3 ms·

How's FreeBSD doing in the exploit mitigation department? Last I checked, they didn't even have ASLR. http://networkfilter.blogspot.com/2014/12/security-open

• deleted 11y ago
  [deleted]
• corv 11y ago
  HardenedBSD http://hardenedbsd.org/ http://hardenedbsd.org/ has completed a fork of FreeBSD with ASLR.
• floatboth 11y ago
  HardenedBSD has ASLR, they're working on upstreaming it to FreeBSD.
• mhandley 11y ago
  I'm not sure I'd place much faith in ASLR these days. Bittau's Blind Return Oriented Programming (BROP) http://www.scs.stanford.edu/brop/ http://www.scs.stanford.edu/brop/ makes that only a speedbump, not a real obstacle, for any server that suffers from a stack overflow vulnerability and respawns after a crash. Basically, you can read the return address off the stack a byte at a time by detecting the difference between a crash (you got the overflowed byte wrong) and no-crash (you got the overflowed byte correct). Doesn't take long to recover the return address, and hence find the text location. Their paper is a really fun read!
  • unluckier 11y ago
    We all know that exploit mitigations aren't perfect. But to not even bother using them... that's just ridiculous. There are plenty of scenarios where ASLR helps prevent exploitation. And the fact that FreeBSD doesn't even have it is pretty damning.
    • mhandley 11y ago
      I didn't say not to bother; I just said the protection provided by ASLR is weaker, even on 64-bit systems, than most of us believed a couple of years ago.
      • unluckier 11y ago
        It's the FreeBSD folks that didn't bother. Not you.