12 ms·
OpenBSD Will Get Unique Kernels on Each Reboot
- ConfucianNardin 9y agoPreviously: https://news.ycombinator.com/item?id=14542874 https://news.ycombinator.com/item?id=14542874
- drdaeman 9y agoJust curious - how would they deal with kernel crash dumps?
- dimman 9y agoIt was the first thing that popped into my mind at first too but then I started thinking about it and out of the top of my head the only issue I could think of would be if symbols are stripped (you can't "load them from another kernel"). But as long as they're in there I think there shouldn't be any problems? But please elaborate on what you mean with the "deal with" part.
- rbanffy 9y agoWouldn't the symbols being there defeat the purpose of the whole randomization thing?
- vbernat 9y agoThe purpose is to defeat a generic exploit. For example, with ASLR, it's easy to retrieve the current layout of the processus and therefore to debug it (if you have the appropriate symbols) despite the randomization. But an exploit has to be built for the specific instance of the application running. If you share the same privileges as the process, you can get the current mapping but an exploit is useless. If you don't, you don't have access to the mapping either and it's difficult to get it while you are executing code inside the process as you can't easily access the functions you would need for that.
- trelliscoded 9y agoBinutils has had debuglink support for, like, a decade now. OpenBSD uses it to put the symbols in a separate file. gdb knows how to find it using information in the executable.
- gbrown_ 9y agoThe re-link is recorded so if you needed can reproduce the same kernel. But as dimman has said you will have symbols.
- brynet 9y agoThe relative offsets within individual compilation units is the same, so debugging is unaffected by this.
- cat199 9y agoNot entirely true - e.g. if your stack is hosed, etc, things could be affected Also, much of kernel debugging involves poking at core images, which wouldn't be coherent with the kernel binary. That said, I'm fairly certain I recall reading that the logic saves your previous kernel for such a case, and otherwise someone could make scripts to save more copies if needed. Others have pointed out reconstructing kernels for debug purposes.
- wolfgke 9y ago> Having KARL on other OS platforms would greatly improve the security of both Windows and Linux users. This is surely true, but at least on Windows the central security holes do not lie in Windows itself (these kinds of holes exist - but exploits are very expensive, which shows that they are typically rare and not easy to exploit), but in third-party applications. For example the current 2017 version of the Petya ransomware was spreaded via a security hole in the software update mechanism in the Ukrainian tax preparation software M.E.Doc. Other well-known attack vectors that are commonly used to attack Windows PCs are Flash Player and the Java browser plugin.
- _asummers 9y agoDon't forget fonts!
- wolfgke 9y ago> Don't forget fonts! It is today considered a design mistake that GDI was moved to kernel mode in Windows NT 4.0 for performance reasons (https://en.wikipedia.org/w/index.php?title=Architecture_of_Windows_NT&oldid=782493134#Executive https://en.wikipedia.org/w/index.php?title=Architecture_of_W...). But with Windows 10 Anniversary Update font parsing is done in user mode within an AC ["AppContainer"] (source: https://blogs.technet.microsoft.com/mmpc/2017/01/13/hardening-windows-10-with-zero-day-exploit-mitigations/ https://blogs.technet.microsoft.com/mmpc/2017/01/13/hardenin...).
- _asummers 9y agoOh, I didn't know that! I haven't used Windows in any serious capacity since 7, so that's refreshing to hear.
- twoodfin 9y agoWas it really a mistake in a practical sense? Does Microsoft move their consumer base to the NT kernel via XP a few years later (a massive win for their platform overall) if GDI performance had to take a big hit?
- andrew_ln 9y agoAnd why would you ever reboot openbsd computer? :)
- qubex 9y agoTo watch KARL do it's thing!
- peedy 9y agoTo upgrade to a new snapshot :)
- tzs 9y agoTo verify that it still boots correctly after an update. If an update does something that breaks your startup sequence it generally is much better to find out about it right away than it is to find out about years later in the middle of the night when you get a forced reboot due to hardware or power issues, and find that things are broken and you have no idea which of a dozen allegedly minor updates broke it.
- nwmcsween 9y agoThen the package manager is broken on your OS of choice, the package manager (or another related utility) should ensure whatever it updates or installs actually works.
- dsr_ 9y agoPlease tell me about this method of writing bug-free software and building bug-free hardware that you have; I am very interested. Can you also detect whether a program will loop forever?
