we present right so I don't know all you can do that but you to developers that zoological expects to ship with its right of so that was that was very impressive an it's also turn off the various Europe and this year for a compact subsystem then if you look at the commitment to set of the inelasticity in is ridiculous this set we disable the last year for by faults so there should be no Ontario and so that is the growing process and that was July 2000 tempting 5 months ago only let me tell you what happened since absolutely nothing but a fiction CBS but thermal patches for current kernel advisories and what this effectively means that you're running on a PC today all 60 bucks are there any nodes TV do CVS and see exactly what about this and so we see it followed up with some pattern advisories and that kind of it's sort of really really really well and they can drop the bomb they so back to my sort of a the earlier where I began position the UK or decent equal footing well I think but just over is defined in the DC girls probably about these than literal of evil b is the wasn't going there were certain things and and seal Musée but it was like it was hard to find in there and there's really very level quality between the 2 of them in all 3 of them and attains on the agent who wrote 1 what circumstances and the most consistent so quality I found by far was only the again this comes back to their rigorous review process right every every CBS checking gets called reviews I think that's a process that simply just works what exception to the ah idea and stuff you busy guys have to see if she could everybody else's that you'll be developers refuse to touch it and another thing I have also that that I I think should happen because I found it had a couple bugs words like OK this but still we have the ballistics and appears the or any other dierent where I go this is not the the video busy graphics 15 years ago right so that those things from time time did happen with some frequency common so ideally I think it is a to be of the should talk more amongst each other but state that that's always easier said than done because in the last 2 to 4 years they have diverged and there's different philosophies and ideas and word abuse supposed to go it obviously there there's a big egos involved as well as again these guys the talk isn't always the easier doesn't always make sense the biologically there's enough commonalities still between old PCs that it would make sense that when it comes to things the attack surface and and and and fixes it would probably make sense of these guys talked more with each other but the other thing is that obviously 1 comes to thing you know if you look at the code base alone that tells you something about attacks of tried right all B is the squirrel is about 2 . edu as cold that B is the is about 7 . 3 million in their PCs and is 10 point this is 11 points are the local is 1 of the series he was about 9 million right so that all right here tells you know these these 2 have less bugs because they have less code right it's studies and so this is this the
part where you can have a bug encoded you don't have right and then it is obviously a sort of accidental horses play work if if I haven't got divided by the sum given you get haven't yet right budgeting is obviously is that the plan was choices to make to delete call on purpose of this is something we assigned in all busy where you know they chose to leave devoted stack the chosen leader of the list about layer and obviously fidelity sort right you lose functionality BD insecurity and try to find that balance and Damasio cutting code you know that generally give you know it it cuts sector essentially means you have books I'm right so yeah what allusions and basically uh going back to where I and usually you had which was the many eyeballs thing I'm getting that's a factor I think it really does matter right and I think if