{"id":465,"date":"2011-02-11T13:45:20","date_gmt":"2011-02-11T21:45:20","guid":{"rendered":"http:\/\/www.outflux.net\/blog\/?p=465"},"modified":"2011-02-12T08:44:29","modified_gmt":"2011-02-12T16:44:29","slug":"shaping-the-direction-of-research","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2011\/02\/11\/shaping-the-direction-of-research\/","title":{"rendered":"shaping the direction of research"},"content":{"rendered":"

Other people have taken notice<\/a> of the recent “auto-run” attack research against Linux. I was extremely excited to see Jon Larimer publishing this stuff, since it ultimately did not start with the words, “first we disabled NX<\/a>, ASLR<\/a>, and (SELinux|AppArmor) …”<\/p>\n

I was pretty disappointed with last year’s Blackhat conference because so many of the presentations just rehashed ancient exploitation techniques, and very few actually showed new ideas. I got tired of seeing mitigation technologies disabled to accomplish an attack. That’s kind of not the point.<\/p>\n

Anyway, Jon’s research<\/a> is a step in the right direction. He defeats ASLR via brute-force, side-steps NX with ret-to-libc, and finds policy holes in AppArmor to accomplish the goal. I was pleased to see “protected by PIE<\/a> and AppArmor<\/a>” in his slides — Ubuntu’s hardening of evince was very intentional. It has proven to be a dangerous piece of software, which Jon’s research just further reinforces. He chose to attack the difficult target instead of going after what might have been the easier thumbnailers.<\/p>\n

So, because of this research, we can take a step back and think about what could be done to improve the situation from a proactive security perspective. A few things stand out:<\/p>\n