[PATCH] Insert random noops to increase security against ROP attacks (llvm)

[PaX Team]

On 5 Jan 2015 at 19:54, Chandler Carruth wrote:

> On Mon, Jan 5, 2015 at 7:45 PM, PaX Team <pageexec at gmail.com> wrote:
> 
> > that's why it's worth reading the paper as they provide numbers ;). the
> > attacker's
> > cost is quite economical, say a few thoudand tries (obviously this
> > requires a
> > respawning service, e.g., this won't work against a browser, but there're
> > other
> > ways for that case). now if everyone had brute force prevention like
> > grsecurity
> > we'd be talking about a different cost model...
> 
> 
> Is it not reasonable to provide this kind of tool for the folks who do have
> such prevention mechanisms?

surely anything that makes an attack more noisy (=triggers actionable events)
is a good thing but the question is at what cost it comes. if one wants to go
down the diversified binary route then there're better ways, say randomizing
the register allocator, structure and stack layouts, etc. stuffing useless
insns into the cpu pipeline isn't the best way IMHO, especially if there're
already realistic exploit techniques that are immune to it...