Hanno Böck

Recently Chris Evans published a series of blog posts where he pointed out serious security problems of common Linux Desktop systems. A combination of automatic downloads (from Chrome), automatic parsing of new files by desktop search systems and libraries with a huge attack surface and support for countless file formats cause a very explosive combination. What's wrong with Linux Desktop security and how can we fix it?

Recently Chris Evans published a series of blog posts where he pointed out serious security problems of common Linux Desktop systems. A combination of automatic downloads (from Chrome), automatic parsing of new files by desktop search systems and libraries with a huge attack surface and support for countless file formats cause a very explosive combination. What's wrong with Linux Desktop security and how can we fix it?

The talk will present a Linux system completely built with Address Sanitizer. Address Sanitizer is a protection mechanism in the gcc and clang compilers that detects and prevents various memory corruption bugs.

Common C coding bugs like buffer overflows, use after free errors and other errors accessing invalid memory are still amongst the most prevalent security issues in today’s software. Modern operating systems have mitigations like ASLR and Stack Canaries, but they can often be circumvented. The gcc and clang compilers come with a feature called Address Sanitizer (short: ASAN). It detects memory access bugs at runtime and stops the program execution. Compared to other previous solutions Address Sanitizer is relatively fast, although it still causes a significant performance hit. It can usually be used with real world software without any modifications. Address Sanitizer is primarily designed as a debugging tool and as such it has been remarkably successful. The speaker has used ASAN in combination with fuzzing to successfully uncover a large number of bugs. But Address Sanitizer could also be used in production. Recently the Tor project started publishing nightly builds of its browser bundle protected with Address Sanitizer. The speaker will present a fully working Linux system (based on Gentoo) with everything except a few core parts compiled with Address Sanitizer. Just trying to do that already uncovered several memory access bugs in core packages like bash and coreutils.

It is surprisingly easy to find memory access violation bugs in all kinds of common Linux tools via very simple fuzzing. The Fuzzing Project is trying to fix that by systematically fuzzing applications and providing helpful pointers for developers to fuzz their own code.

Fuzzing is an easy strategy to find bugs in software. It works by creating a large number of malformed inputs and see what happens. Crashes usually point to bugs in the memory handling of an application which can often be a sign of potential security bugs.

Lately a large number of bugs and security issues have been found with fuzzing, many of them in basic and important tools like less, strings, unzip, gnupg, bash and many more. This highlights a pretty dismal state of the security of many key free software projects.

The talk will give a short introduction to fuzzing with tools like zzuf, american fuzzy lop and Address Sanitizer.