Re: [gentoo-hardened] binary protection mechanisms in different Linux distros

[Radoslaw Madej]

Hi,
Thanks for the useful info. Assessing strength of the cookie itself definitely 
sounds like a good idea (same for PIE + ASLR actually).

Unfortunately, seems like the attached file has been intercepted somewhere 
along the way... ;) Could you resend please? I'm curious to give it a go.

Thanks,
Radek Madej

On Friday 02 July 2010 08:41:46 you wrote:
> Hello,
>
> In addition to checking if SSP is enabled for binaries, you might want
> to check the /strength/ of the cookie.
>
> For example, some distros will use a full 32 bit cookie strength, where
> as others will use a 24 bit strength cookie (such as ubuntu 10.04),
> where they set a cookie like 0x00xxyyzz (for 32 bit little endian).
>
> Presumably it is for off by one errors (buf[buflen] = 0) and maybe to
> prevent ssp bruteforcing in string copy routines :)
>
> At any rate, I've attached a .c file you can use. depending on compiler
> version and stuff, you might need to modify the OFFSET parameter. You'll
> want to test it with -static as well (some distros have released setups
> where if you compile a binary statically, it will not initialize the
> cookie, etc :)
>
> Thanks,
> Andrew Griffiths
>
> On Thu, Jul 01, 2010 at 08:46:11AM +0100, Radoslaw Madej wrote:
> > Hi guys,
> >
> > I convinced the company I work for to allow me to spend some time on
> > reviewing different security aspects of Linux OS and different distros.
> > As it also involves Gentoo Hardened (which I also happily use on a daily
> > basis), I thought I'd share. :)
> >
> > http://labs.mwrinfosecurity.com/projectdetail.php?project=13&view=news
> >
> > There should be more to come in a near future. Any feedback appreciated
> > :)
> >
> > Thanks to all hardened-dev for making the Hardened Gentoo happen! :)
> > Regards,
> > Radek Madej