[Info-vax] VMS Software Partners with Stark Gaming to Create Revolutionary Online Gaming and eSport Server Infrastructure

[John Reagan]

On Friday, August 7, 2015 at 12:01:04 PM UTC-4, Craig A. Berry wrote:
> On 8/6/15 12:59 PM, RobertsonEricW wrote:
> 
> > As was briefly alluded to upthread, OpenVMS on X64 is going to
> > significantly increase the use of the existing body of Run-Time Library
> > analysis (for statically revealing possible points of attack) and
> > malware generation toolkits that are already in use for other platforms
> > running on Intel X64. Currently (and historically) most such tools do
> > not target OpenVMS Platforms. So, comparatively speaking, OpenVMS has
> > not had the same level of scrutiny and exposure that such tools have
> > allowed for other OS's. What strategic approach is VSI planning to take
> > in order to mitigate the risk posed by the extra level of scrutiny and
> > exposure of running OpenVMS on the ubiquitous x64 platform which the
> > equally ubiquitous availability of these toolkits enables?
> 
> I'm not sure I completely get the question, Eric. If the port to x86_64
> means there are more tools available to black hats, won't those same
> tools be available to white hats? 

Note that most hacks aren't really directed at the hardware (rowhammer is kinda hardware-directed, but it might exist on non-x86 platforms too), but rather at system APIs with things like buffer overruns, poor key management, tricking Flash or the PDF viewer into allowing random code execution, etc.  It is true that once you find a place for code execution, that the payload is x86 instructions (I assume the payloads know to flush the icache, etc.).  Then that hidden code tries to do something on your system (muck with the registry, muck with the password file, etc.).  So on an OpenVMS x86 system, the challenge will be to find a hole to inject code.  Finding the hole isn't really hardware dependent.

For example, with the port of LLVM,
> maybe AddressSanitizer will become available:
> 
> <http://clang.llvm.org/docs/AddressSanitizer.html>
> 

Such things are on my list.  However, note that the AddressSanitizer has some extreme memory requirements.  From the webpage:

"On 64-bit platforms AddressSanitizer maps (but not reserves) 16+ Terabytes of virtual address space."