Tag Info

The first point I'd make is that the number of hits on a given vulnerability/exploit db is not a reliable indicator of overall security. This could largely be defined by other factors such as the focus of security researcher's efforts or disclosure policies. Even a quick read over the project websites provides an indicator of the likely comparative security ...

I think the biggest impacts will be on the public relations side. On the plus side (from OpenBSD maintainers point of view), the idea that the FBI deemed OpenBSD important enough, back in 2000, to warrant money-backed insertion of backdoors, is a sure ego inflater. This alone could be a motive for public allegations of backdoors, whether they exist or not. ...

@rook : you should run a diff on the two kernels, after all those years (17 since the split) of divergence there isn't that much that is still common, however there is still cross-breeding between projects and a really good idea will spread all around. OpenBSD got way more in the way of security architecture, as in compiler support to prevent buffer ...

There is a file called SHA256 which contains the checksums. Technically you only need that file to be transmitted securely; you could get the ISO through any mean, and just verify the checksum. This would be as good as getting the whole file through HTTPS. The OpenBSD people do not seem to maintain a public HTTPS web site with a copy of the SHA256 file. ...

First of all, OpenBSD is really just on a server in Canada, where the development takes place, through CVS. People replicate the tree by connecting using SSH there etc. When releases are made, isos are created and mirrors replicate them. I imagine they get the files using a secure way, but can't know for sure. Then you have a list of mirrors to download ...

As I noted in comment, this is a very broad question. There are a wide variety of potential ramifications. One thing is clear though: Theo just got himself a whole bunch of free code reviews ;-). Maybe the FBI did manage to get a backdoor into the 2001-era openbsd IPSec code. If they did, it means that there have been VPNs that US law enforcement could ...

NOT using loadable kernel modules could increase security. Yes, the theory is as follows: Attackers want to co-opt the kernel; that gives them more power and better ability to hide Dynamic kernels allow malicious modules to be inserted, a handy interface for the attacker to co-opt the kernel If the kernel is statically compiled, the attacker can't ...

On x86 processors, 64-bit mode offers significant performance benefits for some cryptographic operations, in particular asymmetric encryption and signatures; this is partly due to the bigger registers (it helps with big-integer arithmetics, and algorithms which rely on 64-bit operations) and due to the higher number of registers (that's a quirk of x86: 7 ...

I agree, they should make available a way to securely authenticate the iso's. They should provide an authenticated mechanism (to https://www.openbsd.org) to retrieve the sha hashes instead of leaving the hashes sitting beside the just-as-easily-compromised iso file. But in the absence of that you can, download, wait and verify that there isn't a security ...

(I speak here more generically than in the specific case of OpenBSD.) X11 needs some direct access to the underlying hardware, something which requires some extra privileges which are not given to just any process (such privileges can be used to mess with memory transfers, e.g. between system memory and hard disks). So there must be some root-or-equivalent ...

NOT using loadable kernel modules could increase security. Is this true? Yes, but so will ripping out your network card and filling all your IO ports with epoxy[1]. However, I don't think you want to do that. Depending on how you define it, most modern operating systems have dynamic kernel modules. I think Windows kernel-mode drivers qualify as do ...

The answer to your question is easy: if anyone hid nasty code in privileged subsystems, the wrong people could have arbitrary control over systems running the code. But note that no evidence has been presented (and Perry should have a lot of that), and he offers no apologies. For more info see an early overview: Deconstructing the OpenBSD IPsec Rumors ...

My understanding of the question is that you want to run a webserver and an ssh server only. First, I'm not sure why you wouldn't be able to able to do this with securelevel set to 2. Second, if you run qemu as a package/port and you use the kernel module you are adding a device, giving some superuser permissions and generally increasing the attack ...

Security-wise, one notable difference is that W^X can't work as well on i386 (32-bit) as it can on amd64 (64-bit). Some other arch have other benefits (for example sparc64 has StackGhost which adds more protection). Apart from this, amd64 mode has more CPU registers, i386 mode has smaller addresses/data structures so you might make better use of the CPU's ...

