I noticed my raspberry pi's sshd does not seem to have PIE and ASLR enabled. I determined that using the answer here: https://unix.stackexchange.com/a/435038

I'm using Raspbian, is there another OS I can use that enables PIE and ASLR by default?

Is there a way i can rebuild sshd on Raspbian, using apt so that my packages remain sane? I really like the simplicity of Raspbian.

EDIT: according to goldilocks' comment below, ASLR is enabled already in Raspbian by default. I didn't check in gdb though.

  • ASLR is already enabled on stock Raspbian: theurbanpenguin.com/aslr-address-space-layout-randomization PIE is just a stronger version of it (the U&L question you linked does state that). – goldilocks Oct 21 '19 at 13:58
  • @goldilocks well sshd is a piece of software that runs over network, so it could be remotely exploited if it were vulnerable. However, I wonder if having these security features would even matter for a program that runs in a daemon anyways... wouldn't it have the same address each time you make a request since the daemon doesnt restart? if it were to restart or fork, then ASLR and PIE would be useful. – Eric Oct 21 '19 at 14:33
  • Yeah, I'll take that back about sshd; some distros do compile it that way (eg., it is on this fedora laptop). I was thinking mostly of virus-y things in the system. I think exploits over a network mostly rely on knowledge of a bug style vulnerability, which doesn't require knowledge of the memory layout, only how to trigger and exploit the bug, which ASLR won't do anything to prevent. – goldilocks Oct 21 '19 at 15:24
  • WRT "wouldn't it have the same address each time" -> Yes, but that's not the vulnerability. It's about knowing in advance exactly where bits of code are going to be in memory. The fact that a running process remains internally consistent isn't going to help if the layout was ASLR'd because it's not a matter of going through a haystack until you find the needle. That would never work. You need to know where to look, which ASLR seriously complicates at the very least. – goldilocks Oct 21 '19 at 15:24
  • Well, maybe I should retract that a bit too -- I'm no binary analysis expert, but you can do things with a running binary to try and pinpoint code locations by doing normal things that you know will store something in memory (eg., your IP or some other bit of user data) next to something else, and locate that something else by searching memory for the known thing (the IP or whatever). That's going to be pretty hard over a network though, because searching the memory of a remote process presents some obstacles. – goldilocks Oct 21 '19 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.