IS THE LINUX DESKTOP LESS SECURE THAN WINDOWS 10? OR HOW SUPER - - PowerPoint PPT Presentation

▶
is the linux desktop less secure than windows 10
SMART_READER_LITE
LIVE PREVIEW

IS THE LINUX DESKTOP LESS SECURE THAN WINDOWS 10? OR HOW SUPER - - PowerPoint PPT Presentation

Feb 27, 2024 251 likes •584 views

IS THE LINUX DESKTOP LESS SECURE THAN WINDOWS 10? OR HOW SUPER MARIO MUSIC CAN OWN YOUR SYSTEM. Hanno Bck https://hboeck.de 1 This was too easy . It should not be possible to find a serious memory corruption vulnerability in the default

slide-1
SLIDE 1

IS THE LINUX DESKTOP LESS SECURE THAN WINDOWS 10?

OR HOW SUPER MARIO MUSIC CAN OWN YOUR SYSTEM. Hanno Böck https://hboeck.de

1

slide-2
SLIDE 2

This was too easy . It should not be possible to find a serious memory corruption vulnerability in the default Linux desktop attack surface with just a few minutes of

  • looking. Although it’ s hard to say it, this is not the kind
  • f situation that occurs with a latest Windows 10 default
  • install. Is it possible that Linux desktop security has

rotted? (Chris Evans)

2

slide-3
SLIDE 3

NINTENDO SOUND FILES (1)

Exploit against Gstreamer in Ubuntu 12.04 (LTS). Thumbnail parser.

3

slide-4
SLIDE 4

NINTENDO SOUND FILES (2)

NSF players are mini-emulators - the attacker can execute code in an emulator. Easier to bypass modern exploit mitigation techniques.

4

slide-5
SLIDE 5

FIX

The fix is to delete the affected NSF gstreamer plugin. No problem: Ubuntu shipped two different NSF player plugins.

5

slide-6
SLIDE 6

FLIC EXPLOIT

6

slide-7
SLIDE 7

AUTOMATIC DOWNLOADS

Some browsers automatically download files to ~/Downloads. Any webpage can create files on your filesystem. (Chrome/Chromium, Epiphany, ... - not Linux specific)

7

slide-8
SLIDE 8

TRACKER

GNOME Desktop search tool automatically indexes all new files in a user's home - including ~/Downloads.

8

slide-9
SLIDE 9

REACTION FROM TRACKER DEVELOPER

Furthermore, the GStreamer guys were extremely fast in fixing it. You could claim that other libraries used for metadata extraction are just as insecure, but that'd really be bugs in these libraries to fix. (Carlos Garnacho)

9

slide-10
SLIDE 10

TRACKER PARSERS (1)

Gstreamer, ffmpeg, flac, totem-pl-parser, tiff, libvorbis, taglib, libpng, libexif, giflib, libjpeg-turbo, libosinfo, poppler, libxml2, exempi, libgxps, ghostscript, libitpcdata

10

slide-11
SLIDE 11

TRACKER PARSERS (2)

If you can exploit any of them you can exploit many Linux desktop users from the web without user interaction.

11

slide-12
SLIDE 12

NOT JUST TRACKER

KDE has Baloo. Thumbnail tools from file managers have similar issues.

12

slide-13
SLIDE 13

PROBLEMS

Automation: Non-interactive downloads and automatic indexing creates a huge attack surface. Support for a vast variety of file formats by using many libraries of varying quality.

13

slide-14
SLIDE 14

WHAT CAN BE DONE?

14

slide-15
SLIDE 15

SANDBOXING

Isolated parser processes are good targets for sandboxing. Aer these events Tracker implemented sandboxing based on libseccomp (KDE/Baloo hasn't yet).

15

slide-16
SLIDE 16

EXPLOIT MITIGATION

Stack Canaries, nonexecutable memory, Address Space Layout Randomization, Code-Flow Integrity.

16

slide-17
SLIDE 17

LINUX AND ASLR (1)

ASLR is one of the strongest exploit mitigation techniques available. Linux has ASLR support since kernel 2.6.12.

17

slide-18
SLIDE 18

LINUX AND ASLR (2)

Proper ASLR needs position-independent code and executables (-fpic -pie). Linux distributions have been extremely slow in adopting ASLR.

18

slide-19
SLIDE 19

STATUS ASLR / PIE

Ubuntu: Introduced it in 16.10 (2016) Fedora: Introduced it in 23 (2015). Debian: Work in progress (Stretch / 2017).

  • penSUSE: No (only for few packages).

Gentoo: Only hardened Gentoo.

19

slide-20
SLIDE 20

AND WINDOWS?

Microso introduced ASLR in Vista. Modern Windows already has next-level mitigations like Code-Flow Integrity. However: Exploit mitigations depend on applications and configuration.

20

slide-21
SLIDE 21

21

slide-22
SLIDE 22

BURN ALL C?

So let's rewrite everything in Rust or other memory safe languages? Gstreamer already supports plugins written in Rust.

22

slide-23
SLIDE 23

OR CAN WE JUST FIX ALL THE BUGS?

Gstreamer is extremely prone to memory safety bugs - C code, parsers for many different file formats. Similar cases: ffmpeg, ImageMagick, browsers, wireshark, tcpdump, ...

23

slide-24
SLIDE 24

LET'S DO SOME FUZZING

Most of these bugs can be trivially found with modern coverage-based fuzzing and sanitizing tools. If they're still there it means nobody is trying to find and report them. American Fuzzy Lop, LibFuzzer, Address Sanitizer.

24

slide-25
SLIDE 25

FUZZING GSTREAMER

Result: 20 memory safety issues (crashes, invalid memory reads, not necessarily exploitable). This is quite a bit, but it's doable.

25

slide-26
SLIDE 26

BUT THERE ARE THE DEPENDENCIES...

libopus, flac, libvpx, libtheora, ffmpeg wavpack, game-music-emu, schroedinger, libsidplay, faad, a52dec, libcdio.

26

slide-27
SLIDE 27

FUZZING GSTREAMER CONCLUSION

I think we can fix most of the security bugs in Gstreamer. Not sure if the same is true for its dependencies.

27

slide-28
SLIDE 28

IS LINUX LESS SECURE THAN WINDOWS?

Automatic indexing of files with a lot of questionable quality parser code. Does something similar exist in Windows? Not by default, but there's Antivirus soware.

28

slide-29
SLIDE 29

BUG IN APPORT (1)

Donncha O'Cearbhaill found a code injection vulnerability in apport, an Ubuntu tool to handle crashes. No automation, requires user to click on .crash file.

29

slide-30
SLIDE 30

BUG IN APPORT (2)

An exploit dealer company offered the bug finder $ 10.000 for this bug. There's someone out there who thinks it's worth $ 10.000 to exploit some Ubuntu users.

30

slide-31
SLIDE 31

LINUX DESKTOP SECURITY MATTERS. WE HAVE TO FIX THIS!

31