Hello everyone, again, our first talk in our security track is about sandboxing.
We are going now to sandbox our goal modules and that sounds super interesting, so I invited
the security stage who will talk us the all-in-mitty gritty, how we can sandbox our goal libraries.
Thank you, I'm Artichiro Saffron, and today I talk about Komu J, which provides
library sandboxing for goal modules.
We have a bunch of libraries everywhere on the internet, so we can find an enormous number of
big goal modules, and they have very profitable contents, and they have a very profitable number of
interesting tools, but they contain marshes course, so there's a very high chance that you accidentally pull such
marshes goal modules. So goal modules put untrusted goal modules into the jail, and goal
modules can be applied in a very simple two steps. So the first step is to just comment,
directly comment, a slush rush, go into the jail, call on confide, to go to the
goal module, and run the program with Komu J. So let me show my demo. So here is some example
program, so this is expected to print 42 plus 43, it's 85, there is a p.at function, but this
option is from an example stress point in the module, so if you run a program, this actually
executes marshes code, so just go built, so it's poisoned, so in this example 42 plus 43, it doesn't
work with 85, but it opens. So this is an example of an operation code execution, so this
example is, of course, a harvest because it's just a play I commands, but supports that this
option. So this could be, whatever else, such as mining, Bitcoin, or maybe it's
run from here, maybe. So because Poison the goal, that's not just to express why it's content
much as commands with exec.comand, so let's apply Komu J to this, so in dot-to-go, go to
mode, or we have a comment like Komu J confines, and then the program, please.
So it's now 42 plus 43, 85, because Komu J Brooks is a Cisco, that's it's exactly
we, so now the command execution is booked, and so let's go back to the presentation. So
it may talk about the back wound, so the operation source is under a very severe attack, and so
now this is practically impossible to write software without the running or server-party
libraries, so for example, in the case of Toka CRI, there are 100 dependencies, and the demo has
a more than 200 dependencies, and the situation is very similar in the case of tuberculosis
as well, and our batch actors have been trying to inject malicious codes into those dependencies.
And of course, it's not specific to go, so one of our recent notorious example was
the popular incident such happens to XZ and LBZ in 2024, so this was a popular injected
to LBZ in a library by a maintainer project, so in this case, the culprit had been
making harmless contributions for more than two years, so it's a range that just, like,
a good person, but they suddenly injected the back drawer and just created out from the
community, so this example indicates that even widely adopted libraries can be compromised,
and unfortunately, even the project manager cannot be just trusted, so you can just
take a signature of a recent artifact, but when they are mentioned, the same steps are
but actors, we can't just trust the signature, so this case was not about go, but
as Mira attack could happen with go modules, and maybe we already have some malicious
go modules, but we can't know that. And actually, last year, there were hundreds of fake
go modules, were published on GitHub, and those repositories look the genuine, but a content
malicious code, such as WGET Pipe Bash, and for some reports, the numbers of the
GitHub serves even exceeded those of the genuine reports, because the attackers used
both accounts to infiltrate the number of the GitHub serves, so we can't just trust the number of
the GitHub serves, and most of those reports seem now a bunch from GitHub, but some of them are
still alive on GitHub, so here's a search result, so for example, you can find a
more than 60 reports, that matches this search, so I can't show an exact code, but this
repo looks like a genuine one, but they contain malicious codes that substitutes Bash
and WGET, and there's also a campaign of subscriting, so people are now using AI coding
agents, such as codes, to produce the codes, but AI coding agents may hesitate to inject
malicious dependency with multiple participants names, so this is an example person, but
some AI has seen it that they use a library name, a secure host name, a secure host
name, a secure host name, but this library doesn't exist, so I think I could publish
a library with this very plausible participant, and even when it's a safe
agent, it's safe, doesn't have a niche, it can be still deceived by the fake sites on the
internet, or views with such tools of the AI agent, so some sites are just AI subs, they are just
wrong, and some sites are actually published with a malicious intent, so here's some example
of AI subs on the internet, so this says that a cube on this is a 2.0 private rate exist,
and they say that a cube on this 2.0 represents a YAMO with a Python code, but it's just a
fake news, this is a fake news, but it's just very plausible to those who don't know
that a cube on this is actually an open source project, so there's no private beta, and
there's no plan to have a cube on this 2.0, but this is a fake news that is
plausible, and this fake news article contains an installation script of a cube on
this 2.0 private beta, it doesn't exist, but it looked genuine to those who are new to
this, and here's a much worse example, so this is a screenshot of Microsoft
Kupai Road, and a user asked how to download a 7-zip for Windows 11, and the Kupai Road
returned to this answer, so this is a 7-zip publisher, download page, is a 7-zip.com,
but this site is a fake, and contains a malicious code, so 7-zip.com is fake,
the real site is 7-zip.org, but Kupai Road was deceived by some malicious
such results on the internet, so this is not about to go, but the same story could happen
with GoMogers, so some erycoding agents may just download malicious GoMogers from
GitHub and to inject that to your program potentially.
