SEI Insights

> Is there any realistic threat model under which the difference between 10 minutes and 70 minutes is the difference between "insecure" and "secure"?

Time is given here just for an example. To crack systemd, it only takes 70 minutes, but in general, bruteforcing ASLR on 64-bit systems can take as few as 1.3 hours but as many as 34.1 hours, depending on the nature of bug. On the other hand, the ~20-bit of entropy on 32-bit systems is trivial to crack in 10 minutes for nearly all cases, and does not provide an adequate security margin.

Oon a 64-bit system there is ~32-40 bit of ASLR entropy available for a PIE program. It forces an attacker to brute-force it. Unlike other protections, no matter how is the system cleverly analyzed beforehand, it taxes the exploit by forcing it to solve a computational puzzle. This fact alone, is enough to stop many "Morris Worm"-type remote exploitations (they have suddenly became a serious consideration, given the future of IoT), since an exploit takes months or years to crack a single machine.

If it's not enough (it is not, I acknowledge ASLR by itself cannot be enough), an intrusion detection system should be used, and it already has used by many. For example, PaX offers an optional, simple yet effective anti-bruteforce protection: if the kernel discovers a crash, the `fork()` attempt of the parent process is blocked for 30 seconds. It takes years before an attacker is able to overcome the randomization (so the attacker is likely to try…

I usually find it safe to assume that compiler folks are conscious of optimization opportunities and make pretty intelligent tradeoffs on that spectrum. This is one such case. There's a long history of bounds checking compilers. The first that I know of is bcc in the 80s, which had a 10x slowdown! Austin et al. [1] came along a few years later way back in '94 and improved things to a mere 2-5x slowdown. That's pretty much where things stood for the next two decades because pointer accesses are everywhere in C and register pressure is nothing to sneeze at. Moreover, changing pointer sizes breaks your ability to link external things that weren't compiled with the same flags, like the system libc. ABI compatibility is make-or-break for a C compiler. You can get around that by breaking up the metadata from the actual pointer (e.g. softbound), but the performance cost is still ~3-4x [2].

ASAN was notable because

1) it was very efficient. That initial 73% was utterly fantastic at the time.

2) It was production-usable (i.e. worked on big codebases)

3) With hardware support, the performance hit is often under 10%. HWAsan on modern platforms is low-cost enough to run it all the time.

And no, I'm saying that pretty much every nontrivial C program has UB, not that they're specifically memory unsafe.

[1] https://minds.wisconsin.edu/bitstream/handle/1793/59822/TR1197.pdf?sequence=1
[2] https://insights.sei.cmu.edu/blog/performance-of-compiler-assisted-memory-safety-checking/

SoftICE was one of the most amazing utilities out there both for debugging as well as reverse engineering. The Wikipedia page is spot on about WinDbg/KD, but pretty out of date re: modern tools. Ollydbg2 came out more than half a decade ago and supports all the 64 bit registers and x86-64 instruction set. Immunity Debugger took the place as the defacto standard, and most modern scripts and tooling are built around Immunity for dynamic analysis and IDA Pro for static analysis. IDA Pro adopted QT natively, so the plugin communities are extending the hell out of what was already a great tool, and there are good plugins that export annotations/symbols that Immunity can consume so the union between static and dynamic analysis has never been smaller. If you don't have an IDA license, Immunity combined with Radare (read down) is still pretty powerful to play around with. Either way, the reverse engineering stuff out there is quite simply amazing.

https://github.com/aquynh/capstone

https://github.com/REhints/HexRaysCodeXplorer (this is CRAZY useful if you bought the Hex Rays license with IDA)

https://github.com/ynvb/DIE - makes IDA even better ("DIE is an IDA python plugin designed to enrich IDA`s static analysis with dynamic data)

https://portal.cert.org/web/mc-portal/pharos-static-analysis-tools - I haven't used this yet but Pharos is a static analysis tool out of Carnegie Melon that's particularly useful for C++ gen'd code.…

5 paragraphs of Silver Bullet Magical Thinking nonsense to get to the actual bill, which is basically calling for a study and recommended guidelines for OSS security - of which there are several already, including one from the DoD [1].

I see nothing new or useful here, what am I missing?

"The Securing Open Source Software Act would direct CISA to develop a risk framework to evaluate how open source code is used by the federal government. CISA would also evaluate how the same framework could be voluntarily used by critical infrastructure owners and operators. This will identify ways to mitigate risks in systems that use open source software. The legislation also requires CISA to hire professionals with experience developing open source software to ensure that government and the community work hand-in-hand and are prepared to address incidents like the Log4j vulnerability. Additionally, the legislation requires the Office of Management and Budget (OMB) to issue guidance to federal agencies on the secure usage of open source software and establishes a software security subcommittee on the CISA Cybersecurity Advisory Committee."

[1] https://insights.sei.cmu.edu/blog/taking-up-the-challenge-of-open-source-software-security-in-the-dod/

I wonder how much DBus (the Inter-Process-Communication (IPC) standard Linux desktops have been based around) is baked into QNX & instrumental to it! Maybe I can find out now?

https://ioactive.com/pdfs/IOActive_Remote_Car_Hacking.pdf or https://insights.sei.cmu.edu/blog/vehicle-cybersecurity-the-jeep-hack-and-beyond/

That was such a time. It's sad that it was a security panic, to me, because there was incredible promise there... All of the cars infotainment, windows, interior lighting, HVAC, all these things are just DBus services hosted on QNX? And I can just connect to my car & modify them, in some cases even over the air? QNX & DBus could have been a huge selling point, could have been such an awesome way to debundle the car from its infotainment. If only.

Really interested to see if DBus really does underpin much of QNX, or whether this was just a time & place. Seeing how monolithic versus networked QNX is in general would be fascinating; is there one or two QNX hosts & lots of devices, or so the story more distributed that that?

So has any person or organization done a statistical survey of a body of bug reports (like CERT) and characterized how many bugs are memory safety related?

I see this SEI blog entry [1] that cites a report, with a bitrotted link (I think it's [2]). The blog summarizes the report associating buffer overflow as a source of "14 percent of software security vulnerabilities and 35 percent of critical vulnerabilities making it the leading cause of software security vulnerabilities overall." Though it seems to be the easiest to track and a leading error, buffer overflow is only one category of memory safety problem.

[1] https://insights.sei.cmu.edu/sei_blog/2014/08/performance-of-compiler-assisted-memory-safety-checking.html

[2] https://courses.cs.washington.edu/courses/cse484/14au/reading/25-years-vulnerabilities.pdf