DaemonForums  

Go Back   DaemonForums > OpenBSD > OpenBSD Security

OpenBSD Security Functionally paranoid!

Reply
 
Thread Tools Display Modes
  #1   (View Single Post)  
Old 11th May 2019
bsdcord bsdcord is offline
Port Guard
 
Join Date: Apr 2019
Posts: 23
Default What's missing in openbsd

Hi,
I think that openbsd is good in perimeter defense but not much in the inner defense.
For example there are few or none papers on forensics. There are few way to check the integrity of your system. I think this is a very important step in security because if you have been hacked your don't know. If you know, you haven't been hacked (defaces are not hacking...they are just pranks) .
Thus every user should periodically make a deep check of their system. In openbsd there a script called "security" that makes some check but, imho, it's rather ridiculous. Could be good in the 80' but not today.
One other thing is missing in openbsd is a memory forensics framework like "rekall" or "volatility". Today a memory forensics software is a necessity because some malware are much easier to detect them on memory rather than on the disk (maybe they are encrypted on the disk or very hidden). But of course they must be resident in memory to run.
Tools like aide, could be useful but not with kernel rootkit. If anyone is enough skilled to hack your openbsd box, it's rather sure he will not install a userland malware.
Reply With Quote
  #2   (View Single Post)  
Old 11th May 2019
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 6,799
Default

Along with your limited awareness of shipped OS and kernel integrity controls, you may not be aware of Kernel Address Randomized Link ("KARL") introduced in 2017. Once OpenBSD is installed, each booted kernel is unique, with unique offsets between program and data. During boot, a new kernel is created for use with the next boot. The local integrity chain is maintained through sha256(1) hashes.

Last edited by jggimi; 11th May 2019 at 11:41 AM. Reason: typo, clarity
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
gcc-4.9.3p0 missing some headers? notooth OpenBSD Packages and Ports 4 21st November 2015 04:20 PM
missing tightvnc in OpenBSD 5.0 mayuka OpenBSD Packages and Ports 15 7th November 2011 06:52 PM
sys.tar.gz missing from 3rd CD in 4.5? thirdm OpenBSD Installation and Upgrading 0 5th May 2009 03:25 PM


All times are GMT. The time now is 02:12 PM.


Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2019, Jelsoft Enterprises Ltd.
Content copyright © 2007-2010, the authors
Daemon image copyright ©1988, Marshall Kirk McKusick