5 ms·

Sure, it's not a panacea. But at least it gives a much better foundation than what we usually are having now.

• adrianN 10y ago
  How many of the exploits for IoT devices are related to the kernel? I have the impression that it's mostly poor protocols with default passwords and zero consideration for security that are the problem.
  • zeveb 10y ago
    The issue you raise is highly relevant — it's like having an IoT powerplug which is, indeed, UL-rated not to burst into flames and explode. That's great, but that doesn't mean that the software running on it won't send every packet on your home LAN to a router in Russia.
  • shandor 10y ago
    I won't pretend to having any kind of statistics on the matter. But the whole point is that usually in embedded systems, there is no separation between "application" and "kernel", at least on the low-end of CPU power scale. To be able to isolate application level problems from kernel would already be a huge boon. As a highly publicized anecdote, the Jeep hack of Miller and Valaseck was done by attacking through wireless, and replacing the CAN driver code to suit their needs. Not possible with proper isolation between critical system drivers and application layer.
    • tptacek 10y ago
      What does separation between kernel and application really matter for single-function devices, like most IoT things are?
      • pjmlp 10y ago
        If written in languages like C and C++, you just get the own the complete device when exploiting application errors. It can also happen when using unsafe code with the Ada, Java, Pascal and Basic variants available for such devices, but the probability is lower.
        • tptacek 10y ago
          Right, but if the device exists more or less to run a single program or small set of programs, what do I care if I own the box once I've taken control of that program?
          • wepple 10y ago
            the jeep hack (IIRC) got code exec in userland remotely, but relied upon talking to drivers to be able to flash the CAN chip. Of course, the whole thing was broken anyhow as everything was running root. But in almost everything else, I agree. I don't care if you have ring-0 on my Nest camera, because I'm more worried about network-level attacks or an attacker being able to read from the camera which (I'm guessing) is available via user space.
          • hackuser 10y ago
            You could run other programs on the box.
            • tptacek 10y ago
              Without some kind of formally assured way of building your application, you can do that anyways.
          • pjmlp 10y ago
            True, but by having everything on the same memory space, unless a memory safe language is being used, it means the amount of possible exploits is much higher, thus leading to an higher probability of owning the device. The isolation helps reducing the attack surface.
          • indolering 10y ago
  • mtgx 10y ago
    Only because that's still the low hanging fruit. Why would most hackers bother with kernel exploits, when hundreds of thousands of routers use their manufacturer's default password?
    • tptacek 10y ago
      This is almost tautological. Application vulnerabilities will always be the low-hanging fruit, because that's where the attack surface is. 20 years ago, an OS had juicy attack surface, because the bugs hadn't been shaken out of TCP/IP stacks and OS's shipped with stupid services enabled that nobody used. But it hasn't been 1998 for quite some time now.
• cvwright 10y ago
  Comments in this thread also illustrate why it's hard (and frustrating) to do constructive work in security. It's a big, complicated problem, and nobody's happy unless you solve it all at once. You could do the equivalent of solving world hunger and world peace, but unless you also give everyone in the world a free puppy, you're going to get bad reviews complaining about the lack of puppies. And there's always someone who wanted a kitten instead...
  • tptacek 10y ago
    I hope I'm not in this instance coming across that way! I like L4!