you have more people look at something more books you could be found this I think 1 of the reasons why the numbers are often compared of tables initially I I think a large part of it is you know more people looking at this girl and so they're going to find more about this code quality can't explain everything of and you are right I mean if you say we want about people running this kernel but you know they're just orders of magnitude people more people looking at that culture justified more box and shows the numbers then I here that's pretty much it it the you that was right we also look at it OK I'm quite convinced the people and has a bunch of questions we got about 90 that's um let's start with you over there 1 sentence 1 question mark all of the euphoria of war and the CEO of the just are you interested in exploiting uh so you will had a crash to process and how about making a proof of concept love Iltis collision or the highest the amount could you should yeah given that my plan was to report all the bugs I saw going No . mindful will exploits because it's wasted effort right the only medially where I mean if I been write exploits I don't like I don't and they for but it's going to kill right side in the I mean somebody's but it would take me weeks or months to sit down and write code for our inside and I don't think it would have been very useful for me dreadful will exports but I know there's a shock and awe factor to experts and and at times they can be useful a given my understanding on my assumption that the people that and I was talking to people like the you know that better a very knowledgeable this area and feel was in need right to right next coincided that is the question of in things that I showing exploits usually helps to convince people and self-protection technique it acknowledges like we have our security and all that stuff but actually no I mean mitigation of a good thing and and you know we should we should keep innovating scoring mitigations but it just that I don't think this would contravene much to it about thank you very the question from the internet use the system to the dark side yes thank you for the dark side of how which is this is just to improve the cooperation between the different views these that that's a question I I mean I don't know I understand general I I don't use a few things about will your studies and thoughtful people because so so and so that how you know it they get these guys are really going to talk something and uh obviously data is that there are some differences in 2 and they're not the different things up today that you know waters differences is don't necessarily have to talk to each other in but I I can't I don't really know of any specific way to try to the sergeant get talked to each other all I all I can say is find is for great subsystems and if some guys fight thinks about it something would ago this attack surface you know reach out to the guy on the on the orders of you know you're B is the the real into cinemas dropped when he will be like a as maybe should still but beyond that I have neither no good answer OK thank you is there another question from the internet not yet not yet and about 1 last question we have 5 more minutes anybody at the microphone amount really see in there and again aware left excuse me yeah on my question was about methodology and using the automated to all you to everything by hand come from complex but yeah that's a bad the and yet uh well I didn't buy a 9 evidence of this thing was like straight up re-encodes just you know I will open up in uh idea of storing it through a couple times will use some graphs that look for some patterns of appeal that no is just me being cold so that was the which if there were no other tools involved thank the good take 1 more 1 more true yeah 1 more here if you want to that's a big chance I could describe your motivation of spending 3 months on the market