Millions of Binaries Later: A Look into Linux Hardening in the Wild

I'm actually surprised that Mac, Windows, and Linux are not way more locked down by default by now.

We see the problem on Android and iOS often have binaries doing bad things (spying if not worse). Often it's not the app developer themselves it's some library they included.

Then we have stay Steam users (maybe that's mostly Windows) but basically every game they download could be installing anything, reading anything. Root kit, key logger, network monitor, sending your private keys somewhere, reading your email database, downloading your documents. There is absolutely nothing stopping that at the moment except trust. A few games have already been caught spying by using 3rd party libraries.

Mac has appeared (not a security expert) to have gotten slightly better as of Mojave. Several folders in ~/Library are not readable by default and permission is given per App. (type ls ~/Library/Mail).

But basically I think I'd like things to be way more locked down by default (with of course ways to open it up per app). I'd like to be able to run an app (not just an App store app but any app) and be relatively sure it can't do anything bad. That includes command line apps. I wish every app was run in a sandbox. I'd like to able to run any app or script and know it's not uploading ~/.ssh/id_rsa for example.

Odd that Fedora isn't even mentioned at all-- at least in the past it has been one of the first to adopt mitigation techniques distribution wide.

I'll take advantage of this thread to ask a related question : do you consider address sanitizers (ASAN) should be applied to harden binaries (on release builds) ? It indeed has a cost but can detect and crash on use after free or out of bounds access. Would you think the price can be worth it in certain cases ?

This is an excellent article with a lot of original research instead of the typical security guides that I see that are pretty much copy paste jobs (look up anything about Apache HTTPD for a very good example of that).

A couple of things about Linux security that really hinder ppl / I don’t think are promoted enough:

- People forget to secure VIM. Even if you’ve secured everything, very easy to use the built in mini-shell in VIM to move to the actual shell.

- Look at / focus on your SSH key fingerprints. These things matter. I didn’t pay attention to these things nearly as much as I should have the first two years of my career, but it’s so easy to just intercept your request, grab your private key, and then just pass you on to your regular server without you even knowing.

- Please please secure your web servers. The default configuration can be very difficult to argue is secure, e.g. the fact that every web server reveals out of the box the exact semver of the Apache/Nginx or the lack of automatic HTTPS redirection that would be useful for 90% of modern deployments. Check out Caddy which helps with some of this.