Re: Secure Ruby - second challenge !

On 2003.12.17 22:52, Brett S Hallett wrote:
> Further to the excellent 'attacks' on my 'rubyrun' tool, I have  
> revised some of the internal methods used to
> protect itself.

> So please visit http://users.impulse.net.au/dragoncity
> and download the latest attempt at makeing ruby program secure

Rather than simply replacing the executable - which you could reduce  
the chances of by performing some sort of check on the ruby executable  
file: either running a test script and checking that it performs as  
expected or doing checks on the binary itself, such as looking at the  
symbol table, it's a lot harder to regulate what else is going on.

The method I used was (dare I say it) almost rubyish - I redefined how  
write worked (using LD_PRELOAD) and copied everything written to a file  
descriptor to a file identified by the process id and numerical value  
of the file descriptor in /tmp.

But the method can't be secure while there's the slightest chink of  
light in between the ruby interpreter and the decrypter.

Even then, you can't rule out people reverse engineering the decrypter,  
and extracting the decryption routine, recompiling it and running that.

And I haven't even got as far as mentioning gdb.

But before anyone got that far, they'd probably find it easier to  
modify ruby (source available!) to copy the contents of any script  
loaded by the interpreter to a specified directory...