mailing list archives
Re: Heterogeneity as a form of obscurity, and its usefulness
From: Crispin Cowan <crispin () immunix com>
Date: Thu, 21 Aug 2003 20:56:51 -0700
Bob Rogers wrote:
Heterogeneity increases survivability of the *species*, but does little
to protect the individual . . .
I don't think that stands up, at least not for digital species. I can
run Apache on Linux/x86, for which tons of shellcode is available, or I
can run the same version of Apache on Linux/sparc, for which much less
is available, and exists within a smaller and more specialized
. . . At most, you could say that running the most common system
makes you somewhat more vulnerable to attack, and you should take
that into consideration when planning your security.
These statements seem to agree. Is there a point?
Yes; and it would be interesting (though probably difficult) to quantify
It is difficult to quantify just about any security benefit.
Now that is just not true. All of the technologies in the previous
thread (StackGuard, PointGuard, ProPolice, PaX, W^X, etc.) have some
capacity to resist attacks based on unpublished/unpatched
vulnerabilities. That is their entire purpose.
So heterogeneity is really just security by obscurity, dressed up to
sound pretty . . .
Seems to me that obscurity is the *only* defence against exploits for
unpublished/unpatched vulnerabilities that are spreading in the cracker
community; if you can avoid being a target, by whatever means, then you
are ahead of the game.
Crispin Cowan, Ph.D. http://immunix.com/~crispin/
Chief Scientist, Immunix http://immunix.com
Re: [Full-Disclosure] Re: Buffer overflow prevention KF (Aug 15)
RE: Buffer overflow prevention Brian Glover (Aug 14)
Re: Buffer overflow prevention noir (Aug 14)
Re: Buffer overflow prevention Matt D. Harris (Aug 15)
RE: Buffer overflow prevention Avery Buffington (Aug 15)
Re: Buffer overflow prevention Massimo Bernaschi (Aug 15)
Re: Buffer overflow prevention Tom 7 (Aug 15)
RE: Buffer overflow prevention noir (Aug 15)
- Re: Buffer overflow prevention, (continued)