• A security concious OS
• A few definitions
• Fixing the Kernel
• Questions

History

• 1995: OpenBSD born: fork from NetBSD

• 2000: I started using OpenBSD :~)

• 2003: OpenBSD implements W^X
• 2003: OpenBSD implements ASLR

• 2013: OpenBSD Position-independent executables (PIE)

• 2015: OpenBSD W^X to AMD64 SPARC64 kernels

• 2017: Kernel Address Randomized Link: KARL

• 2018: Retguard - removing useful ROP gadgets

Return Oriented Programming (ROP)

Compiler Changes

• LLVM compiler tool chain
• Changes to Clang:
  • Register allocation changed (AMD64)
  • Identify possible gadgets and replace with safe alternatives

Benefits

• Remove ROP gadgets
  • AMD64 reduced ~50%
  • ARM64 reduced to zero
    • Retguard verifies integrity of return address

Questions?

Resources

http://www.openbsd.org/

http://www.openbsd.org/papers/eurobsdcon2018-rop.pdf

Wikipedia: ROP

Treasurer Report BCS AGM

Treasurer Report 2018

About Me

LinkedIn

Follow me on twitter: https://twitter.com/fcbsd/