Windows 0day privilege escalation still not fixed
bugs.chromium.org
bugs.chromium.org
Add to that their recklessly incompetent initial fix:
It is complexity that is accepted in small amounts across dozens of projects over many years. Projects that add real value to the business while contributing to this invisible debt that from the business point of view, matters only once it has started directly affecting your revenue.
Eventually an organization can't scale without a major refactoring, rewrite, or an entirely new market vertical.
Incompetence is to spend too much time making software into a golden, egg laying donkey. As is building software that becomes impossible to change after a couple of years. Finding the fine line in between these extremes is what professional software engineering is all about.
IMO there is no good fix for that past certain company size.
Most of these problems are likely contributed to legacy code and backwards compatibility.
It takes me a couple of lines of code now to spin up a web server than can handle thousands of connections. Or an app with beautiful fluid UI.
But I remember that I am standing on the shoulders of giants. What seems like zero complexity to someone on the shoulder is actually not.
Sometimes the giants fuck up too. Ultimately it is incompetence. But not the kind that is attributable to laziness or stupidity. Engineers at Microsoft, I would assume are like engineers everywhere - no smarter, no dumber.
Just because I can build a Lego bridge perfectly, doesn’t make the guys who’ve built an imperfect actual bridge are incompetent. They’re just solving very different problems.
Or perhaps that due to survivorship bias, the evidence for incompetence that we see sticking around longest is also the most pathological.
They are slow and incompetent.
https://www.wsj.com/articles/microsoft-diminishes-windows-ro...
> The company is breaking Windows in pieces. The platform technology, on which Microsoft’s partners build their own devices, apps and services, will now fall under Scott Guthrie, who runs the Azure business. Mr. Guthrie’s unit, called Cloud + AI Platform, will also include the company’s mixed-reality business, including Microsoft’s Hololens device, as well as its artificial-intelligence business.
Maybe someone with insider knowledge will comment, but it looks like Windows is far from being a priority for Microsoft.
But it really shows you how powerful their enterprise sales machine is and the legacy reach of existing programming languages/frameworks.
It’s always easy to underestimate Microsoft I guess. Ditto with Oracle and the like. From our view down in the startup world.
That said. Alt-tab not working is an embarrassment though. And I hope they really haven’t let their OS QA slip this badly in favour of some growth area or whatever.
In my experience the tribal evangelism for AWS is... intense... and they've somehow convinced people to proselytize unpaid on their behalf. Having worked with both I'll occasionally mention Azure if only to revel at the spicy takes. Honestly though, I worked at that claims company I mentioned. Likewise the startup I work at today threw their hats in with AWS. Both were respectively good decisions, both bad in their own right. As ever, try to do everything and something is going to give.
Microsoft earned thst reputation with a lot of development and organizational practices that they've since abandoned. It may take people a while to notice, but today's Microsoft is not prioritizing stable software interfaces and backwards compatability.
It took a lot of testing to ensure existing software and hardware continued to work with new operating systems, and they're not doing as much testing anymore.
I have it on the top of my mind because it bit me twice in recent month. I had to do some PS work on some VMs that didn't have Internet access (beyond RDP). Sure, I can Alt+Tab to a browser on my machine, but at this point, why even have Get-Help? Contrast that with Emacs experience, where everything is documented, and documentation is easily accessible, off-line, and by default.
Well there are a lot of old school Microsoft haters. I used to know a bunch of Unix guys ~ten years ago whose unstated principle was that anything Microsoft did was unilaterally a bad idea (and everything Unix ever did was always the best possible way).
For that reason, I'm not surprised. I've seen the decision come down to not wanting to give money to the other two many times. MS is in a great position there.
Might be fair because aws includes their services as well, but I'm pretty sure aws main income is from ec2, while azure is business tooling like active directory, office etc
Despite just kicking the tyres on the thing, I found about half a dozen bugs or missing critical features. That's just shocking to me.
For comparison, CloudFront -- the most direct competitor -- is far ahead in features and is used by far more customers. It also works out of the box.
All of the other Azure services other than plain virtual machines give me the same impression of being a first adopter and one of only a handful of customers.
I’ve brought Front Door into their architecture for the services I was working on, but even if they decide it’s a great thing for the entire company to use, it will take them over a year to get security to approve it, and then multiple years to get it rolled out to all of their products.
