#aslr — Public Fediverse posts

"If you provide a network-based service and explicitly disable standard security measures, people can remotely hack into your system!"

"If you post the location of your spare key online, people from all over the country can come and rob your house!"

#ffmpeg #PixelSmash #ASLR

I feel like this is an under-reported limitation to that ffmpeg "PixelSmash" vulnerability: Their proof-of-concept exploit only works with ASLR disabled. Which, on any modern system, really shouldn't be the case.

https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/

#ffmpeg #PixelSmash #ASLR

Relocation-Based Predicate — врём в IDA по-новому

Базовые механизмы Windows создавались для защиты программ, но сегодня мы заставим их работать против реверс-инженеров. Показываю новую технику обфускации: как с помощью ASLR и таблицы релокаций создать ложную ветку выполнения, которая сейчас остаётся абсолютно невидимой для статических анализаторов.

https://habr.com/ru/articles/1043458/

#reverse_engineering #ASLR #обфускация #PE #релокации #opaque_predicate #IDA_Pro #антианализ #ассемблер

No Leak, No Problem - Bypassing ASLR with a ROP Chain to Gain RCE;

https://modzero.com/en/blog/no-leak-no-problem/

#exploitation #cve #rce #rop #aslr #arm #iot

Как системщику остаться в живых: харденинг, который не убьет ваш перфоманс

Здравствуйте, меня зовут Анна Мелехова. Я старший архитектор в отделе развития архитектуры KasperskyOS. В статье я хочу поделиться практическим опытом системной разработки, которой я занималась сначала в проекте по виртуализации, а теперь в «Лаборатории Касперского», где мы делаем микроядерную операционную систему с повышенными требованиями к безопасности – KasperskyOS . Когда вы работаете в такой среде, быстро понимаете: харденинг – это не красивые галочки в чек-листе, а набор очень конкретных, очень практических решений, которые должны и защищать, и минимально снижать производительность. О них я и расскажу, а в конце дам личный топ самых полезных харденингов, которые бустят security и не снижают performance.

https://habr.com/ru/companies/kaspersky/articles/968388/

#kasperskyos #системное_программирование #харденинг #canary #aslr #cfi

💻🔓 "Because who needs security when you have a fancy ROP chain to unravel ASLR? Watch in awe as we pretend it's 2005 and marvel at #hacking the unhackable! 🎩✨"
https://modzero.com/en/blog/no-leak-no-problem/ #reverseengineering #ASLR #ROPchain #cybersecurity #HackerNews #ngated

No Leak, No Problem – Bypassing ASLR with a ROP Chain to Gain RCE

https://modzero.com/en/blog/no-leak-no-problem/

#HackerNews #NoLeakNoProblem #ROPChain #RCE #SecurityResearch #ASLR #Exploit

Every one appreciates a good #security pun, so let me educate you on #bufferoverrun.
Don't let your stack get whacked, otherwise you'll get thoroughly #hacked.
Don't be a rookie and use a good stack cookie, lest things get spooky.
To bring you security up to par, you best add some #ASLR

#vulnerability #informationsecurity #infosec #programming #hacking #bufferbloat #stacksmashing

Google Project Zero Exposes ASLR Bypass Vulnerability in Apple’s Serialization Framework https://thecyberexpress.com/project-zero-exposes-aslr-bypass/ #AddressSpaceLayoutRandomization #TheCyberExpressNews #TheCyberExpress #ProjectZero #CyberNews #Apple #ASLR

Toolchain Necromancy: Past Mistakes Haunting ASLR

“Starting from 2001 and continuing until 6 years ago with version 2.32, #binutils' ld linker set too large of an alignment on ELF binary sections. With a #Linux kernel >= 5.10 or glibc >= 2.35, binaries/libraries that were built with the older toolchain act as timebombs against #ASLR, making brute-force attacks easier on 64-bit binaries and reducing randomness to nothing in some cases for 32-bit binaries.”

https://grsecurity.net/toolchain_necromancy_past_mistakes_haunting_aslr

New PaXtest release after years of silence 🥳

Git source: https://github.com/opensrcsec/paxtest/

Small announcement: https://grsecurity.net/paxtest_release/ (worth a read, contains even more info than what’s written about 😛)

#grsecurity #PaX #testing #ASLR

Nice reading about a technique to bypass ASLR without the need of an InfoLeak

https://github.com/nick0ve/how-to-bypass-aslr-on-linux-x86_64

#aslr #exploit #infosec

Theo de Raadt at CanSecWest: Synthetic Memory Protections https://undeadly.org/cgi?action=article;sid=20230325163416 #openbsd #security #rop #mimmutable #aslr #stacksmash #heapsmash

Frage rund um das Thema #CTF: Auch wenn ich #ASLR im gcc deaktiviere (no-pie), landen Datenstrukturen in meiner C-Anwendung an einem random offset. Der Code ist dann immerhin fix.

Wie kann ich das verhindern?

:BoostOK: :ReplyOK:

Theo de Raadt to be presenting at CanSecWest. https://undeadly.org/cgi?action=article;sid=20230313064617 #openbsd #cansecwest #security #mimmutable #executeonly #rop #aslr #pinsyscall

Chris Trout, is gravely ill with Guillan-Barrie Syndrome. He's intubated and cannot move from the neck down. Andy Hershey visited Chris in the hospital and Chris's wife gave the permission to have a word put out for Chris.

The more prayers the better, she said.

Please spare a moment for an ASL'r.
#advancedsquadleader #ASLr #community #guillanbarriesyndrome #prayers

The impact of rising sea levels is being ‘underestimated’, scientists warn

Worrying new research shows that twice as much land as previously thought could be underwater after the first one to two metres of #SeaLevelRise. (euronews) #ClimateEmergency #climate #ASLR https://www.euronews.com/green/2023/01/27/the-impact-of-rising-sea-levels-is-being-underestimated-scientists-warn

#Linux #Kernel #ASLR Implementation

Nice blog post.
https://xorl.wordpress.com/2011/01/16/linux-kernel-aslr-implementation/

#FreeBSD Enables #ASLR by Default for 64-bit

Via commit
https://cgit.freebsd.org/src/commit/?id=b014e0f15bc73d80ef49b64fd1f8c29f469467cb

Just finished building a custom 9.2/amd64 minimal kernel with enhanced hardening (global ASLR and PaX Segvguard), ZFS and M2 Scheduler.
Also tweaked wscons appearance by changing default console font to spleen, with default console/kernel ring buffer colors to white on blue. You can do that by setting:

options WS_DEFAULT_FG=WSCOL_WHITE
options WS_DEFAULT_BG=WSCOL_BLUE
options FONT_SPLEEN6x12

#bsd #netbsd #unix #kernel #security #aslr #zfs #filesystem #console #custom

#ASLR & the #iOS Kernel — How virtual address spaces are randomised

https://bellis1000.medium.com/aslr-the-ios-kernel-how-virtual-address-spaces-are-randomised-d76d14dc7ebb