Tag Info

Hot answers tagged

17

No. OpenBSD has measures (specifically, malloc() guard pages and wiping of deallocated memory) that should have turned Heartbleed into a crash or a leak of a whole bunch of "0x0d" bytes. However, as noted in a blog post here, OpenSSL uses its own custom memory-management system which acts to defeat those measures.


13

The first point I'd make is that the number of hits on a given vulnerability/exploit db is not a reliable indicator of overall security. This could largely be defined by other factors such as the focus of security researcher's efforts or disclosure policies. Even a quick read over the project websites provides an indicator of the likely comparative security ...


12

I think the biggest impacts will be on the public relations side. On the plus side (from OpenBSD maintainers point of view), the idea that the FBI deemed OpenBSD important enough, back in 2000, to warrant money-backed insertion of backdoors, is a sure ego inflater. This alone could be a motive for public allegations of backdoors, whether they exist or not. ...


11

@rook : you should run a diff on the two kernels, after all those years (17 since the split) of divergence there isn't that much that is still common, however there is still cross-breeding between projects and a really good idea will spread all around. OpenBSD got way more in the way of security architecture, as in compiler support to prevent buffer ...


9

There is a file called SHA256 which contains the checksums. Technically you only need that file to be transmitted securely; you could get the ISO through any mean, and just verify the checksum. This would be as good as getting the whole file through HTTPS. The OpenBSD people do not seem to maintain a public HTTPS web site with a copy of the SHA256 file. ...


8

First of all, OpenBSD is really just on a server in Canada, where the development takes place, through CVS. People replicate the tree by connecting using SSH there etc. When releases are made, isos are created and mirrors replicate them. I imagine they get the files using a secure way, but can't know for sure. Then you have a list of mirrors to download ...


8

Virtualization offers some layer of isolation. In your "B" case, if (for instance) there is a remotely exploitable hole in the SMTP server, then an attacker who exploits it may gain full control of the virtual machine which runs that SMTP server, but he will still be "outside" of the two other machines (the guest with the Web server, and the host). This may ...


7

On x86 processors, 64-bit mode offers significant performance benefits for some cryptographic operations, in particular asymmetric encryption and signatures; this is partly due to the bigger registers (it helps with big-integer arithmetics, and algorithms which rely on 64-bit operations) and due to the higher number of registers (that's a quirk of x86: 7 ...


6

NOT using loadable kernel modules could increase security. Yes, the theory is as follows: Attackers want to co-opt the kernel; that gives them more power and better ability to hide Dynamic kernels allow malicious modules to be inserted, a handy interface for the attacker to co-opt the kernel If the kernel is statically compiled, the attacker can't ...


5

(I speak here more generically than in the specific case of OpenBSD.) X11 needs some direct access to the underlying hardware, something which requires some extra privileges which are not given to just any process (such privileges can be used to mess with memory transfers, e.g. between system memory and hard disks). So there must be some root-or-equivalent ...


5

I agree, they should make available a way to securely authenticate the iso's. They should provide an authenticated mechanism (to https://www.openbsd.org) to retrieve the sha hashes instead of leaving the hashes sitting beside the just-as-easily-compromised iso file. But in the absence of that you can, download, wait and verify that there isn't a security ...


5

My understanding of the question is that you want to run a webserver and an ssh server only. First, I'm not sure why you wouldn't be able to able to do this with securelevel set to 2. Second, if you run qemu as a package/port and you use the kernel module you are adding a device, giving some superuser permissions and generally increasing the attack ...


4

NOT using loadable kernel modules could increase security. Is this true? Yes, but so will ripping out your network card and filling all your IO ports with epoxy[1]. However, I don't think you want to do that. Depending on how you define it, most modern operating systems have dynamic kernel modules. I think Windows kernel-mode drivers qualify as do ...


4

The answer to your question is easy: if anyone hid nasty code in privileged subsystems, the wrong people could have arbitrary control over systems running the code. But note that no evidence has been presented (and Perry should have a lot of that), and he offers no apologies. For more info see an early overview: Deconstructing the OpenBSD IPsec Rumors ...


4

Security-wise, one notable difference is that W^X can't work as well on i386 (32-bit) as it can on amd64 (64-bit). Some other arch have other benefits (for example sparc64 has StackGhost which adds more protection). Apart from this, amd64 mode has more CPU registers, i386 mode has smaller addresses/data structures so you might make better use of the CPU's ...


