| |||||||||||||
LCE: Don't play dice with random numbersLCE: Don't play dice with random numbersPosted Nov 23, 2012 9:38 UTC (Fri) by etienne (subscriber, #25256)In reply to: LCE: Don't play dice with random numbers by dirtyepic Parent article: LCE: Don't play dice with random numbers
It is probably possible to make a security software believe the assembly instruction to get a random value is present in the processor, but in fact it will trap and a trojan will give you a fully predictable value which only looks random.
(Log in to post comments)
LCE: Don't play dice with random numbers Posted Nov 23, 2012 20:03 UTC (Fri) by nix (subscriber, #2304) [Link]
I suspect you'd need root and/or kernel mode or virtualization to set up such a trap, upon which all bets are off anyway (it could just e.g. ptrace() the process and replace the rdrand with a straight mov or call to attacker-controlled code).
|
|||||||||||||