"Protection from zero-days" -- how can you make a claim like this?
It does seem like a ridiculous claim
CopperheadOS: A hardened open-source operating system based on Android
21–30 of 105 posts
Re: CopperheadOS: A hardened open-source operating system based on Android
#22Earlier quoted context omitted.
I'm not affiliated with Copperhead at all, but I am familiar with the sorts of techniques they are using. Exploit mitigations, such as Address Space Layout Randomization, Control-Flow Integrity, Fine-grained Randomization, etc. provide a layer of hardening to make exploitation of a source code vulnerability harder, or even not possible on the protected device. The bug (zero-day) still exists, it's just not as exploit…
ASLR is already a part of pretty much every current operating system ( save FreeBSD-RELEASE )
Indeed, I was trying to give well-known examples. Some of the more interesting, not widely-deployed PaX mitigations are more accurate here.
Re: CopperheadOS: A hardened open-source operating system based on Android
#23This project seems interesting but largely impractical until a truly independent FOSS app store exists with a wide selection + security track record as good as Google Play or iTunes. I don't see how it gets there with such a narrow hardware selection.
> security track record as good as Google Play or iTunes
Do they have great security track records? I know a lot of the integrations like games into their systems are terribly insecure.
Re: CopperheadOS: A hardened open-source operating system based on Android
#24This is a hoenypot for the NSA
Do you mean, "this is a honeypot put out by the NSA, to see who wants this"? Or do you mean, "this is an attempt by the developers to see how the NSA tries to subvert, sabotage, or otherwise compromise their project"?
Re: CopperheadOS: A hardened open-source operating system based on Android
#25"Protection from zero-days" -- how can you make a claim like this?
If a zero-day is found in standard Android (ala Stagefright) it's possible it won't be exploitable on Copperhead because of the hardened malloc, overflow protections, bounds sanitizing etc.
Re: CopperheadOS: A hardened open-source operating system based on Android
#26This project seems interesting but largely impractical until a truly independent FOSS app store exists with a wide selection + security track record as good as Google Play or iTunes. I don't see how it gets there with such a narrow hardware selection.
> security track record as good as Google Play or iTunes Do they have great security track records? I know a lot of the integrations like games into their systems are terribly insecure.
No. That is why I'm using them as the minimum standard. :p
Re: CopperheadOS: A hardened open-source operating system based on Android
#27Earlier quoted context omitted.
I'm not affiliated with Copperhead at all, but I am familiar with the sorts of techniques they are using. Exploit mitigations, such as Address Space Layout Randomization, Control-Flow Integrity, Fine-grained Randomization, etc. provide a layer of hardening to make exploitation of a source code vulnerability harder, or even not possible on the protected device. The bug (zero-day) still exists, it's just not as exploit…
ASLR is already a part of pretty much every current operating system ( save FreeBSD-RELEASE )
Not all ASLR implementations are equal, eg. PaX's ASLR vs standard Linux KASLR.
Re: CopperheadOS: A hardened open-source operating system based on Android
#28Earlier quoted context omitted.
I'm not affiliated with Copperhead at all, but I am familiar with the sorts of techniques they are using. Exploit mitigations, such as Address Space Layout Randomization, Control-Flow Integrity, Fine-grained Randomization, etc. provide a layer of hardening to make exploitation of a source code vulnerability harder, or even not possible on the protected device. The bug (zero-day) still exists, it's just not as exploit…
ASLR is already a part of pretty much every current operating system ( save FreeBSD-RELEASE )
ASLR is a band-aid. If you need it, your system is already insecure. It's just that the attacker may need to crash your system a few times before they get in.
Re: CopperheadOS: A hardened open-source operating system based on Android
#29"Protection from zero-days" -- how can you make a claim like this?
It's how you interpret "protection." They didn't say you'd be "protected from all" zero-days.
Re: CopperheadOS: A hardened open-source operating system based on Android
#30"Protection from zero-days" -- how can you make a claim like this?
They complete text is:
Protection from zeroDays Prevents many vulnerabilities and makes exploits harder
So they don't claim to provide immunity from zero days, but