4

There seem to be some misconceptions here about how memory management in OpenSSL works. OPENSSL_malloc and OPENSSL_free by default just call the system malloc and free (there is some indirection, so an application can redefine these functions if it wants, but OpenSSL doesn't do that itself). However, for some data structures, notably input buffers, it keeps ...


4

There is one major category of home haedening that you missed, at least in part. 'Vectors downloaded by the user' is a huge category. It is the most used attack vector today. A lot of attacks don't require any user interaction to run. See drive by downloads for an example. While you are correct that safe browsing habbits are a good way to address this ...


3

All other things being equal, simplicity is good for security. But let's not reverse the paradigm. Software is secure because it is maintained. Complex software is harder to maintain, but, on the other hand, Apache and Nginx have a huge market share, are very active project, and thus benefit from about the best level of maintenance that can be hoped for. ...


3

I know how to do this.. I just don't know how to do this with pf. Forget the wireless portion, what we want to do is make two LAN's that are isolated from each other. You can then add the wireless access point to the one of the LAN's. Obviously, for 2 LAN's, you'll need 3 ethernet ports on your OpenBSD box. See the following for the types of rules you need ...


3

I did not find anything on that page that describes Systrace as insecure. Systrace was the result of groundbreaking research, described here: Improving Host Security with System Call Policies, Niels Provos, USENIX Security 2003. Later research reported vulnerabilities in system call monitoring tools (including Systrace): Exploiting Concurrency ...


3

Is not showing the reality! Is exactly like the bug difference between apache and nginx. apache have a lot more, but this is only because is much more used than nginx. I don't know anything about NetBSD code audit, but OpenBSD is very serious about that. Read that (Audit Process): http://www.openbsd.org/security.html If you need a trusted OS, then ...


2

If you set up your system so that only the guest listens on public network ports (those that are open on the firewall), then you win security in the sense that if someone manages to get into the guest and do some damage, it can be repaired more easily. Another advantage is that you may be able to limit the guest's resource usage, maybe even kill it off and ...


2

An important point about virtual machines is that they do not make any system more secure. The VM is all about protection between the host and the guest. A server with a security hole, running in a VM, still has a security hole; the only difference is that when the hole is exploited, the attacker gains control of the VM, not of the host. This "increases" ...


2

I wanted to say that maintaining an SSL site is a higher cost than HTTP especially when you have that many users. It costs more cycles of CPU, it costs more to maintain the certificates, and because SSL cares which order the packets come in, there is a higher bandwidth cost. In this situation, the user downloading the ISO is concerned that the file has ...


2

http://unix4lyfe.org/darkhttpd/ (no HTTPS) Also, custom compile of Nginx with no optional components, except for SSL, is also a very minimal server. Python SimpleHTTPServer source code is not 1 line long, you simply call it with one line.


2

This was based on a paper presented at the USENIX conference entitled "“Exploiting Concurrency Vulnerabilities in System Call Wrappers" According to the author in a blog post: The key insight here is that the historic assumption of “atomicity” of system calls is falacious, and that on both uniprocessor and multiprocessing systems, it is trivial to ...


2

The "simple" way is an extra NIC in your OpenBSD router and a second AP, which is probably $50 outlay. But if you don't want to spend any money, or are doing this more to learn than anything else then... DD-WRT support VLANs (virtual LANs) and VWLANs (virtual wireless LANs), and can have separate DHCP on the different VLANs. To set the DHCP on the V(W)LANs ...


2

Running X.org as non-root is now possible as of Feb. 22, 2014 (my emphasis): In OpenBSD-current, after this commit users of Intel and ATI Radeon graphics which support kernel mode setting (almost all of them) can set machdep.allowaperture back to 0 in the /etc/sysctl.conf configuration and still run the X server. This means that the X server ...


1

Short answer: The solution with virtualisation is more secure. The HTTP and SMTP servers are presumably exposed to the Internet and open to attack. Most HTTP and SMTP servers themselves have a good recent history with few remote vulnerabilities, although there could still be zero days. Also, HTTP servers expose applications flaws in PHP/CGI/other scripts. ...



Only top voted, non community-wiki answers of a minimum length are eligible