bugtraq - Heterogeneity as a form of obscurity, and its usefulness

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <16196.10156.341677.493809@rgrjr.dyndns.org>
Date: Wed, 20 Aug 2003 22:00:12 -0400
From: Bob Rogers <rogers-bt2@...jr.dyndns.org>
To: Crispin Cowan <crispin@...unix.com>
Cc: "BUGTRAQ@...URITYFOCUS.COM" <BUGTRAQ@...URITYFOCUS.COM>
Subject: Heterogeneity as a form of obscurity, and its usefulness

   From: Crispin Cowan <crispin@...unix.com>
   Date: Sun, 17 Aug 2003 15:42:07 -0700

   Shaun Clowes wrote:

   >I think it's generally accepted that homogenity breeds insecurity, in
   >which case it makes sense to try to be as different from everyone else
   >as possible even if that doesn't make it impossible for someone to break
   >you.
   >
   That is a commonly held view, but I would not say it is widely accepted. 
   I certainly don't accept it.

   Heterogeneity increases survivability of the *species*, but does little 
   to protect the individual . . .

I don't think that stands up, at least not for digital species.  I can
run Apache on Linux/x86, for which tons of shellcode is available, or I
can run the same version of Apache on Linux/sparc, for which much less
is available, and exists within a smaller and more specialized
community.  For a member of a biological species, this would be
tantamount to switching to an entirely different biochemistry at will,
in order to become indigestible to the majority of predators (and making
the Darwinian metaphor much harder to digest in the process).

   From this perspective, it is clear that choosing the "biochemistry"
of Sparcs would protect me as an individual.  At the very least, I can
expect to have more time to patch my Sparc when a new vulnerability
comes to light.

   . . . At most, you could say that running the most common system
   makes you somewhat more vulnerable to attack, and you should take
   that into consideration when planning your security.

Yes; and it would be interesting (though probably difficult) to quantify
that.  Exploits are often cobbled together from several sources, so the
size of an "exploit community" has a direct bearing on how quickly an
exploit becomes available after a member of that community learns of an
exploitable flaw.  Perhaps the dependence of time to exploit on
community size is even quadratic?  If so, then heterogeneity benefits
the whole ecological niche, by fragmenting exploit communities and
therefore making them less efficient.

   So heterogeneity is really just security by obscurity, dressed up to
   sound pretty . . .

Seems to me that obscurity is the *only* defence against exploits for
unpublished/unpatched vulnerabilities that are spreading in the cracker
community; if you can avoid being a target, by whatever means, then you
are ahead of the game.

   Anyway, thank you for posting, and making me think.

					-- Bob Rogers
					   http://rgrjr.dyndns.org/

P.S. to moderator:  I am hoping that this has diverged sufficiently from
the original "Buffer overflow prevention" thread to be worth approving . . .