Re: Preventing exploitation with rebasing

[Carolyn Meinel <cmeinel () techbroker com>]

On Wednesday 05 February 2003 16:07, Seth Breidbart wrote:
> Even under the assumption that locations aren't re-used, it's
> provably impossible (Turing-complete) to determine whether the
> contents of a location can be used as an address by a program.

Would that be more accurately not impossible, but "intractable"? With a 
small enough and simple enough program it is possible to analyze 
whether its implementation on a Turing Machine will reach a halting 
point. What the Turing Machine Halting Problem proves is that for an 
arbitrary tape, calculation of the upper bound on the number of moves 
the read-write head must make to determine whether there is a halting 
state is an "intractable" problem.

What this rebasing discussion comes down to is: to what extent may one 
simplify operation of a program by limiting inputs by obfuscating ports 
(as defined in finite state machine theory, a subset of the Turing 
Machine) that could accept input of exploits?

Better yet, how about eliminating buffer overflow-generated ports by 
using a programming language that doesn't automagically lend itself to 
buffer overflows? There are, after all, languages other than C and 
Fortran, and memory is no longer ferrite cores strung together with 
copper wires by Taiwanese ladies and leased, not sold, by IBM. So we 
don't really need the extreme and bug-prone measures of yesteryear to 
save on RAM use.

Using more modern languages can also reduce the temptation to reuse 
crufty code:)

Two excellent books relevant to this discussion are "Building Secure 
Software" by Viega and McGraw, and "Computers and Intractability" by 
Garey and Johnson.

-- 
"I see in the near future a crisis approaching that unnerves me and 
causes me to tremble for the safety of my country. As a result of the 
war, corporations have been enthroned and an era of corruption in high 
places will follow, and the money power of the country will endeavor to 
prolong its reign by working on the prejudices of the people until all 
wealth is aggregated in a few hands, and the Republic is destroyed."
-- Abraham Lincoln in a letter to William F. Elkins, Nov 21st, 1864

505-281-9675
http://techbroker.com
http://happyhacker.org

Gravity. It's not just a good idea. It's the law.