Shawn Webb is a user on bsd.network. You can follow them or interact with them if you have an account anywhere in the fediverse. If you don't, you can sign up here.
Shawn Webb @lattera

: Day two. More live tooting. We'll kick off this day with an update by the FreeBSD Security Team (secteam@).

Shawn Webb @lattera

: The security officer position has its own charter. The challenges facing the security team are quite difficult:

1. Extremely broad mandate
2. A lot of hurry up and wait activities not conducive to a friendly employment environment
3. Very high level of very technical knowledge required to respond to the large variety of issues

Shawn Webb @lattera

: There's a lot of burnout. Especially so since there's few qualified people to work on the security team.

Shawn Webb @lattera

: They're fixing these challenges by splitting vulnerability response and mitigation implementation.

Shawn Webb @lattera

: FreeBSD needs technical resources and need people who are willing to work on issues that cannot be disclosed outside.

Shawn Webb @lattera

: [Personal note: Gordon's moving pretty fast. I won't be able to capture everything.]

Shawn Webb @lattera

: Two basic workstreams:

1. FreeBSD only response:
- No NDA or explicit embargo
- Only applies to FreeBSD (and maybe Net/Open)
- No major risk of exposure
2. Multi-vendor coordinated response:
- NDA and/or explicit embargo
- Coordinated response via private party or CERT/CC
- Requires limited internal disclosure to contain risk of exposure

Shawn Webb @lattera

: Note on exposure: Some bugs details have leaked because a security team member disclosed to their employer the bug, even when they weren't supposed to do so.

Shawn Webb @lattera

: We don't want to end up like where vendors don't notify us of vulnerabilities due to violating embargoes.

Shawn Webb @lattera

: There were FreeBSD committers that were notified of Meltdown by Intel via unofficial channels prior to the secteam's official notification in late December. Those committers did not notify secteam.

Shawn Webb @lattera

: How the FreeBSD Foundation enables secteam:

1. Holder of NDA and vendor relationships
- Survivability of changeover of security officer
- Vendor relationships
2. Funds resources
- Pays for Ed's time
- Pays for Gordon's travel
- Pays for development resources to enable response (kib@ specifically)

Shawn Webb @lattera

: Once CERT/CC was involved with CVE-2018-8897 / SA-18:06.debugreg, FreeBSD was able to give pre-embargo patches to pfSense.

[Personal note: this is rather... interesting...]

Shawn Webb @lattera

: FreeBSD uses Coverity, but doesn't pay much attention to it.

Shawn Webb @lattera

: From Ed Maste: the FreeBSD Foundation interns worked on Syzkaller. FreeBSD is hoping to help enhance its FreeBSD support.

Shawn Webb @lattera

: Question in the audience: do these embargoes have rules regarding early disclosure by other vendors (ie, )?

Answer: embargoes are usually negotiated with the researcher. You'll notice that the embargo dates fall around the Blackhat conference.

Shawn Webb @lattera

: [Personal note: there seems to be some hostility towards by multiple people here.]

Shawn Webb @lattera

: Ed Maste: I certainly don't want a reputation of blowing embargoes.

Shawn Webb @lattera

: From Allan Jude: Should secteam@ have a phone number?

Shawn Webb @lattera

: secteam update finished. On break for a half hour.

Shawn Webb @lattera

: The devsummit is about to continue with FreeBSD 12.0 planning.

Shawn Webb @lattera

: FreeBSD would like to get 1.1 in base for the 12.0 release.

Shawn Webb @lattera

: Bikeshedding how to take notes.

Shawn Webb @lattera

: Desired to get in to 12.0: geli UEFI support.

Shawn Webb @lattera

: Desired for 12.0: Removal of gets(3).

Shawn Webb @lattera

: Desired for 12.0: kill gcc 4.2.1 in base completely.

Shawn Webb @lattera

: pkgbase will be an experimental feature in 12.0. Perhaps provide the required infrastructure (pkg repo). Have pkgbase configured and enabled by default, but allow users to still use freebsd-update.

Shawn Webb @lattera

: LUA loader enabled by default. UEFI boot loader loose ends. devmatch loose ends.

Shawn Webb @lattera

: [Personal note: if I just list random stuff for the next little while, that likely means things that will/might go into 12.0]

· Web · 0 · 0
Shawn Webb @lattera

: Making sure kernel memory mappings that don't need to be executable aren't on amd64.

Shawn Webb @lattera

: [Personal note: taking a break for a few minutes. Peeps are taking notes on a Google Doc, which I assume will be shared later.]

Shawn Webb @lattera

: [Personal note: I'm back. Something I ate yesterday isn't agreeing with me.]

Shawn Webb @lattera

: Juniper would like to volunteer to help get verified exec in 12.0.

Shawn Webb @lattera

: Kostik's ASLR and NVDIMM patches.

Shawn Webb @lattera

: Yahoo has made a private library in base for multiple years and recommends against it. It's a huge landmine, especially if libprivatecrypto and libcrypto are loaded at the same time.

nixfreak @nixfreak@social.i2p.rocks
@lattera is that effective against #rop also?
Shawn Webb @lattera

@nixfreak Nope.

nixfreak @nixfreak@social.i2p.rocks
@lattera interesting
Shawn Webb @lattera

@nixfreak You don't need rop when exploiting the kernel. No W^X and no SMAP. Right now, an attacker can craft an exploit where the code is mapped in userland, but the kernel will still jump to it.

nixfreak @nixfreak@social.i2p.rocks
@lattera very cool and scary at the same time.
bsd.network powered by Mastodon