OpenBSD, security, software development
The Microsoft Patch Tuesday update on August 10, 2021 “addressed” SeriousSAM a.k.a. HiveNightmare ( CVE-2021-36934 ). So it’s all fixed right? Not quite! It turns out that the update is only a partial fix, as acknowledged by Microsoft’s advisory . Because of this, it is still possible to exploit the SeriousSAM vulnerability on patched systems under certain conditions. In this blog post, I will…
On April 27, 2019, I gave a talk on how to use OpenBSD to write better software at CarolinaCon 15 in Charlotte. Abstract OpenBSD is renowned for its security innovations and code quality. With its emphasis on code correctness, exploit mitigation techniques, and a rigorous development process, OpenBSD provides a rich platform and environment for developers to create robust software. This talk…
Exactly four years ago, I blogged about testing Snort rules on OpenBSD . That post described a quick way to test if Snort has correctly loaded your rules and whether it will emit an alert when it reads a matching packet. But things have changed since then; for starters, the Snort rules I suggested in that post have been disabled in the official Snort ruleset for a long time now, so the…
For more than four years I have been using and tinkering with OpenBSD’s divert(4) . At one point after OpenBSD 4.9 was released, I ran into an annoying bug in divert(4) that totally prevented me from using it. At the time I had no idea how to fix it, so I did the next best thing by filing a detailed bug report . Eventually I realized that the bug isn’t going to fix itself, so I decided it was time…
The upcoming OpenBSD 5.6 release introduces a new libc function called reallocarray(3) that extends realloc(3) with built-in integer overflow detection. In this post, I’ll discuss why it’s useful and how it can be used to fix unsafe code. If you’re not familiar with integer overflows or need a refresher, Ray Lai’s Undeadly article on integer overflows is a good place to start, especially if you…
In exactly one month from now, OpenBSD 5.6 will be released on November 1, 2014 – like clockwork as always. But, you don’t have to wait until November 1 if you want it earlier, because pre-orders are now up at the brand new OpenBSD store ! OpenBSD 5.6 is of course the first OpenBSD release with LibreSSL , the now-famous fork of the OpenSSL library. But while LibreSSL is an important milestone for…
A few months ago, I wrote a diff to simplify the calculation of ICMP extension header checksums in the OpenBSD kernel. It so happened that the code is only used by the OpenBSD MPLS subsystem. I didn’t have access to an OpenBSD-based MPLS network at the time, nor was I familiar with MPLS in general; so in the spirit of the OpenBSD hacker mantra “shut up and hack,” I set out to build a small MPLS…
Last week, in classic Lawrence fashion, I somehow hosed my OpenBSD ports tree while doing some crazy experiments. It got to the point where make package would fail on certain ports like archivers/xz; if I tried it on those ports, I would get this funky error: Error: /usr/ports/pobj/xz-5.0.4/fake-amd64/usr/local/share/locale/cs/LC_MESSAGES/xz.mo does not exist Since MO files are related to GNU…
UPDATE : An updated version of this blog post is now available ! Have you ever wondered if your Snort rules are actually working after you have set up Snort ? You may have seen this line in your log file… Oct 24 22:24:20 foo snort[4520]: 1745 Snort rules read …but you may still be wondering if Snort can actually trigger alerts. You could always let Snort run on a live network and hope that…