Page 2 of 3 FirstFirst 123 LastLast
Results 11 to 20 of 22

Thread: FreeBSD does not have ASLR

  1. #11
    Join Date
    Oct 2013
    Posts
    8

    Default

    @Sergio
    Excuse me but I have no idea who endman is.

    The reason why I wrote this post was because I presented the same problem to forums.freebsd.org to tell them that it is a serious problem in today’s situation with software security. I also asked them for any simple work arounds but all they just did was ban me and removed my post like as if they are doing some cover up. Thus I was fustrated and shock by such a community and their software that I posted here instead hoping for a solution to show people this situation.

    The reason why I was doing this was because we had a new CTO (now fired) who demanded our company to migrate our Linux servers (which we were well familiar with) to FreeBSD servers (which I and other sysadmins don’t have much technical expertise). That CTO didn’t gave any reason for such a risky and unessasary switch. An argument broke out between him and other corparate officers and to resolve the issue, I was asked to use, get familiar with and analyze FreeBSD and do simple tests to see how secure it is.

    After a few days of using it and reading the handbook, me and other sysadmins found that FreeBSD seriously inadequate for running our company’s servers. As per our company’s policy on who should report to who, we submitted our findings to the CTO and his response was abusive demanding that we migrate our servers immediately and learn who to use FreeBSD or be fired. Me and my fellow sysadmins knew that we would be violating the company policy governing migration of servers between software platforms if we obeyed him. Worse is that the company’s proficiency in IT would be severly deminished if our servers were using FreeBSD instead of Linux. We decided to report this to the other corperate officers and they (unlike the CTO) seriously considered our report. They then had the CTO fired for his misconduct.

    The reason why this article was also at http://aboutthebsds.wordpress.com/ was because a UNIX engineer on contract at our company approached me to ask if he could publish part of my report on FreeBSD’s lack of ASLR on his blog which I agreed to as I felt that this situation should be made known to the public.


    @JX8p
    Thanks for the work around but our company is trying to avoid solutions involving the recompilation of an OS kernel as that would take a long time and is subseptible to complications. Furthermore, I searched around and found no evidence of FreeBSD RELEASE-10 having ASLR enabled by default. I know OpenBSD has ASLR but it is not very random and I’ve seen it hacked much more quickly and easily that either Linux or Windows. NetBSD has userland ASLR in which you have to do a “paxctl +A <binary file>“ on every binary file to make them have ASLR which is time consuming and introduces the risk of some binary files not having ASLR.


    Kind regards
    Felix Doggoson

  2. #12
    Join Date
    Oct 2013
    Posts
    8

    Default

    @Sergio
    Excuse me but I have no idea who endman is.

    The reason why I wrote this post was because I presented the same problem to forums.freebsd.org to tell them that it is a serious problem in today’s situation with software security. I also asked them for any simple work arounds but all they just did was ban me and removed my post like as if they are doing some cover up. Thus I was fustrated and shock by such a community and their software that I posted here instead hoping for a solution to show people this situation.

    The reason why I was doing this was because we had a new CTO (now fired) who demanded our company to migrate our Linux servers (which we were well familiar with) to FreeBSD servers (which I and other sysadmins don’t have much technical expertise). That CTO didn’t gave any reason for such a risky and unessasary switch. An argument broke out between him and other corparate officers and to resolve the issue, I was asked to use, get familiar with and analyze FreeBSD and do simple tests to see how secure it is.

    After a few days of using it and reading the handbook, me and other sysadmins found that FreeBSD seriously inadequate for running our company’s servers. As per our company’s policy on who should report to who, we submitted our findings to the CTO and his response was abusive demanding that we migrate our servers immediately and learn who to use FreeBSD or be fired. Me and my fellow sysadmins knew that we would be violating the company policy governing migration of servers between software platforms if we obeyed him. Worse is that the company’s proficiency in IT would be severly deminished if our servers were using FreeBSD instead of Linux. We decided to report this to the other corperate officers and they (unlike the CTO) seriously considered our report. They then had the CTO fired for his misconduct.

    The reason why this article was also at http://aboutthebsds.wordpress.com/ was because a UNIX engineer on contract at our company approached me to ask if he could publish part of my report on FreeBSD’s lack of ASLR on his blog which I agreed to as I felt that this situation should be made known to the public.


    @JX8p
    Thanks for the work around but our company is trying to avoid solutions involving the recompilation of an OS kernel as that would take a long time and is subseptible to complications. Furthermore, I searched around and found no evidence of FreeBSD RELEASE-10 having ASLR enabled by default. I know OpenBSD has ASLR but it is not very random and I’ve seen it hacked much more quickly and easily that either Linux or Windows. NetBSD has userland ASLR in which you have to do a “paxctl +A <binary file>“ on every binary file to make them have ASLR which is time consuming and introduces the risk of some binary files not having ASLR.


