4 ms·

Is there a current meta for OpenBSD exploit developers? What's the right way to go about hardening the system if there's no meta to observe? My very naive tak

Is there a current meta for OpenBSD exploit developers? What's the right way to go about hardening the system if there's no meta to observe? My very naive take would be something like: A successful exploit depends on jumping through a number of different hoops. Each of those hoops has an estimated success probability associated with it. We can multiply all the individual probabilities together to get an estimated probability of successful exploit -- assuming that hoop probabilities are independent, which seems reasonable? The most efficient way to harden against exploits is to try and shrink whichever hoop possesses the greatest partial derivative of overall exploit success probability with respect to developer time.

dtx1 3y ago
> The most efficient way to harden against exploits is to try and shrink whichever hoop possesses the greatest partial derivative of overall exploit success probability with respect to developer time. Depending on your definition of efficient, adding more hoops should work exponentially better.
- 0xDEAFBEAD 3y ago
  My definition of efficient is essentially whatever decreases the number of workable exploits most rapidly per hour of developer time. >Depending on your definition of efficient, adding more hoops should work exponentially better. Explain?
  - nequo 3y ago
    Suppose your hoop probabilities are 25% and that you have two hoops so that the probability of jumping through both is 25% * 25% = 6.25%. You can reduce the size of one of the hoops in half, changing the probability to 25% * 25%/2 = 3.125% You can also add a third hoop, in which case the probability is 25% * 25% * 25% = 1.5625% 1.5625% < 3.125%, so adding a third hoop is better than shrinking one of the two existing hoops. Of course, this argument makes important assumptions about the hoop probabilities.
    - 0xDEAFBEAD 3y ago
      Makes sense. Other key questions would be: complexity cost of added hoop (including, possibly, increased attack surface -- the sequence of hoops is just an abstraction that reality may not obey) and also creation difficulty (it could be that improving an existing hoop is significantly quicker than creating a new one).
    - krab 3y ago
      The probabilities aren't independent. The person jumping through the first hoop is probably more able than average. Therefore, any additional hoop - if it doesn't require a completely orthogonal skill - is less selective.
      - 0xDEAFBEAD 3y ago
        I think it depends on what the "probability" is meant to indicate. You're correct if it's meant to indicate whether a particular attacker can get through a particular hoop. But probabilities could also refer to e.g. the chance that it's possible to get through a particular hoop, period. Or the fraction of some input space which corresponds to an exploitation.
saagarjha 3y ago
The meta doesn’t exist because nobody targets OpenBSD because it’s not used. People’s analysis of it is mostly just their educated guess as to how work for other platforms would carry over.
rfoo 3y ago
There is also "soft" mitigations vs "hard" mitigations guideline as described here [1]. It's handy when designing new mitigations when there's no meta game. [1] https://googleprojectzero.blogspot.com/2023/08/mte-as-implemented-part-1.html https://googleprojectzero.blogspot.com/2023/08/mte-as-implem...

dtx1 3y ago

> The most efficient way to harden against exploits is to try and shrink whichever hoop possesses the greatest partial derivative of overall exploit success probability with respect to developer time. Depending on your definition of efficient, adding more hoops should work exponentially better.

0xDEAFBEAD 3y ago
My definition of efficient is essentially whatever decreases the number of workable exploits most rapidly per hour of developer time. >Depending on your definition of efficient, adding more hoops should work exponentially better. Explain?
- nequo 3y ago
  Suppose your hoop probabilities are 25% and that you have two hoops so that the probability of jumping through both is 25% * 25% = 6.25%. You can reduce the size of one of the hoops in half, changing the probability to 25% * 25%/2 = 3.125% You can also add a third hoop, in which case the probability is 25% * 25% * 25% = 1.5625% 1.5625% < 3.125%, so adding a third hoop is better than shrinking one of the two existing hoops. Of course, this argument makes important assumptions about the hoop probabilities.
  - 0xDEAFBEAD 3y ago
    Makes sense. Other key questions would be: complexity cost of added hoop (including, possibly, increased attack surface -- the sequence of hoops is just an abstraction that reality may not obey) and also creation difficulty (it could be that improving an existing hoop is significantly quicker than creating a new one).
  - krab 3y ago
    The probabilities aren't independent. The person jumping through the first hoop is probably more able than average. Therefore, any additional hoop - if it doesn't require a completely orthogonal skill - is less selective.
    - 0xDEAFBEAD 3y ago
      I think it depends on what the "probability" is meant to indicate. You're correct if it's meant to indicate whether a particular attacker can get through a particular hoop. But probabilities could also refer to e.g. the chance that it's possible to get through a particular hoop, period. Or the fraction of some input space which corresponds to an exploitation.

saagarjha 3y ago

The meta doesn’t exist because nobody targets OpenBSD because it’s not used. People’s analysis of it is mostly just their educated guess as to how work for other platforms would carry over.

rfoo 3y ago

There is also "soft" mitigations vs "hard" mitigations guideline as described here [1]. It's handy when designing new mitigations when there's no meta game. [1] https://googleprojectzero.blogspot.com/2023/08/mte-as-implemented-part-1.html https://googleprojectzero.blogspot.com/2023/08/mte-as-implem...