- still_grokking 9y ago> Can you also detect whether a program will loop forever? Assumed the current state of knowledge about our universe no program will loop forever. But maybe our universe is a kind of infinite loop by itself. Who knows.
- brynet 9y agoIn addition to a new kernel at boot, several libraries in base are also randomly re-linked, including libc and libcrypto, which are prime targets. https://marc.info/?l=openbsd-cvs&m=149605105003964&w=2 https://marc.info/?l=openbsd-cvs&m=149605105003964&w=2 https://marc.info/?l=openbsd-cvs&m=146168291000757&w=2 https://marc.info/?l=openbsd-cvs&m=146168291000757&w=2 This means that in addition to the dynamic linker loading libraries at random addresses, in a random order, the offsets inside the library itself are different on each boot, and on each system. Robert Peichaer (rpe@) added the kernel re-linking at install/upgrade: https://marc.info/?l=openbsd-cvs&m=149884116824098 https://marc.info/?l=openbsd-cvs&m=149884116824098
- danesparza 9y agoAny ideas how these are randomized? Just wondering if these are still vulnerable to a timing attack...
- brynet 9y agoWhat part? At least for the library randomization, a special libc.so.X.Y.a is part of the base install, objects are extracted with ar(1), and then re-linked in a random order (sort -R/arc4random(3)) to create a working shared library. The kernel has a similar reordering stage, best explained by Theo de Raadt: https://marc.info/?l=openbsd-tech&m=149887978201230&w=2 https://marc.info/?l=openbsd-tech&m=149887978201230&w=2 The full implementation is in the tree.
- wlesieutre 9y agoIsn't secure random number generation a problem immediately after boot? Curious what arc4random is using as an entropy source.
- problems 9y agoMany modern systems have hardware RNGs, but they may also be using stored seeds.
- perlgeek 9y agoIf the kernel image is different each time, you can't verify its integrity through a checksum. I'm curious to hear from people working in infosec: is that real problem? How do you see the tradeoff?
- hobarrera 9y agoYou could generate a checksum each time you generate a new kernel. If you need some pre-kernel checksum validation, that might be a problem though.
- clarry 9y agoIn fact OpenBSD already generates a checksum for each kernel.
- Ded7xSEoPKYNsDd 9y agoYou could just feed the individual kernel symbols in a canonical order (i.e. sorted) to the checksum algorithm. It's a bit more involved, but since boot loaders like Grub already have ELF parsers, it shouldn't be too hard.
- clarry 9y agoI haven't noticed any boot time checksum verification on Linux or OpenBSD in the past 15 years. If it's there, I've missed it. But it doesn't seem like this change introduces a new problem. Secure boot springs to mind, but that's something you probably have to disable anyway to run OpenBSD... Think about this angle: if you're concerned about infosec, and there is a malicious actor with the capability to replace your kernel (which you don't do unless you're root), you do have a real problem. Even if the kernel were verified at boot time, that same actor should have countless other attack vectors. But it's something worth considering if a tursted chain from machine firmware all the way to the application level is established. It's not there yet. What is the solution when you need to upgrade some kernel or program and the new version has a different cheksum? I don't see why that same solution, whatever it is, wouldn't work in the relinking case.
- 9y ago
- CGamesPlay 9y agoWhat is the attack vector on KASLR that KARL prevents? My best guess: A leaked kernel pointer could be used to find an offset for the KASLR kernel, and that offset could produce a working payload for some other unrelated kernel shell code exploit. If that's correct, KARL seems like a pretty fringe improvement over KASLR. Can anyone educate me?
- dobin 9y agoKASLR just requires ONE leaked pointer to calculate base offset of the kernel, and from there is the standard ROPchain technique. The kernel is still one big identical blog, just mapped at a different starting address. If i understand KARL correctly, they reorder the internal code (and data?) in the kernel. Therefore a single pointer-leak does not expose all the ROP gadgets anymore. More information leak is necessary, or a smaller amount of gadgets. Therefore imho this is a much better protection than KASLR.
- module0000 9y agoI don't think it's meant to be a massive improvement - just another one of the many barriers you want to put in front of an attacker. Assume they will get through, but make it as difficult as possible in the hopes that reduces the people who attempt it.
- brian_herman 9y agoOr make it as difficult as possible so it will eat up the attacker's time.