    Kind regards
    Felix Doggoson

  3. #13
    Join Date
    Jan 2013
    Posts
    525

    Default

    Quote Originally Posted by doggobot View Post
    @Sergio
    Excuse me but I have no idea who endman is.

    The reason why I wrote this post was because I presented the same problem to forums.freebsd.org to tell them that it is a serious problem in today’s situation with software security. I also asked them for any simple work arounds but all they just did was ban me and removed my post like as if they are doing some cover up. Thus I was fustrated and shock by such a community and their software that I posted here instead hoping for a solution to show people this situation.

    The reason why I was doing this was because we had a new CTO (now fired) who demanded our company to migrate our Linux servers (which we were well familiar with) to FreeBSD servers (which I and other sysadmins don’t have much technical expertise). That CTO didn’t gave any reason for such a risky and unessasary switch. An argument broke out between him and other corparate officers and to resolve the issue, I was asked to use, get familiar with and analyze FreeBSD and do simple tests to see how secure it is.

    After a few days of using it and reading the handbook, me and other sysadmins found that FreeBSD seriously inadequate for running our company’s servers. As per our company’s policy on who should report to who, we submitted our findings to the CTO and his response was abusive demanding that we migrate our servers immediately and learn who to use FreeBSD or be fired. Me and my fellow sysadmins knew that we would be violating the company policy governing migration of servers between software platforms if we obeyed him. Worse is that the company’s proficiency in IT would be severly deminished if our servers were using FreeBSD instead of Linux. We decided to report this to the other corperate officers and they (unlike the CTO) seriously considered our report. They then had the CTO fired for his misconduct.

    The reason why this article was also at http://aboutthebsds.wordpress.com/ was because a UNIX engineer on contract at our company approached me to ask if he could publish part of my report on FreeBSD’s lack of ASLR on his blog which I agreed to as I felt that this situation should be made known to the public.


    @JX8p
    Thanks for the work around but our company is trying to avoid solutions involving the recompilation of an OS kernel as that would take a long time and is subseptible to complications. Furthermore, I searched around and found no evidence of FreeBSD RELEASE-10 having ASLR enabled by default. I know OpenBSD has ASLR but it is not very random and I’ve seen it hacked much more quickly and easily that either Linux or Windows. NetBSD has userland ASLR in which you have to do a “paxctl +A <binary file>“ on every binary file to make them have ASLR which is time consuming and introduces the risk of some binary files not having ASLR.


    Kind regards
    Felix Doggoson
    Do you have any proof to back up your situation? I mean, that whole story sounds fishy and unlikely to occur in any workplace. I'd also like you to show the evidence of where OpenBSD ASLR can be hacked 'more easily'.

  4. #14
    Join Date
    Feb 2012
    Posts
    240

    Default

    Quote Originally Posted by doggobot View Post
    I know OpenBSD has ASLR but it is not very random and I’ve seen it hacked much more quickly and easily that either Linux or Windows. NetBSD has userland ASLR in which you have to do a “paxctl +A <binary file>“ on every binary file to make them have ASLR which is time consuming and introduces the risk of some binary files not having ASLR.
    This is simply hilarious... It can only come from one person: The BSD troll (Pawlerson, kraftman, endman, BSDSucksDicks, etc, etc). Loser.

  5. #15
    Join Date
    Nov 2012
    Posts
    597

    Wink

    Quote Originally Posted by Sergio View Post
    Riiiiiight, Pawlerson (aka kraftman, aka BSDSucksDicks, aka endman, etc, etc)...
    It seems you still didn't take your medicine. Sergio (aka: VimUser, kebbabert, Thomas Abthorpe, Eitan Adler, Shunsuke Akiyama, Monthadar Al Jaberi etc, etc)...

  6. #16
    Join Date
    Nov 2012
    Posts
    597

    Default

    Quote Originally Posted by Sergio View Post
    This is simply hilarious... It can only come from one person: The BSD troll (Pawlerson, kraftman, endman, BSDSucksDicks, etc, etc). Loser.
    What's so hilarious about this? It is known fact freebsd does not have ASLR, so I wouldn't expect security from other bsd either. What's hilarious is your an only and insane argument: aka Pawlerson, kraftman, endman, startman etc.

  7. #17
    Join Date
    Feb 2012
    Posts
    240

    Default

    Quote Originally Posted by Pawlerson View Post
    It seems you still didn't take your medicine. Sergio (aka: VimUser, kebbabert, Thomas Abthorpe, Eitan Adler, Shunsuke Akiyama, Monthadar Al Jaberi etc, etc)...
    Sure, because I am the one creating endless accounts for the sole purpose of trolling... Linux? Oh, wait...

