3 ms·

The mitigations probably do increase exploit difficulty. I still think most of the security is much like we saw with Mac's years ago: virtually nobody targets t

The mitigations probably do increase exploit difficulty. I still think most of the security is much like we saw with Mac's years ago: virtually nobody targets them. The mitigations in CompSci, such as CFI, often get broken when another team spends some time on them. Those talented folks probably only attack a tiny sample of designs, though. Much like black hats who go wherever the users, data, and money are. The more return for attack, the more they focus on that platform. That's mostly Windows, Linux, iOS, and Android. Right now, I assume any "success" of OpenBSD's mitigations are a mix of (small one) actual increases in difficulty and (big one) benefit of being obscure system best breakers aren't interested in. Long as they're uninterested, it should stay safe from most attackers regardless of which mitigations they use. Much like Mac was with hardly any security. We won't know if the mitigations actually work until the kind of people who break mitigations, white or black hat, start focusing hard on beating them one by one or bypassing them all together (eg hardware exploits). Any talk of how strong they are is just speculation. The proof, if it turns up, would be prolonged attempts by highly-talented people to break them with consistent failure and/or less access/damage resulting.

willvarfar 8y ago
The biggest success of OpenBSD's mitigations is that all the other operating systems adopt them. All the attacks that these techniques mitigate on other operating systems are proof of the usefulness of these mitigations on OpenBSD.
- nickpsecurity 8y ago
  "The biggest success of OpenBSD's mitigations is that all the other operating systems adopt them." That just means they're popular, not successful against attackers. "All the attacks that these techniques mitigate on other operating systems are proof " This would be evidence if it's true. So, what attacks do they mitigate? Were those attacks designed to bypass the mitigation of not designed to bypass the mitigation? I find most assessments of mitigations focus on success against attacks not designed with mitigations in mind. Once it's important to attackers, they start focusing on the mitigations. Further, how do we assess whether hackers are having a hard time with the mitigations given they don't disclose most of their successes? One guess I have is to look at exploit prices from firms such as Zerodium. I figure the prices will be much higher for targets that are harder to reliably exploit. If they're low, that might indicate they already have plenty of exploits for it. If it stays low or high, then that might show how consistently it was easy or hard to exploit. One variable to eliminate, though, was a vendor raising prices on one or more items just to further incentivize 0-day hunters. That happened at least once with Zerodium. Let's look at the prices for desktops and servers: https://zerodium.com/program.html https://zerodium.com/program.html The highest payout is a Windows 0-day for remote code execution. There's no mention of Mac or Linux payouts for the same thing. Instead, they offer $50,000 for privilege escalation on both. They also have $100-500k payouts for RCE's on services that often run on Linux hosts. These do get lots of eyeballs from bug hunters, some getting hit for long time, which might drive prices up a bit. The combo suggests the attackers mostly hit a service/app on Mac and Linux followed by privilege escalation. In any case, the Linux boxes cost them anywhere from $150k-550k for exploits with Windows about a million. If it counts as field evidence, that would argue strongly against what many might suspect is safest route to security. Whatever Linux is doing isn't working. Whatever Windows is doing is working really well. On mobile, iOS is the champ of comparable value. Note that they're not soliciting 0-days for OpenBSD on that page. That may or may not mean their clients don't care about it. If it did mean that, it would support my point about the OS being secure due to obscurity first, mitigations second. So, I check another article to find they're offering $500k for UNIX exploits, esp BSD's: https://securityaffairs.co/wordpress/74050/hacking/zerodium-linux-zero-day-exploits.html https://securityaffairs.co/wordpress/74050/hacking/zerodium-... They explain that how many systems are impacted with what level of interactivity largely determines the price. Implicitly corroborates what I said about attacker focus, too, if these incentives matter to them. For BSD's, I can't tell if the price is just to get a first-mover advantage against BSD's in their market or because they're harder to hack. Might have to wait a while. They did put a number on what Linux vulnerabilities were worth at the time: "as high as $45,000." Maybe we ask Zerodium if they have an OpenBSD exploit with what level of interactivity. Although I doubt they'll say, maybe someone could sell them on the marketing benefit of it if they do have something. The OpenBSD devs might feel proud if they're consistently not on the list with the bounty going up every year or something.
  - bluGill 8y ago
    You didn't account for competition here. Because Windows is more popular they have to offer more to keep things out of the hands of hackers. Of course some researchers are honest (one would hope most) and will never sell on the black market, but there are always a few.
syn0byte 8y ago
No one likes hearing the truth. However, to bolster your point; ASLR. OpenBSD was the first to implement and support it. It Generally seems to just be a bullet point of an extra step taken in a given exploit POC these days.

