News for hackers. Stuff that matters.

A comment on Microsoft is creating a new Rust-based programming language for secure coding. Parent comment

Re:Microsoft is creating a new Rust-based programming langua... by pjmlp on Monday December 02, 2019 @01:16PM (#21685077)
The video explains more:

- Need to keep old insecure code around, too much money to rewrite the world from scratch in Rust, C#, or whatever safe language makes your day

- They are just starting the project, so far only interpreter and runtime model

- It is based on CHERI CPU research (https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/), which has memory tagging

- They are planning to open source the existing work in a couple of months

- Looking for collaboration

[ Parent | on HN ]
Re:Microsoft is creating a new Rust-based programming langua... by xvilka on Monday December 02, 2019 @09:06PM (#21689292)
Rewriting can be greatly automated. C2Rust[1] proves that. Just can be improved with new languages and refactoring capabilities.

[1] https://github.com/immunant/c2rust

[ Parent | on HN ]
Re:Microsoft is creating a new Rust-based programming langua... by zozbot234 on Monday December 02, 2019 @01:18PM (#21685099)
> Need to keep old insecure code around

That's what process boundaries are for. (As a bonus, you get protection from any Spectre-like issues arising in the old code.)

[ Parent | on HN ]
Re:Microsoft is creating a new Rust-based programming langua... by saagarjha on Monday December 02, 2019 @01:25PM (#21685169)
Not everything can be neatly refactored out of a process.
[ Parent | on HN ]
Re:Microsoft is creating a new Rust-based programming langua... by pjmlp on Monday December 02, 2019 @01:27PM (#21685189)
Process boundaries don't protect against internal exploits, which is what most of the C and C++ exploits are all about.

If you are able to force a process to change its behaviour, the process boundaries become useless.

[ Parent | on HN ]
Re:Microsoft is creating a new Rust-based programming langua... by saagarjha on Monday December 02, 2019 @04:13PM (#21687015)
Process boundaries specifically protect against these exploits.
[ Parent | on HN ]
Re:Microsoft is creating a new Rust-based programming langua... by pjmlp on Monday December 02, 2019 @05:07PM (#21687566)
So how does a process boundary protect against Heartbleed?
[ Parent | on HN ]
Re:Microsoft is creating a new Rust-based programming langua... by saagarjha on Monday December 02, 2019 @05:17PM (#21687662)
Process boundaries help you when you start jumping through a ROP chain that spawns a shell because your process doesn't have access to things that it shouldn't, even when compromised. Calling Heartbleed an example of a process "changing its behavior" doesn't really make sense in the context of exploits that can cause arbitrary code execution.
[ Parent | on HN ]
Re:Microsoft is creating a new Rust-based programming langua... by dx87 on Monday December 02, 2019 @06:30PM (#21688275)
You don't have to spawn a shell as a seperate process. Injecting and executing code inside a vulnerable process has been done for a long time.
[ Parent | on HN ]
Re:Microsoft is creating a new Rust-based programming langua... by saagarjha on Monday December 02, 2019 @06:36PM (#21688312)
A shell spawned in an unprivileged process is not very useful.
[ Parent | on HN ]
Re:Microsoft is creating a new Rust-based programming langua... by pjmlp on Tuesday December 03, 2019 @12:49AM (#21690266)
One doesn't need to spawn a shell.
[ Parent | on HN ]
Re:Microsoft is creating a new Rust-based programming langua... by iCodeSometime on Wednesday December 04, 2019 @12:25PM (#21704339)
Injecting and executing code inside an unprivileged process is not very useful.
[ Parent | on HN ]
Re:Microsoft is creating a new Rust-based programming langua... by pjmlp on Thursday December 05, 2019 @08:35AM (#21712112)
Some black hats would consider stealing data, data corruption or triggering DOS already very useful for ransonware.
[ Parent | on HN ]
Re:Microsoft is creating a new Rust-based programming langua... by pjmlp on Monday December 02, 2019 @06:09PM (#21688081)
So each one gives an example that suits their own sales pitch.
[ Parent | on HN ]