- lawnchair_larry 9y agoThat's exactly it, more or less. KASLR is almost always useless in practice because there are so many ways to leak kernel pointers that most seasoned researchers are convinced that this will never be plugged. Even if they are, it's often the case that the same bug you are exploiting can also be used to leak enough information. Here is a long anti-ASLR rant by the folks who invented the ASLR mitigation in the first place, explaining why attempts to repurpose the idea for kernel attacks are misguided: https://forums.grsecurity.net/viewtopic.php?f=7&t=3367 https://forums.grsecurity.net/viewtopic.php?f=7&t=3367 I agree that it is probably not a meaningful improvement.
- rsync 9y agoI have not followed these features - are they proposed in any way for adoption in FreeBSD ?
- quanticle 9y agoWhat's the performance impact of this? Are OpenBSD reboots suddenly going to take 5-10 minutes because the kernel has to be re-linked?
- pklausler 9y agoDistinct, not unique, I believe.
- dchest 9y agoRandom linking of at least 160 files will give more combinations than there are atoms on Earth. I counted 1206 *.o files in OpenBSD kernel. Unique enough?
- pklausler 9y agoDistinct enough, sure. Unique means something else.
- notaplumber 9y agoThat's a very shiny pedant.
- dchest 9y agoOh, I'm sorry, unique in the current Universe from its birth many many trillions of trillions of years until after the death of all currently known galaxies. Still not unique? No other OpenBSD installation had or will ever have the same kernel, so each kernel is unique.
- pklausler 9y agoYou seem to think that I'm arguing that collisions might be a problem. I'm not. I'm raising a point of English usage. "Unique" is not the right word to use in this context; "distinct" is correct. If a set has a single member, that member is unique; e.g., 2 is the unique even prime number. If a thing is different from all other things, it's distinct.
- Gracana 9y ago> You seem to think that I'm arguing that collisions might be a problem. To be fair, your short original post left readers free to guess at which unnecessarily pedantic point you were trying to make.
- kbradero 9y agois there any book/document about building embedded systems with openbsd/netbsd/freebsd ?
- cat199 9y agoEmbedded, not so sure. Depending on your definition of 'embedded', you might look at the various wireless router repackagings and scripts that are available.. Also, the NetBSD 'rump' kernel might be an interesting thing to review. Generally speaking, the projects overall have excellent documentation, including manual pages or HTML docs on kernel, c library interfaces, building the system and packages from source, etc. Also, the whole system is in the source tree, which can be downloaded as a set. Otherwise: OpenBSD in general: There's "Absolute OpenBSD', kind of more 'user/admin' level. For lower-level stuff like API's, kernel organization, etc, the McCusick books (Design and implementation of the {4.3BSD,4.4BSD, FreeBSD} Operating System), though either dated, or more specific to FreeBSD, respectively, still cover quite a bit of stuff that still applies to OpenBSD (most changes have been incremental, and can be tracked through the source tree history back to the original USG sources if needed) I'd suggest running an install 'from source' on a spare machine/vm/etc for a while and reading docs and the source tree this will get you familiar enough with the system to have an idea where to go next.
- ta34512 9y agoI guess this is more of a quick start but along the lines: https://www.freebsd.org/doc/en/articles/nanobsd/index.html https://www.freebsd.org/doc/en/articles/nanobsd/index.html
- deleted 9y ago[deleted]
- giovannibajo1 9y agoNice technique but it cannot be used in a secure boot chain. Maybe that's not an issue in most contexts OpenBSD is used into, but if I were to choose I wouldn't turn off secure boot to activate this feature.
- jethro_tell 9y agowhy can't it be used in a secure boot? The image and checksum are created at the end of last boot, so it could be signed then. If the bootloader is signed it should be able check the kernel.
- Iv 9y agoDoesn't this prevent using UEFI secure boot mechanisms?
- trelliscoded 9y agoYes.
- idealpersona 9y agoI am grateful that OpenBSD exists, but I find it sad that the most novel advances employed in systems security are layers of security/obscurity over vulnerable systems, instead of advances in intrinsically secure systems. Type-safety would eliminate a large class of vulnerabilities in systems software. We enjoy such benefits at the application layer, but systems software is far behind.
- warsharks 9y agothe more i hear about OpenBSD the more i like it, i really should do more with it as my current experience begins and ends at using pfsense (well and a PS4 which i believe runs a BSD based OS if you count that)