Re: Worm and virus free code.

[Ian Lance Taylor <ian at wasabisystems dot com>]

markw <markw@mohawksoft.com> writes:

> I had an idea for helping prevent worms from spreading even if there
> were vulnerabilities.
> 
> Is there a way that gcc and ld could randomize locations of functions,
> code, and data at compile, link, or even load times?
> 
> During the debugging phase, this would be turned off, but during
> production, you may turn this feature on so that function and data
> references are randomized in memory at link time.
> 
> Even if a stack overflow vulnerability did exists, the functions and
> or data it would attempt to access wouldn't be where they are supposed
> to be.
> 
> It may take a little overhead at link time, and if memory image
> randomization were practical, it may take a little time at program
> start and shared library mapping, but it could make gcc programs
> immune to worms and viruses that spread via stack overflow or other
> vulnerabilities.

This could be done at load time on an ELF system.  It doesn't require
any compiler work.  The relatively easy way is to compile all your
code with -fPIC, perhaps tweak the linker slightly to preserve all
relocations in the executable, and tell the loader to randomize the
load address.

However, this wouldn't prevent worms from spreading, it would just
raise the barrier.  My understanding of the recent ssh attacks is that
they simply tried a wide range of buffer overflows until they found
one which worked.

Ian