4 ms·
Second there is really no excuse anymore not to move every OS over to randomised memory location access, and more. But even so I am not convinced this would hel
by matheist 10y ago
Second there is really no excuse anymore not to move every OS over to randomised memory location access, and more. But even so I am not convinced this would help here.
It might make it harder... but in this case couldn't an attacker search the entire address space for the location of the library? ASLR protects against buffer overflows as an attack vector, but here the attacker already has access.
(I'm no expert and would appreciate correction.)
- lifeisstillgood 10y agoTo be honest the attack space for 2 malicious bytes in a system of phones, routers, servers and applications consisting of what, trillions of bytes of code, is so mind bogglingly huge that even the experts arent experts. At some point we need to go back to secure kernels only a few thousand lines long and they ddole out permissions and access - making all attack vectors ridiculously harder. Can we do it? Will Facebook hand over its billions to the project? Will anyone?
- noir_lord 10y ago> Can we do it? Will Facebook hand over its billions to the project? Will anyone? At some point the cost of not doing it will exceed the cost of doing it, I'm not sure what it would actually take, shit security already costs tens of billions a year to the global economy and people just accept it.
- marcosdumay 10y ago> At some point the cost of not doing it will exceed the cost of doing it Will something like this really cost more than $900M?