The Jurassic Park scene referenced in the title is infamous for how ludicrous it sounds to those who are tech literate. But it also illustrates what seems to me to be a glaringly huge hole in web security, particularly IoT devices--as soon as attackers find out a server or camera or baby monitor is running linux, they instantly know volumes about how it works. They know that commands like
sudo are big juicy targets and they know that shell access will bring with it gobs of useful tools like
RRI6e29 commands instead of
ls? Imagine a hacker that somehow gained remote root access--what are they even going to do if they don't know any commands?
Implementation would be fairly easy for compilers. Take the simplest case of "rename this function and all calls to it." You could give an OS compiler and an application compiler the same randomized names and they'd be able to talk to each other. But even if the application has poor security and is vulnerable to bash injection, such attacks would be fruitless.
Obviously this technique can't be used in all scenarios. Setting aside scenarios like servers maintained by human sysadmins, it seems to me that any device or server managed by automation is a prime candidate for this defense.
I guess the question(s) needs to be a bit more concrete:
- Is OS obfuscation as described used widely and I just haven't encountered it?
- If not used widely, what are the practical or technical barriers to usage?