And it's always going to be an arms race, according to the mathematics and computation foundations that were layed in the 20th century.
It started with David Hilbert who seeked a proof and was obsessed with mathematics to be complete, consistent and decidable. This sparked the work of
Gӧdel and Turing. First Kurt Gӧdel proved that it's both incomplete and inconsistent and then Alan Turing came along and proved that mathematics and computation is undecidable.
So Morpheus may be vulnerability-tolerant, but it might be impossible to have a vulnerability-proof architecture? At least using current mathematics and Turing machines, maybe Quantum computers will come to the rescue. I guess time will tell.
Morpheus: A Vulnerability-Tolerant Secure Architecture Based on Ensembles of Moving Target Defenses with Churn
https://dl.acm.org/doi/10.1145/3297858.3304037
"Abstract
Attacks often succeed by abusing the gap between program and machine-level semantics– for example, by locating a sensitive pointer, exploiting a bug to overwrite this sensitive data, and hijacking the victim program’s execution. In this work, we take secure system design on the offensive by continuously obfuscating information that attackers need but normal programs do not use, such as representation of code and pointers or the exact location of code and data.Our secure hardware architecture, Morpheus, combines two powerful protections: ensembles of moving target defenses and churn. Ensembles of moving target defenses randomize key program values (e.g., relocating pointers and encrypting code and pointers) which forces attackers to extensively probe the system prior to an attack. To ensure attack probes fail, the architecture incorporates churn to transparently re-randomize program values underneath the running system.With frequent churn, systems quickly become impractically difficult to penetrate.We demonstrate Morpheus through a RISC-V-based prototype designed to stop control-flow attacks. Each moving target defense in Morpheus uses hardware support to individually offer more randomness at a lower cost than previous techniques. When ensembled with churn, Morpheus defenses offer strong protection against control-flow attacks,with our security testing and performance studies revealing: i) high-coverage protection for a broad array of control-flow attacks, including protections for advanced attacks and an attack disclosed after the design of Morpheus, and ii) negligible performance impacts (1%) with churn periods up to50 ms, which our study estimates to be at least 5000x faster than the time necessary to possibly penetrate Morpheus."
Two of the more interesting citations are:
Undefined behavior: what happened to my code?
https://dl.acm.org/doi/10.1145/2349896.2349905
Towards optimization-safe systems: analyzing the impact of undefined behavior
https://dl.acm.org/doi/10.1145/2517349.2522728
--
↙↙↙ uǝlƃ
- .... . -..-. . -. -.. -..-. .. ... -..-. .... . .-. .
FRIAM Applied Complexity Group listserv
Zoom Fridays 9:30a-12p Mtn GMT-6 bit.ly/virtualfriam
un/subscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/
archives: http://friam.471366.n2.nabble.com/
- .... . -..-. . -. -.. -..-. .. ... -..-. .... . .-. .
FRIAM Applied Complexity Group listserv
Zoom Fridays 9:30a-12p Mtn GMT-6 bit.ly/virtualfriam
un/subscribe
http://redfish.com/mailman/listinfo/friam_redfish.comFRIAM-COMIC
http://friam-comic.blogspot.com/archives:
http://friam.471366.n2.nabble.com/
Locked
