4 ms·

> their binaries are built with no mitigations whatsoever. ASLR disabled, no stack canaries, no fortify. Provide evidence.

• lima 7y ago
  Anyone can easily verify this by downloading the binaries, and running checksec themselves. Here's the output: $ sha256sum palemoon-bin 0b7f4ad73fc671e20bfb2366aa9d9ad81e82a3c8f63acde7f37063e73fda2141 palemoon-bin $ checksec --file=./palemoon-bin --output=json --extended | jq { "./palemoon-bin": { "relro": "partial", "canary": "no", "nx": "yes", "pie": "no", "clangcfi": "no", "safestack": "no", "rpath": "no", "runpath": "no", "symbols": "no", "fortify_source": "no", "fortified": "0", "fortify-able": "15" } } Notably, the binary has not been compiled with -fPIE and -fstack-protector, which disables two very basic exploit mitigations - ASLR and stack canaries. Any self-respecting Linux distribution enables these compiler flags by default nowadays. -D_FORTIFY_SOURCE is also missing, unlike Chrome or Firefox. A modern browser uses dozens of custom binary exploitation mitigations in addition to this. Mitigations and sandboxing are the difference between an exploit a CTF player can write on an afternoon, and a multi-month expert-level endeavour.
  • fouric 7y ago
    Which version is the `palemoon-bin` that you have there?
    • eropple 7y ago
      It's 28.8.4 x64, downloaded straight from the website. (I duplicated his efforts; tbf, you could have, too.)