With Azure’s core customer base being major enterprises, it’s not surprising that you had a hard time finding evidence.
Linux distros seem to manage pretty well...?
Or is this "it's only bad if Microsoft do it"?
Or if you're trying to limit this to individual use, I'll grant you equivalence once Microsoft stops charging their beta testers and offers them the source.
Even I do it and I work for a company orders of magnitude smaller
And that's only the kernel. Distributions and their package maintainers have their own quality controls, as do cross-distribution upstream developers. Public bug trackers (beta testers) are a complement to these. The division of labour in quality control of Linux systems is fine, diverse, and of variable effectiveness before beta testers come into the picture.
When you say "temporary" remedy, is that implying there will be a real fix that obsoletes this, or this workaround will stop working at some point?
FF uses CTRL+Tab to cycle through tabs like alt tab.
Example 1 for the GUI: it drives me crazy that I can't resize the dialogs to edit the properties of a scheduled task. They were probably designed for 800x600 screens and they were a bad design back then (a text area please and join the lines.)
Example 2 for the core: a process keeps track of its parent but if the patent exits the process doesn't update the reference so you can end up with a reused process id in the child process data table. I run into that a couple of weeks ago.
Regarding the more technical side, while I'm entirely unqualified to comment on kernels and low-level APIs, I actually like some NT/Windows design choices quite a lot more than Linux. Network transparency (\\shares) is a big one and in general the way external filesystems are handled (mounting makes no sense for desktop use - especially the way udisks or whatever does it). And while the way programs are stored and installed on Linux is a neat idea in theory, it all breaks the moment one app doesn't follow the standard and it imposes far too many restrictions that Windows doesn't suffer from.
Edit: sorry for the rant, I'm stupidly tired and have had a few drinks. Happy holidays!
I've spent quite a lot of time poking around in the print spooler and my gut feeling is it's probably riddled with issues like this.
It's not going to increase in relevance or take over the world, but it is probably satisfying.
As opposed to Apple, who just assumes you don't use printers older than 2 years and liberally breaks old printers and scanners.
Now that most computers can hold a page in their L2 caches, it's easy and much faster to render in-memory and send a bitmap over to the printer driver to let it print with whatever options it wants. All the driver needs is to accept a bitmap and print it as well as it can and you can safely ignore most of the printer's own PDL.
Most of the thorny issues in printing are with special-purpose printers - thermal, barcode, embedded text only, etc.
Apple uses CUPS and it should work fine with older printers. Last time I checked, CUPS could handle an HP Deskjet 500 (if you have the parallel port)
He found the printer that was emitting the graphs was actually more powerful than the (very expensive) machines running the simulations, to the point that converting the simulation to postscript (or some variant thereof) and running it directly on the printer was some orders of magnitude faster.
And stump upon sb else code that you have no permission to modify
When IBM chose the I/O ports for the PC, they used a parallel port compatible with early office printers from Centronics, but used a female DB-25 connector (previously seen mainly on external serial RS-232 modems) on the PC. The printer end of the cable had the Centronics type connector.
By that time Centronics and other pre-DOS printers were already issued with standard or optional serial RS-232 input, or parallel.
Serial printers most often still used a DB-25 like modems, and parallel the Centronics connector. The only bidirectional communication was logical handshaking which had dedicated conductors in the cable, serial only needed one conductor plus ground for the data and 2 or 3 more conductors if you were even using handshaking. Parallel uses 8 data conductors and about half a dozen logic lines.
The early IBM PC offered an optional serial RS-232 I/O card having a male DB-25 (9 pins is actually more than enough for serial but the DB-9 connectors didn't show up much until you got 2 COM ports on a single card) then once people started using a mouse they were serial DB-9 and built into the mainboard. This was the bidirectional port to communicate with modems and send to printers. Or anything else, the RS-232C standard specifies you must be able to short any of the conductors or connect them to anything within +/- 25VDC without damage, whether the hardware is powered on or not. Not everything meets the full standard.
OTOH, parallel connects directly to the bus and can be very sensitive to incorrect connections or plugging cables while powered. Often damaging motherboard chips for a while there if a stray DB-25 serial modem cable were plugged into the parallel port of a PC. Which might contain jumpers between pins in either or both RS-232 connector hoods to effect self-handshake.