that affect the I I know quote could be used for everyone I and again once heard it described being you know more boring than watching paint dry I disagree with that I actually I enjoy writing every encodes I I I think it's what I think there's a number of things you've learned from reading code but it's the it's sort of interesting to a kick from right like if I find a bug in pieces that something needs to the filled in the like all like all these who itself like a notice and then they didn't so that is a little bit of that but generally I yeah I I generally enjoyed there's of people don't but for me it was it was in the that water was the stretch I was I had no problem but it will save 3 people want signing on off of C of work and things so it's like evenings and weekends um but it wasn't it wasn't hard was difficult it was like OK what's problem I laptop and most the next you for I was looking at you know the system called or something but I didn't think it was hard to understand his of everyone but I I I I tend to enjoy what you Basic Input award of and thank you might my overseeing a questions somewhere no about your chance the Internet can hear this on the final question from the internet on why the is stay not be cooperating is that he's a common mission statement or any high-level thing they they could it at least agree on this is a non security is question I have no idea I'm hiding the people here probably much better placed nite densities kind of B is the questions God audio OK you if that's it thank you relate some of my own at 2 should be here a ng
yeah and the it kind thank you it can't compare the week but
Resultante
Hydrostatik
Kernel <Informatik>
Bit
Umsetzung <Informatik>
Demo <Programm>
Momentenproblem
Flächentheorie
Gruppenkeim
Befehl <Informatik>
Oval
Information
Sondierung
Kernel <Informatik>
Eins
Übergang
Softwaretest
Fahne <Mathematik>
Code
Gruppe <Mathematik>
Computersicherheit
Dateiverwaltung
Notepad-Computer
Strebe
Wurzel <Mathematik>
Substitution
Druckertreiber
Prototyping
Softwaretest
Sichtenkonzept
Datennetz
Kategorie <Mathematik>
Computersicherheit
Güte der Anpassung
Stellenring
Systemaufruf
Strömungsrichtung
Gleichheitszeichen
Systemaufruf
Arithmetisches Mittel
Rechenschieber
Dienst <Informatik>
Rechter Winkel
Zahlenbereich
Konditionszahl
Digitalisierer
Heegaard-Zerlegung
Garbentheorie
Explosion <Stochastik>
Schlüsselverwaltung
Normalspannung
Lesen <Datenverarbeitung>
Tabelle <Informatik>
Standardabweichung
Zeichenkette
Schnittstelle
Subtraktion
Kontrollstruktur
Quader
Penetrationstest
Zahlenbereich
Kombinatorische Gruppentheorie
Term
Whiteboard
Code
ENUM
Quellcode
Physikalisches System
Open Source
Datensatz
Flächentheorie
Datennetz
Schätzung
Softwareschwachstelle
Inverser Limes
Luenberger-Beobachter
Schreib-Lese-Kopf
Leck
Schätzwert
Expertensystem
Fehlermeldung
Wald <Graphentheorie>
Sondierung
Solar-terrestrische Physik
Paarvergleich
Einfache Genauigkeit
Mailing-Liste
Paarvergleich
Binder <Informatik>
Quick-Sort
Keller <Informatik>
Programmfehler
Flächeninhalt
Mereologie
Wort <Informatik>
Physikalischer Effekt
t-Test
Bildgebendes Verfahren
Touchscreen
Hydrostatik
Offene Menge
Kernel <Informatik>
Web log
Oval
Information
Eins
Physikalisches System
Freeware
Knotenmenge
Fahne <Mathematik>
Gruppe <Mathematik>
Statistische Analyse
Strebe
Datenstruktur
Leck
Statistik
Fehlermeldung
Stichprobe
Systemaufruf
Statistische Analyse
Binder <Informatik>
Quick-Sort
Druckertreiber
Flächeninhalt
Datenstruktur
Thread
Versionsverwaltung
Resultante
Offene Menge
Bit
Freeware
Flächentheorie
Information
Freeware
Datenmanagement
Kryptologie
Vorzeichen <Mathematik>
Code
Punkt
Quick-Sort
Urbild <Mathematik>
Druckertreiber
Gerade
Softwaretest
Schreiben <Datenverarbeitung>
Filter <Stochastik>
Physikalischer Effekt
Kryptologie
Stichprobe
Systemaufruf
Frequenz
Verkettung <Informatik>
Datenfeld
Forcing
Datenstruktur
Benutzerschnittstellenverwaltungssystem
Rechter Winkel
Festspeicher