  8. #18
    Join Date
    Jan 2013
    Posts
    1,116

    Default

    Quote Originally Posted by Pawlerson View Post
    What's so hilarious about this? It is known fact freebsd does not have ASLR, so I wouldn't expect security from other bsd either.
    It is also a known fact that in Puppy Linux you are logged in as root by default. Following your logic we have to conclude that this is the case for all other distros. We also have to conclude that any distro is user-friendly because Mint is, that any distro is source based because Gentoo is, that no distro uses systemd because Slackware doesn't, that any distro is commercial because RHEL is, and so on.

    You know why it is so easy to spot your alter egos and connect them to you (or whichever of those accounts was the original one)? Because they all have the same poor English, the same style of argumentation, the same poor logic and reasoning.

  9. #19
    Join Date
    Dec 2013
    Posts
    39

    Default

    Quote Originally Posted by Vim_User
    It is also a known fact that in Puppy Linux you are logged in as root by default. Following your logic we have to conclude that this is the case for all other distros. We also have to conclude that any distro is user-friendly because Mint is, that any distro is source based because Gentoo is, that no distro uses systemd because Slackware doesn't, that any distro is commercial because RHEL is, and so on.
    The fact is that other BSDs also do not have modern security features that can deal with today’s security problems. The only reason why there are very little publicity in BSD security break ins is because there aren’t much installations out there (almost none). Thus learning how to be hack BSD is a waste of time expect to show BSD zealots that BSDs are inherently insecure.

    OpenBSD are fools because they believe that the right way to make a secure OS is to write one that is clean and bug-free with no security mechanisms like NX, SELinux and AppArmor. The problem is no usable code can be bug-free and their meaning of clean code is ambigious if there’s a security hole and someone exploits it, BAM!!! the box is owned. In Linux if there’s a security hole and someone exploit it, Selinux or AppArmor will prevent the exploit from working.

    NetBSD’s atitude to implementing ASLR in such a way that you have to do paxctl +A on every damn binary is funny at best. Also, in terms of rootkit detection, rkhunter is incompatible with NetBSD. The only thing you can install as an outdated version of chkrootkit which is shit because the updated version of chkrootkit can be defeated by many rootkits.

    There’s absolutely nothing in DragonflyBSD.

    On top of all this, BSD code is only checked, audited and patched by a handful of people with questionable sanity while Linux code is check, audited and patched by many including companies and real security experts. Also, much of the security implementations that do make it through to BSD (like pf etc.) are far less flexibe then their Linux counterparts.

    Quote Originally Posted by Vim_User
    You know why it is so easy to spot your alter egos and connect them to you (or whichever of those accounts was the original one)? Because they all have the same poor English, the same style of argumentation, the same poor logic and reasoning.
    I think it has come to the point that this argument has been used by nearly all BSD trolls that one can’t take the argument seriously. Many people have bad english so your argument fails even further.

  10. #20
    Join Date
    Feb 2012
    Posts
    240

    Default

    Quote Originally Posted by beetreetime View Post
    The fact is that other BSDs also do not have modern security features that can deal with today’s security problems. The only reason why there are very little publicity in BSD security break ins is because there aren’t much installations out there (almost none). Thus learning how to be hack BSD is a waste of time expect to show BSD zealots that BSDs are inherently insecure.

    OpenBSD are fools because they believe that the right way to make a secure OS is to write one that is clean and bug-free with no security mechanisms like NX, SELinux and AppArmor. The problem is no usable code can be bug-free and their meaning of clean code is ambigious if there’s a security hole and someone exploits it, BAM!!! the box is owned. In Linux if there’s a security hole and someone exploit it, Selinux or AppArmor will prevent the exploit from working.

    NetBSD’s atitude to implementing ASLR in such a way that you have to do paxctl +A on every damn binary is funny at best. Also, in terms of rootkit detection, rkhunter is incompatible with NetBSD. The only thing you can install as an outdated version of chkrootkit which is shit because the updated version of chkrootkit can be defeated by many rootkits.

    There’s absolutely nothing in DragonflyBSD.

    On top of all this, BSD code is only checked, audited and patched by a handful of people with questionable sanity while Linux code is check, audited and patched by many including companies and real security experts. Also, much of the security implementations that do make it through to BSD (like pf etc.) are far less flexibe then their Linux counterparts.



    I think it has come to the point that this argument has been used by nearly all BSD trolls that one can’t take the argument seriously. Many people have bad english so your argument fails even further.
    I'm pretty sure you have no fucking idea about what you are saying... You know nothing about how an OS fucking works; all things you say are just plain stupid.

    Nevertheless, take a look at http://www.trustedbsd.org, although I'm pretty sure you won't understand shit.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •