Live data from Hacker News

SSHD: Random boot time relinking, OpenBSD

undeadly.org

41–50 of 55 posts

Re: SSHD: Random boot time relinking, OpenBSD

#41
post #36

Earlier quoted context omitted.

The assembler laid out the code within the sections and generally it's not changed after that (except for targets that do linker relaxation). However with -ffunction-sections the compiler would put each function in its own section which then can be independently relocated.

If each function is in its own section, then all function calls would need to be indirected through the PLT/GOT, even function calls within the same translation unit? Ouch.

No - the linker is there to resolve references among sections and can do so without PLT/GOT indirection when creating things like static archives.

There may be a code size cost in some architectures - that since the call destination can be relocated far from the call site that the assembler will need to make sure it allocates enough space to reach the call target instead of a small PCREL relocation.

Re: SSHD: Random boot time relinking, OpenBSD

#42
What impact will this have on anti-tampering software that looks for changes in executable checksums? Tripwire and OSSEC come to mind and both can report their findings to a centralized server. Do package manager integrity tests still work? I assume anyone here using BSD in a PCI environment have already figured something out. Some people also feed checksums into Splunk.

Re: SSHD: Random boot time relinking, OpenBSD

#43
post #21
post #19

Does anyone know an actually-happened example case where a fine-grained ASLR (like the OpenBSD relink one) successfully mitigates or significantly hinders an exploit, and the usual ASLR doesn't? I'm curious because years ago the academic strongly pushes the FG ASLR story, then OpenBSD did kernel relinking, but I haven't heard any industry story on how effective this is.

How would you measure that? How would you notice a failed attempt at finding a hole, of stack smashing, etc, if it did not even result in a crash, or any other dysfunction? Not a rhetorical question.

There are whitehats constantly looking at this sort of thing. It's why we can say that KASLR is a huge waste of time - because it's both theoretically bogus and we have actual exploit devs saying that they don't care about it.

Re: SSHD: Random boot time relinking, OpenBSD

#44

What impact will this have on anti-tampering software that looks for changes in executable checksums? Tripwire and OSSEC come to mind and both can report their findings to a centralized server. Do package manager integrity tests still work? I assume anyone here using BSD in a PCI environment have already figured something out. Some people also feed checksums into Splunk.

Very good point. As per Job snijder's own words [0], "the sshd binary becomes unique on every openbsd machine". So checksum-checking systems will indeed trip everytime.

[0]: https://marc.info/?l=openbsd-tech&m=167388832715992&w=2

Re: SSHD: Random boot time relinking, OpenBSD

#45
post #29

Takes some dedication to still be using CVS. Do they use another version control system to feed into CVS, or is CVS the tool they use directly?

There is a git mirror of the repo, and some devs use that for their own work. The project itself uses CVS for formal change commits.

Re: SSHD: Random boot time relinking, OpenBSD

#46
post #25

Earlier quoted context omitted.

A local package manager that performs the linking can save the hash of the result.

And the exploited program acquired root and changes the hash?

The hash can be uploaded somewhere. Alternatively a seed to randomize the executable can be derived from an immutable token like serial number.

Yet another solution is to re-sort the executable into a stable order and compare the hash of that.

Re: SSHD: Random boot time relinking, OpenBSD

#47
post #21
post #19

Does anyone know an actually-happened example case where a fine-grained ASLR (like the OpenBSD relink one) successfully mitigates or significantly hinders an exploit, and the usual ASLR doesn't? I'm curious because years ago the academic strongly pushes the FG ASLR story, then OpenBSD did kernel relinking, but I haven't heard any industry story on how effective this is.

How would you measure that? How would you notice a failed attempt at finding a hole, of stack smashing, etc, if it did not even result in a crash, or any other dysfunction? Not a rhetorical question.

It's not about failed attempt at finding a hole, it's about failed attempt at actually making use of a hole (i.e. write an exploit) given a hole.

(FG)ASLR is more of a "targeting at exploit instead of vulnerability" style mitigation.

