6 ms·

Rust is really bad for security. It puts debug strings and full source file paths inside binaries. It's been a bug for over 5 years that's been reported and the

by maldev 4y ago

Rust is really bad for security. It puts debug strings and full source file paths inside binaries. It's been a bug for over 5 years that's been reported and there's been no progress. Nobody talks about this wild dataleakage. Also leaks usernames on computers and such. This can lead to ALOT of forensics information and be used by authoritarian nations to find and arrest people for making software. I really don't think any rust application can meet some compliance requirements for certain sectors due to this either. But the developers and communities just wash this and other real issues under the rug.

eska 4y ago
Did you call “strip” on the final executable? It is now also possible to specify “no debug info” for the release build in the build config.
- maldev 4y ago
  Yes, you can verify that it doesn't work by looking at godbolt. Here's a very simple example. https://godbolt.org/z/sqW8xcGEc https://godbolt.org/z/sqW8xcGEc . For some reason everyone seems to suggest that when it's a currently open (For the last 5 years) issue on their github of it not working. Using a third party tool and binary patching is not an appropriate measure of securing a binary in the case of the linux strip util.
  - estebank 4y ago
    The default hasn't been changed yet (and if you look at the tickets there's ongoing conversation), but you can use `--remap-path-prefix` today if you need it. https://godbolt.org/z/zTh36c6Pz https://godbolt.org/z/zTh36c6Pz
    - maldev 4y ago
      That's good for the path. But there's still concern with the filenames being there, along with being mapped to specific functions. Filenames can be relatively unique and makes signature matching extremely easy. So it can still cause issues to people who have to worry about authoritarian regimes, as it's not out of the realm of this being enough evidence to arrest someone for having all the filenames. It also affects obfuscation and licensing in commercial products. As you can map most functions to a file based off of this handling and find code to target. It's even worse, as if you were to strip the string and replace them all with giberish, it's still possible to map each file by xref's and find related functions. With how signature are in RE tools, you can automatically detect crypto functions and then map that every other function in the file, finding licensing checks easily. The compiler should really respect privacy, and while the ticket is ongoing, it's been ongoing for 6 years and they just made it a bug last year, with no progress. This is a huge blocker for businesses or privacy related domains which instantly makes the language a no-touch.
- estebank 4y ago
  For reference, the tickets GP is talking about are - https://github.com/rust-lang/rfcs/pull/3127 https://github.com/rust-lang/rfcs/pull/3127 - https://github.com/rust-lang/rust/issues/40552 https://github.com/rust-lang/rust/issues/40552
IshKebab 4y ago
Putting full paths in binaries is very common even in C++ projects. It's difficult to completely avoid and trivial to mitigate. In fact if you're doing things correctly - i.e. using CI & CD, there's nothing to do.
- maldev 4y ago
  The only path in a C++ release build is the PDB or debug information. This can be removed with a compiler flag. The only other indicator is a timestamp, which again can be modified with a compiler flag. Using CI/CD can still give forensic indicators as the paths are still in the binary, even if they arn't your host machine path. In authoritarian countries where people have to worry about security services, this is a big threat which can get people killed. It also leaks information, even if you don't view the information as valuable, it's still fingerprinting.
  - IshKebab 4y ago
    > In authoritarian countries where people have to worry about security services, this is a big threat which can get people killed. Pure paranoia. Find me one instance ever where anything like this has happened.
    - eska 4y ago
      The North Korean dictatorship developed a linux distribution that adds machine and user identifying information to every single file to find whistleblowers.
      - maldev 4y ago
        Yep, it's a real threat to security, whistleblowers and even an organizations cyber security posture. I'll post a few strings which is enough for a state like North Korea to lock someone up for life. For example by just running strings on this binary. I find out the authors name is Zhou from. C:\Users\zhouh\.cargo\registry\src\github.com-1ecc6299db9ec823\aho-corasick-0.7.18\src\ahocorasick.rs C:\Users\zhouh\.cargo\registry\src\github.com-1ecc6299db9ec823\aho-corasick-0.7.18\src\classes.rs I also know what version of the library he uses which means I can pwn anyone using this if a exploit comes out. And not only this library, I know the version for every library he's using. Like Chrono-0.4.19 from this string C:\Users\zhouh\.cargo\registry\src\github.com-1ecc6299db9ec823\chrono-0.4.19\src\sys\windows.rsSystemTimeToTzSpecificLocalTime failed with: In strings there's actually 304 unique strings with his username in it. I know every file, I know every library. There's nothing stopping a malicious actor from downloading popular rust server binaries and using strings to determine if they have an exploit. And alot of software DOESN'T upgrade their libraries from vulnerable versions, especially if unmaintained. It's a big issue. It's a real shame that Rust ignores this. And the fact that my original comment was so lambasted against really shows the amature nature of Rust users which don't align with real world organizational goals.