Login
Lesen <Datenverarbeitung>
Fehlermeldung
Computervirus
Zahlenbereich
E-Mail
ROM <Informatik>
Code
Puffer <Netzplantechnik>
Physikalisches System
Ganze Zahl
Schwingung
Operations Research
Touchscreen
Autorisierung
Leck
Videospiel
Fehlermeldung
Datenmissbrauch
IPSec
Kreisfläche
Physikalisches System
Elektronische Publikation
Frequenz
Quick-Sort
Programmfehler
Druckertreiber
Last
Codierung
Hydrostatik
Freeware
Momentenproblem
Klasse <Mathematik>
Automatische Handlungsplanung
Symboltabelle
ROM <Informatik>
Ganze Zahl
Fahne <Mathematik>
Adressraum
Kontrollstruktur
Inverser Limes
Strebe
Fehlermeldung
Prozess <Informatik>
Raum-Zeit
Kryptologie
Stichprobe
Symboltabelle
Zeiger <Informatik>
Ordnungsreduktion
Druckertreiber
Thread
Zellularer Automat
Wort <Informatik>
Warping
Offene Menge
Hydrostatik
Subtraktion
Computervirus
Prozess <Physik>
Freeware
Flächentheorie
Symboltabelle
Socket-Schnittstelle
Code
Physikalisches System
Streaming <Kommunikationstechnik>
Freeware
Socket
Fahne <Mathematik>
Adressraum
Gruppe <Mathematik>
Kompakter Raum
Strebe
Emulator
Operations Research
Zeiger <Informatik>
Differenzenrechnung
Binärdaten
Umwandlungsenthalpie
Binärcode
Lineares Funktional
Fehlermeldung
Prozess <Informatik>
Raum-Zeit
Stichprobe
Speicher <Informatik>
Physikalisches System
Zeiger <Informatik>
Elektronische Publikation
Teilbarkeit
Quick-Sort
Konfiguration <Informatik>
Druckertreiber
Thread
Kompakter Raum
Residuum
Ordnung <Mathematik>
Versionsverwaltung
Kernel <Informatik>
Hydrostatik
Einfügungsdämpfung
Prozess <Physik>
Ausnahmebehandlung
Flächentheorie
Systemzusammenbruch
Oval
Information
ROM <Informatik>
Code
Division
Kernel <Informatik>
Richtung
Loop
Message-Passing
Zufallszahlen
Umwandlungsenthalpie
Code
Kompakter Raum
Strebe
Inhalt <Mathematik>
Zeiger <Informatik>
Default
Bildgebendes Verfahren
Leck
Umwandlungsenthalpie
Lineares Funktional
Fehlermeldung
Architektur <Informatik>
Fuzzy-Logik
Programm/Quellcode
Default
Stichprobe
Mailing-Liste
Ausnahmebehandlung
Binder <Informatik>
Quick-Sort
Garbentheorie
Wort <Informatik>
Decodierung
Lesen <Datenverarbeitung>
Nebenbedingung
Satellitensystem
Bit
Subtraktion
Prozess <Physik>
Flächentheorie
Mathematisierung
Term
Physikalische Theorie
Kernel <Informatik>
Spezialrechner
Physikalisches System
Bildschirmmaske
Code
Dateisystem
Gruppe <Mathematik>
Datentyp
Dateiverwaltung
Operations Research
Datenstruktur
Druckertreiber
Implementierung
Nichtlinearer Operator
Parametersystem
Elektronische Publikation
Sichtenkonzept
Extremwert
Fuzzy-Logik
Validität
Vektorraum
Physikalisches System
Lineares Funktional
Quick-Sort
Teilbarkeit
Roboter
Office-Paket
Arithmetisches Mittel
Druckertreiber
Mereologie
Basisvektor
Codierung
Speicherabzug
Tabelle <Informatik>
Chipkarte
Offene Menge
Prozess <Physik>
Web log
Freeware
Atomarität <Informatik>
Natürliche Zahl
Flächentheorie
Parser
Information
Sondierung
Eins
Stetige Abbildung
Freeware
Einheit <Mathematik>
Prozessfähigkeit <Qualitätsmanagement>
Code
Gruppe <Mathematik>
Protokoll <Datenverarbeitungssystem>
Dateiverwaltung
Strebe
Druckertreiber
Lineares Funktional
Dicke
Sichtenkonzept
Datennetz
Kategorie <Mathematik>
Physikalischer Effekt
Stichprobe
Systemaufruf
Plot <Graphische Darstellung>
Schwach besetzte Matrix
Ein-Ausgabe
Rechenschieber
Randwert
Rechter Winkel
Ein-Ausgabe
ATM
Prozessfähigkeit <Qualitätsmanagement>
Ablöseblase
Verzeichnisdienst
Speicherverwaltung
Lesen <Datenverarbeitung>
Zeichenkette
Fehlermeldung
Gravitation
Rückkopplung
Subtraktion
Mathematische Logik
Quader
Gruppenoperation
Content <Internet>
Physikalisches System
Puffer <Netzplantechnik>
Informationsmodellierung
Verzeichnisdienst
Unterring
Flächentheorie
Datennetz
Inhalt <Mathematik>
Datenstruktur
Leck
Videospiel
Fehlermeldung
Validität
Binder <Informatik>
Quick-Sort
Keller <Informatik>
Programmfehler
Chipkarte
Rahmenproblem
Druckertreiber
Mereologie
Bus <Informatik>
Luftreibung
Verkehrsinformation
Kernel <Informatik>
Offene Menge
Funknetz
