While sitting here recompiling libc I was thinking that these binary
distribution things are really bad :-). There are bunches of sites that have
exactly the same sendmail, exactly the same libc, ect. Duh.
Someone can spend hours to develop an exploit for a particular target
platform, OS version, and cpu type. That exploit might need to use different
offsets on other versions or machine types, and it is clearly just a
mechanical process.
It is almost getting boring or something.
I just decided it would be pretty funny if we had a C compiler which would
randomize the location of variables on the stack for each compile. It
would also be nice if it could randomly stick in some unused short ints
into the stack in various places (especially around big strings used
by sprintf, strcpy, and friends :-) ).
This would offer some protection against the next 10 years of cloned
stack-o-rama exploits. Raise the level of effort and all that. :-)
It doesn't change the price of the first exploit but it might prevent
anybody from making a profit on the volume!
Well? What do you think? Should Sun/HP/DEC/IBM/SGI cut unique binary
distributions for each customer using such a bizarre compilation technique?
(At least for libc and suid stuff). Some sort of automated facility that
you could download a unique upgrade from :-).
Would this be really cool or am I overlooking something?
The core dump readers wouldn't like this but there aren't very many of
them left alive :-)
Regards,
Mark Hittinger
bugs @
win .
net
Follow-Ups:
|
|