by maldev 4y ago

eska 4y ago

Did you call “strip” on the final executable? It is now also possible to specify “no debug info” for the release build in the build config.

maldev 4y ago
Yes, you can verify that it doesn't work by looking at godbolt. Here's a very simple example. https://godbolt.org/z/sqW8xcGEc https://godbolt.org/z/sqW8xcGEc . For some reason everyone seems to suggest that when it's a currently open (For the last 5 years) issue on their github of it not working. Using a third party tool and binary patching is not an appropriate measure of securing a binary in the case of the linux strip util.
- estebank 4y ago
  The default hasn't been changed yet (and if you look at the tickets there's ongoing conversation), but you can use `--remap-path-prefix` today if you need it. https://godbolt.org/z/zTh36c6Pz https://godbolt.org/z/zTh36c6Pz
  - maldev 4y ago
    That's good for the path. But there's still concern with the filenames being there, along with being mapped to specific functions. Filenames can be relatively unique and makes signature matching extremely easy. So it can still cause issues to people who have to worry about authoritarian regimes, as it's not out of the realm of this being enough evidence to arrest someone for having all the filenames. It also affects obfuscation and licensing in commercial products. As you can map most functions to a file based off of this handling and find code to target. It's even worse, as if you were to strip the string and replace them all with giberish, it's still possible to map each file by xref's and find related functions. With how signature are in RE tools, you can automatically detect crypto functions and then map that every other function in the file, finding licensing checks easily. The compiler should really respect privacy, and while the ticket is ongoing, it's been ongoing for 6 years and they just made it a bug last year, with no progress. This is a huge blocker for businesses or privacy related domains which instantly makes the language a no-touch.
estebank 4y ago
For reference, the tickets GP is talking about are - https://github.com/rust-lang/rfcs/pull/3127 https://github.com/rust-lang/rfcs/pull/3127 - https://github.com/rust-lang/rust/issues/40552 https://github.com/rust-lang/rust/issues/40552

IshKebab 4y ago

Putting full paths in binaries is very common even in C++ projects. It's difficult to completely avoid and trivial to mitigate. In fact if you're doing things correctly - i.e. using CI & CD, there's nothing to do.

maldev 4y ago
The only path in a C++ release build is the PDB or debug information. This can be removed with a compiler flag. The only other indicator is a timestamp, which again can be modified with a compiler flag. Using CI/CD can still give forensic indicators as the paths are still in the binary, even if they arn't your host machine path. In authoritarian countries where people have to worry about security services, this is a big threat which can get people killed. It also leaks information, even if you don't view the information as valuable, it's still fingerprinting.
- IshKebab 4y ago
  > In authoritarian countries where people have to worry about security services, this is a big threat which can get people killed. Pure paranoia. Find me one instance ever where anything like this has happened.
  - eska 4y ago
    The North Korean dictatorship developed a linux distribution that adds machine and user identifying information to every single file to find whistleblowers.
    - maldev 4y ago
      Yep, it's a real threat to security, whistleblowers and even an organizations cyber security posture. I'll post a few strings which is enough for a state like North Korea to lock someone up for life. For example by just running strings on this binary. I find out the authors name is Zhou from. C:\Users\zhouh\.cargo\registry\src\github.com-1ecc6299db9ec823\aho-corasick-0.7.18\src\ahocorasick.rs C:\Users\zhouh\.cargo\registry\src\github.com-1ecc6299db9ec823\aho-corasick-0.7.18\src\classes.rs I also know what version of the library he uses which means I can pwn anyone using this if a exploit comes out. And not only this library, I know the version for every library he's using. Like Chrono-0.4.19 from this string C:\Users\zhouh\.cargo\registry\src\github.com-1ecc6299db9ec823\chrono-0.4.19\src\sys\windows.rsSystemTimeToTzSpecificLocalTime failed with: In strings there's actually 304 unique strings with his username in it. I know every file, I know every library. There's nothing stopping a malicious actor from downloading popular rust server binaries and using strings to determine if they have an exploit. And alot of software DOESN'T upgrade their libraries from vulnerable versions, especially if unmaintained. It's a big issue. It's a real shame that Rust ignores this. And the fact that my original comment was so lambasted against really shows the amature nature of Rust users which don't align with real world organizational goals.