4 ms·

I won't pretend to having any kind of statistics on the matter. But the whole point is that usually in embedded systems, there is no separation between "applic

by shandor 10y ago

I won't pretend to having any kind of statistics on the matter. But the whole point is that usually in embedded systems, there is no separation between "application" and "kernel", at least on the low-end of CPU power scale. To be able to isolate application level problems from kernel would already be a huge boon. As a highly publicized anecdote, the Jeep hack of Miller and Valaseck was done by attacking through wireless, and replacing the CAN driver code to suit their needs. Not possible with proper isolation between critical system drivers and application layer.

tptacek 10y ago
What does separation between kernel and application really matter for single-function devices, like most IoT things are?
- pjmlp 10y ago
  If written in languages like C and C++, you just get the own the complete device when exploiting application errors. It can also happen when using unsafe code with the Ada, Java, Pascal and Basic variants available for such devices, but the probability is lower.
  - tptacek 10y ago
    Right, but if the device exists more or less to run a single program or small set of programs, what do I care if I own the box once I've taken control of that program?
    - wepple 10y ago
      the jeep hack (IIRC) got code exec in userland remotely, but relied upon talking to drivers to be able to flash the CAN chip. Of course, the whole thing was broken anyhow as everything was running root. But in almost everything else, I agree. I don't care if you have ring-0 on my Nest camera, because I'm more worried about network-level attacks or an attacker being able to read from the camera which (I'm guessing) is available via user space.
    - hackuser 10y ago
      You could run other programs on the box.
      - tptacek 10y ago
        Without some kind of formally assured way of building your application, you can do that anyways.
    - pjmlp 10y ago
      True, but by having everything on the same memory space, unless a memory safe language is being used, it means the amount of possible exploits is much higher, thus leading to an higher probability of owning the device. The isolation helps reducing the attack surface.
    - indolering 10y ago
      What if you can't take control of the program, like Ironsides? It seems as if your premise is that it's too complex to verify the application layer. However, you don't need to model every behavior in a program and this can be leveraged to reduce proofing overhead. A recent paper [1] produced <100 line security proofs for an SSH server, http server, and the SOP of a web browser. 1: https://pdfs.semanticscholar.org/bc9c/491e215d4abad1be7de94418fcfa2e2241bb.pdf https://pdfs.semanticscholar.org/bc9c/491e215d4abad1be7de944...

by shandor 10y ago

tptacek 10y ago

What does separation between kernel and application really matter for single-function devices, like most IoT things are?

pjmlp 10y ago
If written in languages like C and C++, you just get the own the complete device when exploiting application errors. It can also happen when using unsafe code with the Ada, Java, Pascal and Basic variants available for such devices, but the probability is lower.
- tptacek 10y ago
  Right, but if the device exists more or less to run a single program or small set of programs, what do I care if I own the box once I've taken control of that program?
  - wepple 10y ago
    the jeep hack (IIRC) got code exec in userland remotely, but relied upon talking to drivers to be able to flash the CAN chip. Of course, the whole thing was broken anyhow as everything was running root. But in almost everything else, I agree. I don't care if you have ring-0 on my Nest camera, because I'm more worried about network-level attacks or an attacker being able to read from the camera which (I'm guessing) is available via user space.
  - hackuser 10y ago
    You could run other programs on the box.
    - tptacek 10y ago
      Without some kind of formally assured way of building your application, you can do that anyways.
  - pjmlp 10y ago
    True, but by having everything on the same memory space, unless a memory safe language is being used, it means the amount of possible exploits is much higher, thus leading to an higher probability of owning the device. The isolation helps reducing the attack surface.
  - indolering 10y ago
    What if you can't take control of the program, like Ironsides? It seems as if your premise is that it's too complex to verify the application layer. However, you don't need to model every behavior in a program and this can be leveraged to reduce proofing overhead. A recent paper [1] produced <100 line security proofs for an SSH server, http server, and the SOP of a web browser. 1: https://pdfs.semanticscholar.org/bc9c/491e215d4abad1be7de94418fcfa2e2241bb.pdf https://pdfs.semanticscholar.org/bc9c/491e215d4abad1be7de944...