6 ms·

The only path in a C++ release build is the PDB or debug information. This can be removed with a compiler flag. The only other indicator is a timestamp, which a

by maldev 4y ago

The only path in a C++ release build is the PDB or debug information. This can be removed with a compiler flag. The only other indicator is a timestamp, which again can be modified with a compiler flag. Using CI/CD can still give forensic indicators as the paths are still in the binary, even if they arn't your host machine path. In authoritarian countries where people have to worry about security services, this is a big threat which can get people killed. It also leaks information, even if you don't view the information as valuable, it's still fingerprinting.

IshKebab 4y ago
> In authoritarian countries where people have to worry about security services, this is a big threat which can get people killed. Pure paranoia. Find me one instance ever where anything like this has happened.
- eska 4y ago
  The North Korean dictatorship developed a linux distribution that adds machine and user identifying information to every single file to find whistleblowers.
  - maldev 4y ago
    Yep, it's a real threat to security, whistleblowers and even an organizations cyber security posture. I'll post a few strings which is enough for a state like North Korea to lock someone up for life. For example by just running strings on this binary. I find out the authors name is Zhou from. C:\Users\zhouh\.cargo\registry\src\github.com-1ecc6299db9ec823\aho-corasick-0.7.18\src\ahocorasick.rs C:\Users\zhouh\.cargo\registry\src\github.com-1ecc6299db9ec823\aho-corasick-0.7.18\src\classes.rs I also know what version of the library he uses which means I can pwn anyone using this if a exploit comes out. And not only this library, I know the version for every library he's using. Like Chrono-0.4.19 from this string C:\Users\zhouh\.cargo\registry\src\github.com-1ecc6299db9ec823\chrono-0.4.19\src\sys\windows.rsSystemTimeToTzSpecificLocalTime failed with: In strings there's actually 304 unique strings with his username in it. I know every file, I know every library. There's nothing stopping a malicious actor from downloading popular rust server binaries and using strings to determine if they have an exploit. And alot of software DOESN'T upgrade their libraries from vulnerable versions, especially if unmaintained. It's a big issue. It's a real shame that Rust ignores this. And the fact that my original comment was so lambasted against really shows the amature nature of Rust users which don't align with real world organizational goals.
  - IshKebab 4y ago
    Interesting but not really relevant.
    - eska 4y ago
      Moving the goal post, I see.
      - IshKebab 4y ago
        No? The goal posts were very clear. North Korea intentionally adding fingerprints to their users' documents is obviously not the same as compilers accidentally leaving them in.

by maldev 4y ago

IshKebab 4y ago

> In authoritarian countries where people have to worry about security services, this is a big threat which can get people killed. Pure paranoia. Find me one instance ever where anything like this has happened.

eska 4y ago
The North Korean dictatorship developed a linux distribution that adds machine and user identifying information to every single file to find whistleblowers.
- maldev 4y ago
  Yep, it's a real threat to security, whistleblowers and even an organizations cyber security posture. I'll post a few strings which is enough for a state like North Korea to lock someone up for life. For example by just running strings on this binary. I find out the authors name is Zhou from. C:\Users\zhouh\.cargo\registry\src\github.com-1ecc6299db9ec823\aho-corasick-0.7.18\src\ahocorasick.rs C:\Users\zhouh\.cargo\registry\src\github.com-1ecc6299db9ec823\aho-corasick-0.7.18\src\classes.rs I also know what version of the library he uses which means I can pwn anyone using this if a exploit comes out. And not only this library, I know the version for every library he's using. Like Chrono-0.4.19 from this string C:\Users\zhouh\.cargo\registry\src\github.com-1ecc6299db9ec823\chrono-0.4.19\src\sys\windows.rsSystemTimeToTzSpecificLocalTime failed with: In strings there's actually 304 unique strings with his username in it. I know every file, I know every library. There's nothing stopping a malicious actor from downloading popular rust server binaries and using strings to determine if they have an exploit. And alot of software DOESN'T upgrade their libraries from vulnerable versions, especially if unmaintained. It's a big issue. It's a real shame that Rust ignores this. And the fact that my original comment was so lambasted against really shows the amature nature of Rust users which don't align with real world organizational goals.
- IshKebab 4y ago
  Interesting but not really relevant.
  - eska 4y ago
    Moving the goal post, I see.
    - IshKebab 4y ago
      No? The goal posts were very clear. North Korea intentionally adding fingerprints to their users' documents is obviously not the same as compilers accidentally leaving them in.