The printer was conceptualized to be the one _peripheral_ that every office was going to surely have or the PC could not function like a typewriter, so the printer has actually always been part of the PC which you connect first before powering them up as one.
Anyway, DOS would only do one thing at a time, so for paperwork you would have to wait for the printer to finish before you could move on. Some printers were slower than others. Fast was not in the vocabulary for early-adopting offices.
Within a couple years at Radio Shack you could get a print spooler to come between the CPU and the printer. An external hardware print spooler of course.
What a time-saver! When you hit PRINT your data went into the spooler much faster than the printer could accept it, within a few seconds you had your command prompt back and the printer could finish the task on its own, however long it took.
Eventually significant buffers came inside the printers themselves, plus Windows became accepted in mainstream offices and it had a software spooler.
With printing handled within Windows at the actual DOS layer for the first decade while Windows was only a shell around whichever DOS you installed it over.
I don't think parallel ports connected directly to the bus, there was always an interface chip like the Intel 8255.
The scenario I'm theorizing, is that there's probably at least one major vendor who's drivers are dependent on this behavior, and Microsoft is trying to avoid the flack that could result from an update 'breaking usability'. Working around that behavior could be complicated. I feel like if this is the case, I know the vendor.
Probably XKeyscore or Solarwinds Orion or something... Can't break that shit, it gets important work done!
This exploit is a kind of sandbox escape. It allow a low integrity process to run code as a medium (aka normal) integrity process. The exploit runs `splwow64.exe` which explorer "helpfully" auto elevates to medium integrity. The exploit then tricks `splwow64.exe` into running arbitrary code.
It does not grant admin privileges.
In practice this vulnerability isn't that scary on its own. Sandboxes don't (or shouldn't) rely solely on this form of mandatory access control for their security. However this attack could be used as part of a chain of exploits in ored to escape a sandbox.
https://securelist.com/operation-powerfall-cve-2020-0986-and...
This wasn't discovered by a security researcher looking for holes. This was discovered by a virus scanning company that realized people were actively being attacked using this method.
Everyone else has known about it for exactly 2 hours.
0day means no patch is available, whether the vulnerability is known privately/publicly or not
I’m a fan of letting context infer meaning. And letting certain words just naturally grow to whatever the culture wants it to. It’s always hard to fight back against it.
There’s a million examples of this on the internet where people try to be pedantic about slang or word usage. All that matters is “we know what you mean”. I like to assume enough people here know the real difference zero days vs existing vulnerabilities are. But in practice it matters less.
I still think that your usage of "0-day" breaks down precisely in the case we're in currently, where the vulnerability has been exploited in the wild and Microsoft has known about it for some time, but there is not a patch available, and the general public (everyone who has to defend against the exploit) found out about it today.
The most valuable time of an exploit is not the time of discovery, but the time of resolution.
Sorry my reply came so late.
like "We need to control the optics of the situation"
"I flashed my cellphone but it failed and now it's bricked."
but the unsophisticated public gets it wrong and now here we are, every recent unpatched exploit is now 0day
It doesn't sound wrong to me, both "flash" and "brick" are correct in an appropriate context. It's not "updating the system" but "flashing" if the process uses some low-level recovery mode, and it would be "bricked" if can no longer be recovered by usual means.
I guess the definition varies, it was what I meant by "an appropriate context".
The difference is that the recovery is almost a full blown operating system. It can mount filesystems, has various shell utilities installed, and there's a user interface (through ADB and on-screen). This in contrast to fastboot which has noneof those things, and only allows you to flash/erase partitions with the help of a computer.
And for a number of years I only thought a zero-day defect was something that had existed since that version of DOS or Windows was issued, regardless of when or whether it was discovered, patched, exploited or not.
Eventually I got the idea that people just don't want to count back that far.
An alternative title could include "actively used" or similar to maybe be more clear.
The exploit was a 0-day at one point in time. Furthermore, I'd argue that the perspective of the one talking also matters. If Microsoft etc know about it, but haven't patched it or made anything public, it's definitely a 0-day if used against me, as I haven't had any opportunity to defend against it.
