The DMZ

« first day (4155 days earlier) ← previous day next day → last day (1023 days later) »

forest

02:27

@nobody Yes, although I don't know of any which attacked the debugger and then attacked the kernel.

12 hours later…

MechMK1

14:02

08.Secret History of Microsoft Gary

►

"The fix for the bug was revealed to me in a dream"

RoraΖ

My best solutions come in dreams or in the shower.

MechMK1

Reminds me of when I was on mushrooms and told my friend to trust me with the software architecture

Now that I am sober, I can confidently say "It made sense to me at the time"

RoraΖ

Sounds like you gotta go back on the mushrooms to sort it out

belkarx

15:08

@MechMK1 When the actual story starts at minute 10 of 16

6 hours later…

nobody

20:53

The Trusted Platform Module is all about Microsoft et al being able to trust that your computer is running the software they want it to run, not the software that you want it to run. Everyone should disable the TPM. — studog 2 hours ago

I wonder how often this dude modifies his Windows kernel

forest

Disabling the TPM is a terrible idea.

Better to just provision ownership yourself.

nobody

Yeah. TPMs are like the vaccines of the infosec world I guess.

@forest Not many people would know how to do that, so Microsoft setting it up by default still makes complete sense

forest

TPMs are fine as long as you can set ownership.

But tbh why even use Windows?

nobody

@forest Because the alternative is...? Linux is not a valid alternative for non-tech savvy people, and macos isn't a valid one for anyone on a budget

forest

ChromeOS I guess?

nobody

21:01

Yeah that's fine, but limited in usage

forest

21:14

And actually, Linux isn't that hard to set up. It doesn't require being tech-savvy.

But a stock Linux distro won't be particularly secure...

Thomas Ward

this is why you harden it :P

there's numerous ways to harden down linux distros

nobody

@forest Setting it up is the easy part. The hard part would be the learning curve for anyone who is not tech savvy and whose needs are not fulfilled by ChromeOS

Also, setting up is easy because someone else can do it for you once. But if I had to explain how to install linux to my grandfather so that he could do it by himself...

forest

@ThomasWard Hardening is good and all, but honestly you won't be getting much benefit unless you compile your own kernel (for RANDSTRUCT and the like) and use strong MAC policies and a hardened toolchain.

A few sysctl tweaks here and there and a different default umask isn't going to cut it.

Thomas Ward

true, but there's things like CIS compliance and other things that if you enforce it help. The big thing is "Don't be stupid" - and that's usually a problem that leads to infections :P

forest

Oh, yeah for malware infections all it takes is some basic data hygiene.

But the kernel's attack surface is just too great by default.

Thomas Ward

21:22

that's where the fact there's numerous variants of kernels helps provided they get general patching. There are kernels out there that help lock donw, but most of the kernel vulns I'm aware of that're critical are local-based attacks.

but in general yes I agree with you it's hard to harden at the kernel level

forest

Sadly most kernel vulns are not made public. Linus has the "a bug is a bug" philosophy and almost all the sec fixes are silent. That prevents security backports from being very useful.

Thomas Ward

shrugs

then you run into the problem of "If I compile my own kernel how do I knokw the vulns are aptched"

the rule of thumb is "No system is 100% secure"

forest

By using the latest vanilla upstream.

Custom compile != custom fork.

Thomas Ward

> Sadly most kernel vulns are not made public.

contradictory statements here buddy

just saying

forest

They're fixed, but they are labeled as regular fixes, not security fixes. That's what I meant.

I guess I should have done s/kernel vulns/kernel security fixes/.

@ThomasWard If you just custom compile a distro kernel, you indeed won't be getting as many security fixes as if you use vanilla upstream. It's also gregkh's policy (a silly one if you ask me). However, compiling your own kernel, if it's using the latest upstream sources, allows you to make use of both RANDSTRUCT as well as enable further hardening features that aren't available as runtime tweaks. Plus you can remove legacy kconfig settings that are enabled by default in Debian and the like.

The best thing to do, of course, is to use grsecurity, but sadly that's not affordable anymore...

This is a great resource: madaidans-insecurities.github.io/guides/linux-hardening.html

Shows what really is required to harden a Linux distro, and why it can be so difficult.

Thomas Ward

21:33

at least you can. cough Windows is worse cough

forest

Agreed. Windows may have a more secure kernel out of the box, but with Linux, you can, with effort, improve security vastly over whatever Windows could do. Linux is a better base for a secure system than Windows.

belkarx

21:56

|> Windows may have a more secure kernel out of the box
I wonder if it really is ... Windows' kernel is likely a huge mess of code, and if it were leaked, it's likely a fair few vulns would be found just on the basis of "huge attack surface"

forest

@belkarx The Windows kernel has a much greater attack surface area, but is a bit more hardened and they take static analysis and fuzzing more seriously (e.g. they use taint tracking and any new API that is reachable from an untrusted process must pass many fuzzing tests, including symbolic analysis and deterministic dynamic analysis).

So whether or not it's "more secure" depends on too many factors to count.

nobody

@belkarx Been leaked a few times I think

forest

Only XP and prior.

At least, those are the only ones leaked to the public.

nobody

fossbytes.com/windows-10-source-code-leaked-online-report

forest

hahaha wow

nobody

22:02

Well, doesn't look like the complete kernel was leaked, but a fair bit.

forest

Do you know where to find it now?

> “Our review confirms that these files are actually a portion of the source code from the Shared Source Initiative and are used by OEMs and partners,” a Microsoft spokesperson told Fossbytes.

nobody

I couldn't find it at the time even. MS seems to have done a good job of covering up. But maybe it is available on some torrents or something

forest

Oh this is from 2017? Then probably not. I would have heard of it.

But either way, Linux is still more customizable which lends to the potential for better security.

github.com/boltgolt/howdy

Well this looks terrifying.

forest

22:37

lwn.net/Articles/893154

This is the one thing I dislike about Rust...

> It amazes me how far from Not-Invented-Here syndrome we have come. 20 or so years ago there was so much talk about not re-inventing the wheel and how using existing code is the best one can do. Now we are seemingly on the other end of the spectrum where the 'rules' of programming are something like:
1, Whatever you do, do not write any actual real code
2, You may use an unbounded amount of code from any part of the internet, provided you did not write it
3, It is of the utmost importance that you use an existing framework. The more code the framework did not write the better (e.g wxwidge…

nobody

23:39

@forest What's that got to do with Rust?

Isn't it something that plagues most software development these days?

forest

@nobody Not C. At least, not nearly as much.

The problem with Rust is that this is what they encourage.

That doesn't mean Rust is bad or worse than C, since C is not memory safe.

« first day (4155 days earlier) ← previous day next day → last day (1023 days later) »

all rooms