As I’ve got a new laptop (a tiny EeePC) I used the chance to try gentoo hardened on the desktop. For those who don’t know: Gentoo hardened is a Gentoo Linux flavour where all packages are compiled with stack smashing protection (SSP) and address space layout randomization (ASLR) support. This makes the system a pretty hostile environment for attackers. So far everything went good and I have a fine gnome desktop running. The only major glitch is that python C extensions (ctypes) don’t work because the python runtime uses a bad mmap which would violate the general W^X policy enforced by the PaX kernel patches. But that bug is reported upstream and can and will be fixed.

Another security measure hardened takes is the so called relro linking. Usually when you link your executable binary against a shared library (.so) the dynamic linker loads symbols as they are needed (lazy). For this and the general dynamic linking process to work, references to dynamically exported symbols have to go through an indirection process. One part of this indirection mechanism on IA32 and AMD64 is the GOT, the global offset table. Think of it as a table where you can look up the addresses of symbols (not quite correct though). When the dynamic linker works in lazy mode, it fills out entries in the GOT as needed. Therefore the GOT must be writeable memory.

Now if an attacker manages to insert code into a running process and then tries to transfer control to this code one convenient way to achieve this would be to write into the GOT and manipulate an address there. Therefore we don’t really want the GOT to be writeable. But for this to work, lazy binding has to be disabled. That’s done with the ldd linker flags -z now and -z relro. -z now advises the linker to resolve symbols on load time and not to use lazy binding. -z relro makes the linker mark the GOT read-only.

Now while this is a cool defensive feature for security, it’s terrible for desktop performance. Every program loads all of it’s libraries on load time which slows down load times. I didn’t do any measurements but my HDD got pretty busy when I started heavy GUI programs. Combined with a slow laptop HDD this is no fun.

But there is a device in this little laptop that is unused most of the time anyway and could help: the SD-card reader. Given a good controller attached to the USB2.0 port and a fast SDHC card, it could somehow serve as a cache for /usr 90% of the systems libraries. So I bought a fine class 10 16GB SDHC card and put it into the slot. dd reported 20MB/s write speed. Combined with excellent random-access behaviour, this should be enough to improve the situation.

Now the idea is to somehow redirect access to /usr onto the SD card. There already are solutions out there. Google for mcachefs. Mcachefs is a fuse filesystem written in C that buffers accessed files on another filesystem that may be a solid state disk. But mcachefs is alpha-sate software and has known bugs. So I needed to go for something simpler. Writing my own python fuse filesystem seemed like a lot of work and the extra fuse overhead is something I’d like to avoid if possible anyway.

So I went for something more simple: I just copied /usr over to the SD card and mounted it over /usr in ro mode. The problem is, you will never be able to unmount this and access your real /usr (e.g. to install new packages) as long as there are processes running in the background with open files from /usr. So this was no option either. To be able to switch back and forth between the read-only /usr cache and the real read-write /usr both must be mounted and we need something to decide what to use. Symlink anyone? :)

That’s the solution where I’m now: Move your /usr to /usr.real/ and create a symlink named /usr that pointers either to /usr.real/ or /fscache/usr/. To make things more comfortable I created a nice gentoo init script.

/etc/init.d/fscache start #set up the mount and symlinks
/etc/init.d/fscache stop #switch the symlink back to /usr.real/
/etc/init.d/fscache sync #run an rsync that syncs /usr.real/ into /fscache/usr/


To use it, you have to setup your SD card, rename /usr to /usr.real and create and initial symlink /usr -> /usr.real/ (it won’t do anything if /usr is a directory).

Here is the code: http://pastebin.com/zw10p6TR

Solved what’s probably everbodys most neglected problem: backups (or better their absence).

• bought a bluetooth stick to backup the phone (with gammu/wammu)
• bought a 2TB HDD and an USB/eSATA case to backup my systems (with rsnapshot)

It definitly was a very relaxing moment when I finished the first backup. Rsnapshot is certainly the tool to use for such home backup purposes. It allows you to have multiple virtual full snapshots of the system while only needing the space of the first full backup plus all your changes (it uses hardlinks for unchanged files). One thing I noticed: As I’m a bit of a paranoid, I set the disc encryption algorithm to AES256 in contrast to dmcrypts default AES128 setting. Now it seems like that takes up a considerable amount of CPU cycles more then AES128 (no real measurement, just quick observation). The result is that on my Atom 330 board, the encryption process runs at 100% CPU usage, eating up a full core and I only get 15MB/s writing speed (as opposed to 30MB/s on a Core2Duo 1.6GHz — maxing out the USB port). It’s still OK, it’s just that I don’t even have to bother using the eSATA port with the system. The good thing is, that on the next weekly backup, the disk speed will not matter very much as only the diff will get rsynced :)

Now … my nights will be much better, I think :)

And if you don’t have home backups yet, I hope your nights will be very restless!

