Re: [PATCH] [RFC] Deter exploit bruteforcing

Pavel Machek
2015-01-02T22:54:24Z

On Fri 2015-01-02 23:49:52, Jiri Kosina wrote:
> On Fri, 2 Jan 2015, Pavel Machek wrote:
>
> > > You also want to protect against binaries that are evil on purpose,
> > > right?
> >
> > Umm. No. Not by default. We don't want to break crashme or trinity by
> > default.
>
> I thought trinity is issuing syscalls directly (would make more sense than
> going through glibc, wouldn't it?) ... haven't checked the source though.

Patch in this thread wanted to insert delays into kernel on SIGSEGV
processing. That's bad idea by default.

But changing glibc to do sleep(30); abort(); instead of abort(); to
slow down bruteforcing of canaries makes some kind of sense... and
should be ok by default.
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html