So we have to review all's dependencies, so everybody knows that we have to review all
the dependencies, but it's very questionable, who can actually review all's in, so
we have so many dependencies, so it's not very sticky to review all's the codes.
So, right now, some of the books make this program, it's a jump of a technology to
confine capabilities of a library, so it's similar to the content such as the content
of free BSDJ, but the granularity is different, so the jump of content for processes
while library sandboxing for libraries.
Here, there are several designs of library sandboxing, such as Linux, CECOMP, or WebAssembly,
or it's also possible to have compilation time solution.
And here's an example of similar work in the past.
It's a Google sandbox API.
It works CECOMP and name species, so it's very similar to Jocca containers.
And in this model, a function core and a colleague are extracted in separate processes
that communicate with each other via IPC, but adoption of this model doesn't seem
straightforward, because if you request massively modifying the source course and build scripts
so that the function core and the function core can communicate with each other via IPC.
So, as far as I can see, this is not widely adopted outside Google products.
And next example is our red box, which wraps the library course using WebAssembly,
and it's already adopted in Mozilla FireFox in 2021, and it's used the full sandboxing of libraries
related to graphics, music, and font libraries.
But an adoption of our red box doesn't seem straightforward either.
So, this is that on average, sandboxing a library takes only a few days.
So, it takes multiple days, and that's just a few minutes.
So, it doesn't seem widely adopted outside FireFox.
And next example, it's isolated via, which wraps not only the library course,
using a multiple instances of a BH engine, which is a JavaScript virtual machine,
and it's always adopted by several companies products.
So, adoption is relatively wide in the community of Node.js,
but it's not very easy to get started.
So, because you have to expose several functions for the host of the JavaScript virtual machine,
into the isolated instance of the BH engine.
And in existing or go, there is a depth guard.
It's not a reverse sandbox, but somewhat similar.
It's a linear to enforce a row list or denatist of go modules,
and it's already a wide array adopted to be a Go-AnxCI link.
But this is too strict.
So, there's no way to arrow a module with limited capabilities.
And there's also a very similar project, which is called Go-AnxCI,
but this is not different from my project Go-AnxCI.
So, the similarity of name is just by coincidence.
So, the Go-AnxCI project is to make it easy to get started.
So, no modification to the source code, and later modification to the build script.
And cabbage may apply as a thread of simplicity.
So, under this principle, I designed the Go-AnxCI.
So, it focuses on simplicity and applicable in just two steps.
So, just Go-AnxCI confined comment.
And then run target program is Go-AnxCI run.
So, how it works?
So, it freaks several dangerous system course,
such as five operational systems that open and create.
And for process course, it freaks exactly a or project spawn on the case of macOS.
And it also freaks network system course, such as connect and listen.
And Go-AnxCI unwinds the course that to identify the Go function that involves the Cisco.
So, in the F binary, there is a section called Go-T-C in top.
So, this section contains symbols.
It blends binary is stripped in the case of the goal.
And if the function belongs to module is a confined list, Go-AnxCI blocks the system core.
So, this is how it works.
So, Go-AnxCI observes some exactly a Cisco using something a weird binary.
And Go-AnxCI unwinds the course that to identify the function that course it is minus a Cisco.
And Go-AnxCI observes the module is confined by checking this Go-AnxCI commands.
And Go-AnxCI injects a number of e-prom to block this xb system core.
And current range, Go-AnxCI supports Linux and the Dowing for AMD 64 and ARM 64.
But in the case of a Dowing AMD 64, Jerry's Inter Mac, there is no support for stripped binary.