… hab die letzten 8h damit verbracht herauszufinden warum mein selbstgebauter shellcode POC segfaultet …
Bis ich bemerkt habe, dass kernel+cpu W^X machen. So’n Mist! Im Wohnzimmer auf der alten Kiste und ohne PaX ging’s dann :)
Dear h4cker-g0dz, plz give me a ROP-compiler.

We all have passwords. Lots of passwords. Be it for hosts or websites or disc-encryption. Noone can memorize a thousand different passwords for every account one needs. So we have two possibilities:

1. use a small number of default-passwords or
2. use a password-manager

Most people I know chose a combination of the two. But having shared passwords between different accounts makes you very vulnerable in case of targeted attacks (or even automated attacks, if the attackers tool is smart). So what you really want is different passwords for each and every account.

For that to work for daily use, you want an integrated wallet, like the KDE wallet, the Gnome keyring or the Firefox password manager. But for longtime archival to look up that password you had for that old mail-account somewhere, you want something seperate that can hold all kinds of different passwords and is more or less plattform independent.

For a long time I maintained my list of passwords with gpg: I had an encrypted file with all my accounts. To access one of the passwords, I could do a gpg -d passwords.txt.gpg | grep username. To add or change a password, I had to save the decrypted file on disk, edit the record, encrypt the cleartext again and then shred the remaining cleartext file. This was really cumbersome.

What I really wanted was a simple independant password-manager for the command line.

This is what pwsafe is.

It has a pretty simple cli. Every record has a group.name string as primary key and has username, password and optional notes as properties. The commands to access the records are straight forward:
pwsafe -l [REGEXP] — list passwords matching regexp
pwsafe -a group.name — add a new record
pwsafe -up [REGEXP] — print records matching regexp
pwsafe -e [REGEXP] — edit existing records matching regexp

The grouping system becomes really natural after some time. For every operation you have to enter a passphrase to decrypt the on-disc password database. The on-disc file format is compatible with the windows tool password-manager.

I’ve taken a quick view at the source-code. It tries to mimick the behaviour of Schneiers password-safe. That means it uses (openssl) Blowfish in CBC mode and tries to keep the passphrase in non-swappable memory (needs suid-root for that to work). The passphrase is directly fed into blowfish as the encryption key. That means if you supply an 8-character passphrase you only get like 40^8 bit of randomness. So you better chose a strong passphrase. To get at least a 64bit strong key from about 40 keys on the keyboard you need about 12 or 13 characters.

I didn’t look for any parser vulnerabilities, but so far it seems the author knows what he did and I can only suggest pwsafe :)

The Lazy Programmer’s Guide to Secure Computing

small summary writeup:

• how to write secure code in an imperfect world
• code patterns for “principle of least authority” (POLA)a sharp razor (to much authority: you get abuse, to few authority: you don’t get your job done)
• security and POLA in the mail envelope, every security principle serves another purpose as well
• the OO paradigm could serve as a good security paradigm, too
• most languages break the security properties of OO (e.g. by allowing stack access)
• for various languages there are tools which fix these language problems and filter your code, thus enforcing OO security properties (e.g. Caja by Google and Yahoo for javascript, Joe-E for java, Emily for Ocaml)
• how could these patterns be transported into distributed systems, the web? implementations: waterken server / web-key
• with these patterns in action, a web-money protocol can be implemented in about 30LOC Java
• if POLA is used in larger OO software systems, you achive ultra-deep security in depth
• with POLA, the attack-tree risk-combining operation changes from OR to AND, thus the economics of security change
  • when extending code, you mostly add unpriviledged code
  • meanwhile you fix problems in the priviledged code
  • thus, over time code becomes more secure instead of less secure
• we should use memory-safe OO languages and POLA principles