[Dwarf-Discuss] security implications of DWARF info

[James Oakley]

You and I disagree about security through obscurity, but this list is not 
the place for that discussion.

 > However, I'm not familiar with libraries for
 > writing/generating/modifying DWARF files.  I checked the FAQ today;
 > the entries are empty.

libdwarf (http://reality.sgiweb.org/davea/dwarf.html) is a library for 
reading and modifying DWARF information. There's outdated documentation for 
the consumer part of the library at 
ftp://ftp.software.ibm.com/software/os390/czos/dwarf/libdwarf2.1.pdf. 
There's a pdf with some documentation about the producer part of the library 
somewhere as well, but I can't find the link at the moment. There may be 
better/more current documentation.


On 11/24/2010 12:38 AM, travis+ml-dwarf at subspacefield.org wrote:
> On Tue, Nov 23, 2010 at 08:43:44PM -0500, James Oakley wrote:
>> How would it pose a security risk? Or do you mean would it aid reverse
>> engineers, thereby posing a risk to your intellectual property?
>
> It's a bit more subtle than that.
>
> I'm assuming that there's more information that function addresses.
>
> Type information, for example, or mappings to source code lines.
>
> Such information could aid reverse engineers.  Arguably, this is not
> _real_ security, in that proper guesses or effort could reveal this,
> but I'm not in favor of lowering the bar, personally.
>
> I'm personally not so much interested in IP as in the security of
> customers who run this software.  Already there have been a number of
> very sophisticated attacks.
>
>> I don't think this is the correct list for this question, but why don't
>> you just hash all of your symbol names and replace the names in the
>> strtab (or equivalent, I'm not familiar with dSYM or with development on
>> Darwin/OS X in general) with their hashes.
>
> Well, we had an engineer use a hex editor and attempt to replace the
> ASCII names of functions with enumerated names, padded to the original
> length, but this naive approach only caught about 10% of the function
> names, according to him.  Also, the modified file was flagged as
> corrupt by whatever app was trying to use it.
>
> Also, I'm concerned there would be a lot more information available.
> In general, security issues dictate that you only give out what is
> necessary to accomplish your goals - the blacklisting approach tends
> to be less safe in the long run than whitelisting.  We know what is
> necessary to allow third parties to match stack traces across
> versioned releases; anything else is unnecessary risk.
>
> However, I'm not familiar with libraries for
> writing/generating/modifying DWARF files.  I checked the FAQ today;
> the entries are empty.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3262 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.dwarfstd.org/private.cgi/dwarf-discuss-dwarfstd.org/attachments/20101124/50b03adc/attachment.bin>