31–40 of 45 posts
Earlier quoted context omitted.
that is exactly what an MMU is for.
MMUs work on much larger regions than what is useful for many classes of memory safety issues. Luckily, ARMv8.5 adds support for memory tagging at a more granular level.
Earlier quoted context omitted.
Our qsort() caller is an application with at most 256 different comparators. Let us call that an ABI limit. The addresses are in read-only memory so they cannot be changed- new addresses simply cannot be introduced at run-time, so there is no risk of qsort being tricked into “jumping into the middle of a function”. The implementation of my qsort() does not need to know if there are fewer- the entry will be null and t…
This is a whole-program transformation though, it doesn't seem to be possible to make it modular. Unless you manage to map some module-specific dispatch table whenever you're running code from that module - in a way that cannot easily be subverted by exploit code! Not sure how to do this however.
You would need a linker script to collect the callbacks into a section and provide a symbol for the end, and define variables something like
int (my_sort_callback_ptr)(void , void *) __attribute__((section, "sort_callbacks"))=my_sort_comparator;
You would, of course, use a macro for that.
Is it technically possible to design a MMU that prevents a process reading or writing to a region of memory that don't belong to it?
Regarding ROP, that entire class of attack isn't possible if return addresses are stored in hardware that isn't accessible to the program.
> "[Stacks on the Mill architecture] contain no control flow information. In particular, no return addresses. The control stacks are maintained entirely within the hardware, inaccessible from programs. They get saved and restored by the Spiller as needed. This makes several classes of common security exploits simply impossible."
I’m guessing this was developed by or at the behest of Apple and ARM, based off the supported hardware and languages? Are any versions of the iOS or macOS kernel (or even user lands) utilizing this “across the board” now? I’d read papers and theory on strong pointer authentication to mitigate control flow attacks a very long time ago but I did not realize this was now “mainstream” in a consumer compiler (with support…
> AMD remains the only one to really offer hardware acceleration for SHA Intel added SHA with Goldmont, for smaller laptops. But it's only SHA1 and SHA2, which are already outdated. Good enough for ptrauth though.
I forecast it would get impossible to hack a personal computer in 10 years. Maybe there would be some vulnerability left on IOT devices
There are so many mitigation techniques out there to protect against any execution takeover attacks.. and I wonder how exploiters survive through them. I forecast it would get impossible to hack a personal computer in 10 years. Maybe there would be some vulnerability left on IOT devices
Let's say you have really good security hygeine, apps and sites are whitelisted, no exploits are possible, things can't execute from removable drives,etc... What happens when someone you know sends you an email containing a link to a whitelisted service (say onedrive,dropbox,etc...) and that link downloads a zip file with a malicious jar,javascript,mshta,macro enabled document basically any thing that uses a whitelisted app to run some code? Let's say your email security is top notch, are you gonna ban peoplr from accessing their personal email? Let's say you do,what if a whitelisted site has XSS used to inject JS that tells the user "you need to download and install this font to view this site" (something I have seen) even if you whitelist everything there are bypass techniques,code signing certs get compromised, a new technique to use some existing known app to run code may exist,etc...
I think initial access will get a lot more difficult but not impossible. Up to the point someone can run code,it will be very difficult to lock down well,but there is a lot that is being done to harden systems and monitor events to catch when someone does something afterwards.
I personally think endpoint software and technology continues to get more and more complicated. I can see big companies being resilient to many types of attacks but consumers in general are too denseless.
Take something as simple as a usb worm, a company might make a calculated decision to block usb exexution but what laptop will ship with that turned off? A windows shortcut (lnk) running a whitelisted executor will continue to be abused for at least 5 more years but I dare not speculate as far as 10 years.
Earlier quoted context omitted.
> AMD remains the only one to really offer hardware acceleration for SHA Intel added SHA with Goldmont, for smaller laptops. But it's only SHA1 and SHA2, which are already outdated. Good enough for ptrauth though.
If you care about speed and are concerned about sha1/2 vulnerabilities, maybe take a look at blake2? Faster than sha1, probably a similar level of security as sha3 (it is a redesign of a finalist for sha3). It's also the default for nacl/sodium. https://blake2.net/
Blake2 is about a factor of 1000 slower. Secure hashes are not really applicable for pointer hashing (i.e. 48bit). Some need 16byte alignment (but you can use a stack word for that), some need excessive padding. Here the padding will kill you.
Earlier quoted context omitted.
Hardware Address Sanitizer is intended to protect against memory corruption in general, while pointer authentication helps ensure code flow integrity. (And I think it's mutually incompatible with the implementation that iOS uses because they both use TBI).
They can be compatible. Memory tagging does use the TBI bits. Pointer authentication uses an arbitrary number of bits, and the kernel configures the width and whether the TBI bits are preserved. So you can use both, it just costs you 8 bits of signature. Moreover, this can be configured independently for code and data pointers. iOS turns off TBI on code pointers to get 8 more bits of signature. That's not a problem f…
Ooh, this is cool. Does iOS currently use different signature sizes? Can I write an application that uses the top bits of data pointers?
Earlier quoted context omitted.
If you care about speed and are concerned about sha1/2 vulnerabilities, maybe take a look at blake2? Faster than sha1, probably a similar level of security as sha3 (it is a redesign of a finalist for sha3). It's also the default for nacl/sodium. https://blake2.net/
Nope. ptrauth needs a good hash in Hardware. There's only crc32c, aes, sha1 (-160) and sha256 (i.e. sha2-256). Of these crc32c is entirely insecure, aes not applicable, so we are left with AMD, Intel laptops (Goldmont), armv8 and Power8. For sure we don't care about any SHA vulnerabilities here, only about speed. Blake2 is about a factor of 1000 slower. Secure hashes are not really applicable for pointer hashing (i.e…