But for ARM Mac, there is support for stripped binary, that's where.
And she is a deep dive into its implementation.
So, for Linux, the second red dress is used to focus the system course.
And the P2S, P2Dator is used to unwind the course stack.
So, I don't use a second user-notif, which is similar to the second red dress, because in the case of the second user-notif,
it's a frame-point information.
So, I had to use it as a second red dress.
And, I didn't use Randerok.
It's a modern feature of the Linux kernel to controls the capability of file and network system course.
But Randerok is not used here, because there is no way to associate goal modules with specific Linux suites to be controlled via Dandruk.
And, in the case of Mac OS, Go-AnxCI uses the insert library to focus the scores.
So, this is a quiet balance of everyday pre-loads on Linux.
But the story is different in the case of Mac OS.
So, there is no need to support static binary on Mac OS, because in the case of Mac OS, the system course always invoked the system, which is equivalent of TPC.
And, if you call it a general foot-downing.dip, that is the insolent-peer library,
unwinds the core stack using a di-rd-a-kitch image to address thread function.
And, unlike Linux, unwindings core stack is quite complicated, because in the case of Mac OS, the core stack switches when calling the system.
So, it stresses the structure G that represents the current goal routine.
And, it passes the member of the structure G to fetch m.dip core SP and m.dip core PC to align core stack for system course.
And, this is quite complicated. So, how to fix the pointers of the structure G.
So, we have to fix the value of the runtime.dip variable.
And, then, with TSTR register, and we can compute the address of the structure G.
And, for fixing the value of the runtime, the TSTR is very complicated.
So, in the case of the binary, that is not stripped.
We can just fix the symbols of the global variables.
The goal-themed tab section.
But, in the case of the strip binary, we don't have symbols of the global variables.
But, we still have symbols of global functions in goal PC and tab section.
So, we can just find the pointer to the runtime.dip function.
And, just call this function.
So, this is the border function.
So, there is a no return value.
But, when calling runtime.dip, the value of the runtime to TSTR is a Dict.
And, to temporary, register X to 7.
So, we can just fix the pointer to the structure G in this way.
But, this is quite complicated.
And, she is a benchmark reserved.
So, in the case of the benchmark, or what hit was about 4%.
And, also, in the case of macOS, the robot hit was about 9%.
So, there is still room to improve the performance.
And, the robot share comes with lots of caveats.
So, it is not applicable to a goal binary built by known trust versus sad property.
Because, the symbol information might be fake.
And, there is no isolation of file descriptors across modules.
So, a confined module can still read or write an existing file descriptor.
And, also, the third binary mustn't be depressed during the execution of the process.
And, of course, it is not applicable to module, just impose unsafe or reflect a fragment or a goal in clean or see or assembly.
So, there is lots of caveats.
So, share is a command, go to share, analyze.
It is a static, analyze that you detect incompatible imports.
So, for example, go back to all the strategies.
It is not compatible with go to share.
Because, it uses unsafe course.
And, here is adaption status of go to share.
It is currently used by several projects under my augmented steps,
such as Dima, the Exposure Machine project.
And, not a city here.
It provides continuity, city here.
It is a command and interface for continuity.
And, also, my experimental project, which is alcohol-horses home-vure,
which improves the security of the home-vure package manager.
And, I think, who was to see wider adaptions.
And, here is a hint to distribute go-motor share, which is a target program.
And, I have a side-topic strike, but I don't have time to cover this side-topics.
But, one more time, future rock I am planning is to switch away from the runtime model to Compilation time model.
So, runtime side-topics thing is fragile and has lots of limitations.
So, the future plan is to just implement this in the Compilation time mode.
And, maybe, I will use aspects oriented program model for implementing go-motor share in the Compilation time mode.
And, we also have to support other languages.
And, share is also as a approach to prevent supply chain attacks, which is a social reputation checker for go-motors.
So, I don't have time to cover this.
But, this kind of social approach is a complementary to technological approaches, such as go-motor share.
So, this reflects a result of dependencies having already used by trust-worthy projects.
So, this is a recap or my talk.
So, process is under attack.
It is a martial arts algorithm and go-motor share puts onto a set of go-motor intuitive share.
So, if you have any questions and feel free to talk me, it is a whole way.
Thank you.