0-day versus "publicly disclosed unpatched vulnerability" doesnt help anyway
If you want to use the "day" framing, the appropriate headline is "90-day exploit still not fixed". The entire point is that it's an old exploit that is still unpatched, and not some new discovery.
"A zero-day (also known as 0-day) vulnerability is a computer-software vulnerability that is unknown to those who should be interested in mitigating the vulnerability (including the vendor of the target software)."
Personally I have always used it as "there is not mitigation / patch available". Thanks for pointing me in the proper direction.
Edit: I am old and stubborn, I still use 'hacker' as a compliment.
> 2020-12-08 Meeting between MSRC and Project Zero leadership to determine details and discuss next steps. The 14-day grace period is unavailable as Microsoft do not plan to patch this issue before Jan 6 (next patch Tuesday is Jan 12).
> 2020-12-23 90 day deadline exceeded - derestricting issue.
Ouch. With xmas in the middle the grace period, I could see how this can be considered too strict on P0's part. Then, again, the initial bad fix surely harmed whatever trust there was between the parties.
CVE-2020-0986 had been discovered in the wild in May. Microsoft claimed to have fixed it, so this was logged as a separate CVE, even though it's essentially the same bug (the fix can be trivially circumvented) and P0 has given it a new 90 day period, which has now ran out.
I wouldn't call it too strict, they had much more than 90 days to fix it properly.
(e.g., this be used for something like breaking out of a Chrome sandbox?)
>Integrity levels are available on Windows Vista and later versions. They don‘t define a security boundary in the strict sense, but they do provide a form of mandatory access control (MAC) and act as the basis of Microsoft’s Internet Explorer sandbox.
And yes, chrome uses it as a sandbox.
> So, the integrity level is a bit redundant with the other measures, but it can be seen as an additional degree of defense-in-depth, and its use has no visible impact on performance or resource usage.
Not sure about Chrome though.
They can always use DOH but you can block DOH domains via the pinhole as well.
All of this of course is part of defense in depth, multiple layers of incomplete protection is better than nothing at all.
1. Run it locally and have it configured to use a public name server as its source (if you run Windows/other there are not doubt native options that'll work this way too). Even if the network you connect to redirects requests to public DNS resolvers you'll still be going through your local filter. Though you'll need to set your machine to ignore DNS config via DHCP, and you'll have to point it at the local resolvers if the network simply blocks public DNS servers.
2. Run it in a VM or container, this would mean you can run PiHole specifically even if you are running Windows, and configure as above. Memory requirements are pretty low so unless you are using very low spec device it should fit.
3. If you have a hosted server (you can get a VPS big enough for PiHole for a few $/year) or a publicly addressable address at home, you can run a VPN and access it that way (assuming the network you are on does not block your VPN of choice of course). You don't have to run a VPN, but I'd not recommend running a publicly addressable DNS server. This will even work on phones depending on the OS there and the chosen VPN.
Of course these are not viable options for a lesser techie user.
It's been months. Microsoft and security don't exactly go together in my head.
Taken together these things feel like the death knell of Wintel.
[same applies to Goo only their troll army, yet, is larger. as long as it lasts ..]
Windows is very popular.
https://googleprojectzero.blogspot.com/p/vulnerability-discl... https://googleprojectzero.blogspot.com/2020/01/policy-and-di...
Leaving vulnerabilities in products for an extended period of time is a problem, and adding a deadline helps to ensure that important security issues actually do get triaged and addressed.
As a recent project zero blog post about their policy calls out (https://googleprojectzero.blogspot.com/2020/01/policy-and-di...) "We've seen some big improvements to how quickly vendors patch serious vulnerabilities, and now 97.7% of our vulnerability reports are fixed within our 90 day disclosure policy."
It sounds like it's working as intended. The only way you can make it actually work is to make sure it has some teeth though, hence you have to actually disclose when you say you will.
> doesn't it cause more harm than good?
Microsoft is harming its users by not fixing a security vulnerability. In this case, it's even more clear since there's "in the wild" exploits. Project zero's just helping to raise awareness of the harm microsoft's causing.
The stakes are very different for disclosing a remotely exploitable vuln.
Having disclosure deadlines is the only way to get away from companies taking literal years to provide patches, and the deadlines only matter if they're actually enforced.
So..
Google... Don't be evil??? Lol. So not true now...