Главная
Study mode:
on
1
Introduction
2
Who am I
3
Root of Trust
4
Loch Ness Monster
5
Software is not easy
6
Policy granularity
7
Types
8
Interpreted languages
9
compiled languages
10
dependent types
11
file permissions
12
types and policy
13
policy
14
wish lists
15
understanding policy
16
semantics of uboot
17
bootloader
18
what to expect from bootloader
19
how should you behave
20
boot loaders
21
boot image
22
memory regions
23
black
24
tool suite
25
the bootloader
26
blockwrite operations
27
call graph
28
call stack instrumentation
29
writability
30
final thoughts
31
kitty
Description:
Explore innovative approaches to software hardening in this 40-minute conference talk from NorthSec 2020. Delve into the concept of using types beyond traditional compiler and interpreter applications to implement policies across address spaces. Learn how semantically related objects grouped in memory can be leveraged for enhanced security measures. Discover the potential of assigning types to memory regions as a basis for practical access control policies. Follow the speaker's journey in retroactively hardening a U-Boot bootloader instance, modeling its intentions, and creating a mediating access control policy. Understand how typed region-based hardening can be applied to various software types, protecting against both low-level memory vulnerabilities and high-level logic-based attacks. Gain insights into the speaker's background in studying weird machines in application linkers and loaders, and their current focus on system bootstrap loaders as a senior security researcher.

Regions Are Types, Types Are Policy, and Other Ramblings

NorthSec
Add to list