4 ms·
"No system calls" Yeah, they're direct function calls now. How exactly is that more secure? The author's right that many traditional exploit paths are gone,
by notacoward 9y ago
"No system calls"
Yeah, they're direct function calls now. How exactly is that more secure? The author's right that many traditional exploit paths are gone, but only because they've been replaced by even easier ones.
- wmf 9y agoThey assume that 99% of libc was stripped out at build time. The full network stack is probably there but there might not be much filesystem code.
- robotresearcher 9y agoBecause you don't know how to call the functions, as explained in the article. To call a function, you need to know its address among other things. And you don't, since the address was decided at random at build time (or even boot time in some systems).
- notacoward 9y agoThere are other ways to find functions besides knowing their addresses a priori.
- robotresearcher 9y agoHow is this done? I think kernels try not to leak the address of system calls at run time, and if they are scattered around in a 64bit address space they are tough to search for. Educate me!
- xorcist 9y agoI have no idea, but couldn't you use some part of the software you just compromised that makes syscalls?
- robotresearcher 9y agoThere are no syscalls as the fine article explains.
- robotresearcher 9y agoAh, wait, I mis-read your comment and it's too late to edit mine. Yes, that sounds plausible, and particularly if you have the source code, which you do for many common servers.