willvarfar 8y ago

The biggest success of OpenBSD's mitigations is that all the other operating systems adopt them. All the attacks that these techniques mitigate on other operating systems are proof of the usefulness of these mitigations on OpenBSD.

nickpsecurity 8y ago
"The biggest success of OpenBSD's mitigations is that all the other operating systems adopt them." That just means they're popular, not successful against attackers. "All the attacks that these techniques mitigate on other operating systems are proof " This would be evidence if it's true. So, what attacks do they mitigate? Were those attacks designed to bypass the mitigation of not designed to bypass the mitigation? I find most assessments of mitigations focus on success against attacks not designed with mitigations in mind. Once it's important to attackers, they start focusing on the mitigations. Further, how do we assess whether hackers are having a hard time with the mitigations given they don't disclose most of their successes? One guess I have is to look at exploit prices from firms such as Zerodium. I figure the prices will be much higher for targets that are harder to reliably exploit. If they're low, that might indicate they already have plenty of exploits for it. If it stays low or high, then that might show how consistently it was easy or hard to exploit. One variable to eliminate, though, was a vendor raising prices on one or more items just to further incentivize 0-day hunters. That happened at least once with Zerodium. Let's look at the prices for desktops and servers: https://zerodium.com/program.html https://zerodium.com/program.html The highest payout is a Windows 0-day for remote code execution. There's no mention of Mac or Linux payouts for the same thing. Instead, they offer $50,000 for privilege escalation on both. They also have $100-500k payouts for RCE's on services that often run on Linux hosts. These do get lots of eyeballs from bug hunters, some getting hit for long time, which might drive prices up a bit. The combo suggests the attackers mostly hit a service/app on Mac and Linux followed by privilege escalation. In any case, the Linux boxes cost them anywhere from $150k-550k for exploits with Windows about a million. If it counts as field evidence, that would argue strongly against what many might suspect is safest route to security. Whatever Linux is doing isn't working. Whatever Windows is doing is working really well. On mobile, iOS is the champ of comparable value. Note that they're not soliciting 0-days for OpenBSD on that page. That may or may not mean their clients don't care about it. If it did mean that, it would support my point about the OS being secure due to obscurity first, mitigations second. So, I check another article to find they're offering $500k for UNIX exploits, esp BSD's: https://securityaffairs.co/wordpress/74050/hacking/zerodium-linux-zero-day-exploits.html https://securityaffairs.co/wordpress/74050/hacking/zerodium-... They explain that how many systems are impacted with what level of interactivity largely determines the price. Implicitly corroborates what I said about attacker focus, too, if these incentives matter to them. For BSD's, I can't tell if the price is just to get a first-mover advantage against BSD's in their market or because they're harder to hack. Might have to wait a while. They did put a number on what Linux vulnerabilities were worth at the time: "as high as $45,000." Maybe we ask Zerodium if they have an OpenBSD exploit with what level of interactivity. Although I doubt they'll say, maybe someone could sell them on the marketing benefit of it if they do have something. The OpenBSD devs might feel proud if they're consistently not on the list with the bounty going up every year or something.
- bluGill 8y ago
  You didn't account for competition here. Because Windows is more popular they have to offer more to keep things out of the hands of hackers. Of course some researchers are honest (one would hope most) and will never sell on the black market, but there are always a few.

syn0byte 8y ago

No one likes hearing the truth. However, to bolster your point; ASLR. OpenBSD was the first to implement and support it. It Generally seems to just be a bullet point of an extra step taken in a given exploit POC these days.