Flächentheorie
Formale Grammatik
Rekursivität
Oval
Information
Hinterlegungsverfahren <Kryptologie>
Homepage
Richtung
Freeware
Standardabweichung
Vorzeichen <Mathematik>
Typentheorie
Code
Fahne <Mathematik>
Gruppe <Mathematik>
Mustersprache
Computersicherheit
Protokoll <Datenverarbeitungssystem>
Konditionszahl
E-Mail
Gerade
Dicke
Sichtenkonzept
Pufferüberlauf
Güte der Anpassung
Gebäude <Mathematik>
Stichprobe
Ausnahmebehandlung
Strömungsrichtung
Zeiger <Informatik>
Biprodukt
Garbentheorie
Verbandstheorie
Menge
Rechter Winkel
Kompakter Raum
Festspeicher
Konditionszahl
Sandwich-Satz
Computerunterstützte Übersetzung
Faserbündel
Subtraktion
Mathematische Logik
Hyperbelverfahren
Digital Rights Management
Automatische Handlungsplanung
Mathematische Logik
Open Source
Bildschirmmaske
Domain-Name
Knotenmenge
Modul <Datentyp>
Flächentheorie
Datentyp
Endogene Variable
Diffusor
Delisches Problem
Datenstruktur
Leck
Soundverarbeitung
Tropfen
Videospiel
Architektur <Informatik>
Default
Binder <Informatik>
Modul
Datenfluss
Programmfehler
Netzwerktopologie
Patch <Software>
Auswahlaxiom
Offene Menge
Gamecontroller
Wort <Informatik>
Orakel <Informatik>
Resultante
Punkt
Prozess <Physik>
Web log
Übergang
Kernel <Informatik>
Eins
Videokonferenz
Temperaturstrahlung
Mixed Reality
Strebe
Druckertreiber
Default
Schnitt <Graphentheorie>
Softwareentwickler
Physikalischer Effekt
Datenhaltung
Reihe
Systemaufruf
Ähnlichkeitsgeometrie
Quellcode
Frequenz
Widerspruchsfreiheit
Arithmetisches Mittel
Standardabweichung
Aggregatzustand
Rückkopplung
Gewicht <Mathematik>
Quader
Ortsoperator
Hausdorff-Dimension
Schaltnetz
Virtuelle Maschine
Gefrieren
Zahlenbereich
ROM <Informatik>
Punktspektrum
Code
Division
Ausdruck <Logik>
Ganze Zahl
Rendering
Polarkoordinaten
Digital Rights Management
Luenberger-Beobachter
Ordnungsreduktion
Strom <Mathematik>
Softwareentwickler
Zeiger <Informatik>
Meta-Tag
Beobachtungsstudie
Schätzwert
Graph
Mailing-Liste
Physikalisches System
Quick-Sort
Endogene Variable
Keller <Informatik>
Druckertreiber
Flächeninhalt
Differenzkern
Mereologie
Computerarchitektur
Verkehrsinformation
Kernel <Informatik>
Bit
Gewichtete Summe
Prozess <Physik>
Flächentheorie
Ungerichteter Graph
Diskrepanz
Kernel <Informatik>
Internetworking
Medianwert
Code
Mustersprache
Ordnung <Mathematik>
Auswahlaxiom
Lineares Funktional
Befehl <Informatik>
Sichtenkonzept
Teilbarkeit
Computersicherheit
Systemaufruf
Ein-Ausgabe
Exploit
Teilbarkeit
Dichte <Physik>
Transcodierung
Rechter Winkel
Zahlenbereich
Beweistheorie
Grundsätze ordnungsmäßiger Datenverarbeitung
Decodierung
Ordnung <Mathematik>
Tabelle <Informatik>
Größenordnung
Subtraktion
Quader
Wasserdampftafel
Stoß
Automatische Handlungsplanung
Zahlenbereich
Systemzusammenbruch
Code
Hypermedia
Systemprogrammierung
Flächentheorie
Notebook-Computer
Ordnungsreduktion
Beobachtungsstudie
Expertensystem
Mailing-Liste
Physikalisches System
Quick-Sort
Programmfehler
Summengleichung
Auswahlaxiom
Mereologie
Größenordnung

Metadaten

Formale Metadaten

Titel Are all BSDs created equally?
Untertitel A survey of BSD kernel vulnerabilities.
Serientitel 34th Chaos Communication Congress
Autor Sprundel, Ilja van
Lizenz CC-Namensnennung 4.0 International:
Sie dürfen das Werk bzw. den Inhalt zu jedem legalen Zweck nutzen, verändern und in unveränderter oder veränderter Form vervielfältigen, verbreiten und öffentlich zugänglich machen, sofern Sie den Namen des Autors/Rechteinhabers in der von ihm festgelegten Weise nennen.
DOI 10.5446/34827
Herausgeber Chaos Computer Club e.V.
Erscheinungsjahr 2017
Sprache Englisch

Inhaltliche Metadaten

Fachgebiet Informatik
Abstract In this presentation I start off asking the question „How come there are only a handful of BSD security kernel bugs advisories released every year?“ and then proceed to try and look at some data from several sources.
Schlagwörter Security

Zugehöriges Material

Video wird in der folgenden Ressource zitiert

Ähnliche Filme

Loading...
Feedback