One way to minimize the attack surface is to use different application binaries to perform the same task. In this video, you’ll learn about software diversity and some of the advantages and disadvantages of this security strategy.
<< Previous Video: Secure Coding Techniques Next: Automation and Scripting >>
Attackers are very good at finding a vulnerability in a particular application and then exploiting that vulnerability wherever they happen to find that application running. This is one of the reasons why we have constant patch updates for operating systems and applications. If an attacker finds a vulnerability in Windows 10, we’ll need to update everyone’s Windows 10 operating system to make sure that that vulnerability is patched.
A unique approach to this type of problem is to create software that’s different on everybody’s workstation. This would mean that everyone would still be running Windows 10. But everyone’s Windows 10 binaries would be slightly different from one machine to another.
We refer to this as software diversity. We use different tricks in the compiler to change where the paths go during the compilation process. This means that the final binary file will be different every time you compile the application. This won’t change the functionality of the application or the way that it works. It only changes the final binary file itself.
This means if an attacker finds a vulnerability inside of this file in a person’s machine, and they create an exploit for that vulnerability, they may find that they’re not able to use that exploit on a different person’s machine because it’s running a different version of that file. This obviously creates some additional work to create the different binaries for this application. It also creates additional work to deploy these different binaries to these different devices.
But if you’re able to have this diversity in applications between all of these different machines, you could minimize the attack surface if anyone does find an exploit with this particular application. But this would limit the potential for an attack because any type of vulnerability, and ultimately, any exploit would be limited to only a certain type of binary file.