I know how to do this.. I just don't know how to do this with pf. Forget the wireless portion, what we want to do is make two LAN's that are isolated from each other. You can then add the wireless access point to the one of the LAN's. Obviously, for 2 LAN's, you'll need 3 ethernet ports on your OpenBSD box. See the following for the types of rules you need ...

An important point about virtual machines is that they do not make any system more secure. The VM is all about protection between the host and the guest. A server with a security hole, running in a VM, still has a security hole; the only difference is that when the hole is exploited, the attacker gains control of the VM, not of the host. This "increases" ...

If you set up your system so that only the guest listens on public network ports (those that are open on the firewall), then you win security in the sense that if someone manages to get into the guest and do some damage, it can be repaired more easily. Another advantage is that you may be able to limit the guest's resource usage, maybe even kill it off and ...

I did not find anything on that page that describes Systrace as insecure. Systrace was the result of groundbreaking research, described here: Improving Host Security with System Call Policies, Niels Provos, USENIX Security 2003. Later research reported vulnerabilities in system call monitoring tools (including Systrace): Exploiting Concurrency ...

Is not showing the reality! Is exactly like the bug difference between apache and nginx. apache have a lot more, but this is only because is much more used than nginx. I don't know anything about NetBSD code audit, but OpenBSD is very serious about that. Read that (Audit Process): http://www.openbsd.org/security.html If you need a trusted OS, then ...

I wanted to say that maintaining an SSL site is a higher cost than HTTP especially when you have that many users. It costs more cycles of CPU, it costs more to maintain the certificates, and because SSL cares which order the packets come in, there is a higher bandwidth cost. In this situation, the user downloading the ISO is concerned that the file has ...

This was based on a paper presented at the USENIX conference entitled "“Exploiting Concurrency Vulnerabilities in System Call Wrappers" According to the author in a blog post: The key insight here is that the historic assumption of “atomicity” of system calls is falacious, and that on both uniprocessor and multiprocessing systems, it is trivial to ...

I refer you to the answer to this question, and will copy relevant parts below. I've also added a section or two at the end. Choosing a strong passphrase Yes, we've all heard it time and time again, but there is probably no easier way to improve your security. If you're a fan of passwords, make sure to choose something that contains enough entropy to be ...

The "simple" way is an extra NIC in your OpenBSD router and a second AP, which is probably $50 outlay. But if you don't want to spend any money, or are doing this more to learn than anything else then... DD-WRT support VLANs (virtual LANs) and VWLANs (virtual wireless LANs), and can have separate DHCP on the different VLANs. To set the DHCP on the V(W)LANs ...

If cybersecurity was simply a matter of not doing dangerous things, then we would have solved the problem by now. But this would include turning off the Internet, which is the most dangerous thing of all, so maybe a little danger isn't so bad. If a hacker has already broken into your Linux machine, one way he can elevate privileges is through loadable ...

I think there is a wide gap between "absolute" security and "good enough" security. Is SSL encryption worth the compute overhead on all of OpenBSD's mirrors? I don't think so. The chance that someone is going to hijack your http download session and patch your iso and then update the checksum is pretty low. A more likely scenario is that the files get ...

One security problem with a LiveCD is that its static and there for cannot be updated. The SQL Slammer worm was memory resident, it doesn't matter if you have a disk drive. You can install live cd's onto usb drives using LiveUSB Creator. Check out the new Debian GNU/kFreeBSD distribution. You have all the power of apt and its built on a FreeBSD kernel. ...

The best evidence, as I read it, is that the allegations of a backdoor in OpenBSD are so much hot air. It looks to me like a scurrilous and unjustified smear of OpenBSD, in an attempt to spread FUD (fear, uncertainty, and doubt). In my view, Gregory Perry's allegations have little credibility at this point. I'll list some of the evidence against his ...

This doesn't really answer your question, but circa 2001 code may have had major changes in the last decade-ish so it's hard to say whether the code would still be there anyway (if it was there in the first place). Somewhat closer to a useable answer: Graham has a listed a few. The next question is when did they start consuming that code? Before or after ...