Messages in this thread | | | Date | Fri, 2 Jan 2015 23:54:20 +0100 | From | Pavel Machek <> | Subject | Re: [PATCH] [RFC] Deter exploit bruteforcing |
| |
On Fri 2015-01-02 23:49:52, Jiri Kosina wrote: > On Fri, 2 Jan 2015, Pavel Machek wrote: > > > > You also want to protect against binaries that are evil on purpose, > > > right? > > > > Umm. No. Not by default. We don't want to break crashme or trinity by > > default. > > I thought trinity is issuing syscalls directly (would make more sense than > going through glibc, wouldn't it?) ... haven't checked the source though.
Patch in this thread wanted to insert delays into kernel on SIGSEGV processing. That's bad idea by default.
But changing glibc to do sleep(30); abort(); instead of abort(); to slow down bruteforcing of canaries makes some kind of sense... and should be ok by default. Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
| |