Re: SSHD: Random boot time relinking, OpenBSD

#48
post #22

I remember how back in MS DOS days polymorphic viruses first appeared, in an attempt to avoid detection by antivirus software (useful and essential back then). Now the tables have turned, and legitimate software has to become somehow polymorphic to thwart attacks by malware.

Yes, the base idea is not that new. I store since years every GO based application I use as small (few kb) source code tree checkout only, no binary at all. At runtime the wrapper compiles a randomized individual one-time-temporary-uniq binary via garble [0]. [0] https://github.com/burrowers/garble

How do you ensure that your compiler and libs are clean though?

Re: SSHD: Random boot time relinking, OpenBSD

#49
post #20
post #17

Earlier quoted context omitted.

> So I am 100% for a fully predictable sshd random-relink kit, producing unpredictable sshd binaries, but only as long as there is an instruction how to check that the sshd binary that allegedly came from it indeed could have come from it, and was not quietly replaced by some malicious entity. You can easily verify the integrity of the object files that are used in the random relinking - they are included in the bina…

On OpenBSD all static system binaries are compiled as static PIE, so they already benefit from ASLR. The issue, IIUC, is that ASLR only randomizes entire ELF sections relative to each other. In any executable or library, whether static or dynamic, the code is placed into one giant .text section, so the relative offsets remain static. In a dynamic executable all library dependencies are loaded separately, so at least…

The ELF spec certainly allows for multiple .text sections, and one can also use totally custom sections with the correct attribute too.

Any linker that could not handle multiple identically named sections is simply buggy. That said, it is normal for a a linker to prefer to output only a single section of each name, but it is not difficult to get a linker to output multiple .text equivalent sections, especially if you make them have distinct names.

However section are not really what you want. PT_LOAD segments are, since those represent regions that get memmap'd contiguously. One can certainly put different executable sections into different segments.

I'm not 100% certain about how it works on OpenBSD, but on Linux, neither the kernel loader nor the loader embedded in the dynamic linker randomize the segments independently. The problem is that for dynamically linked code, the .text needs to be able to reference the GOT and PLT via relative addresses, so those segments must be loaded at a known distance relative to the code. For simple static PIE executables this should not be needed [1], however if you start introduce multiple chunks of code loaded at random addresses again, then you need to reintroduce similar concepts, as you cannot reference code in those other randomly placed chunks with a relative address.

Assuming things are at all similar in OpenBSD, to do what you are proposing, it would be needed to mark groups of segments that need to be loaded relative to each other, allowing other segment groups to be randomized with respect to each other. For code in one group to access globals or functions from the other, the linker would generate a GOT and PLT per group, similar to how dynamic linking works, but with simplifications since you know all the code that will be present, so don't need to worry about interposing, etc. In theory each GOT could get away with having as few as one entry per other segment group. [2]

Of course you would need code to initialize these GOT values. Realistically the static ELF loader would need to be augmented to provide the program with information about where it placed each segment group. Then the static PIE libc could include code that reads these offsets, and uses them to initialize the GOTs. If using the one entry per segment group approach and you place the GOTs a say the very start of each segment group, with the entries in segment group order, this would make for really simple initialization code. Of course, a more complicated relocation engine like a hyper stripped down dynamic linker would also be possible.

Footnotes:

[1]: Apparently on Linux even static PIE executables those have some amount of runtime relocation code that is needed (I'm not really sure what/why).

[2]: This is because the linker would know exact offsets of functions and variables within each segment group, so the code can simply load the other segment's pointer into a register using a relative addressing, and do the load/store/jump with that register plus the already known displacement into that segment group.

Re: SSHD: Random boot time relinking, OpenBSD

#50
post #46

Earlier quoted context omitted.

And the exploited program acquired root and changes the hash?

The hash can be uploaded somewhere. Alternatively a seed to randomize the executable can be derived from an immutable token like serial number. Yet another solution is to re-sort the executable into a stable order and compare the hash of that.

Actually, saving the hashes of the objects into the executable itself, into a new section, would be enough. Then one would need to locate this section, confirm that the hashes there form a permutation of the canonical ones, relink the canonical objects in the same order, and check whether the resulting executable is the same byte-for-byte.
Post reply on HN