6 ms·

Windows non-LAN, wormable RCE 0-day discovered

99 points by nerdy 9y ago

mynewtb 9y ago
I don't understand the LAN bit, does this mean 'over the internet'?
- deleted 9y ago
  [deleted]
- paulv 9y ago
  Yes. Non-LAN meaning the attacker doesn't have to be inside your home/work local network.
  - londons_explore 9y ago
    It could mean two things. Either it could mean it is not a requir mentioned to be able to send broadcast packets to the machine. Windows uses broadcast packets for lots of things, like discovering UPnP devices, media centers, other machines file/printer shares, etc. Or it could mean no need to have the ability to send the machine IP packets directly, so one can attack even if the machine is behind NAT. There are far fewer ways to attack a machine behind NAT with no user interaction, but things like sending back false NTP or DNS responses, spoofing windowsupdate servers, or some of the peer to peer services built into windows sound like possible ways.
    - pdkl95 9y ago
      s/NAT/firewall/g NAT does not provide security on its own, it's the firewall that drops packets. Most of the time you see both together on the same device; it's very rare to see a NAT-only device, which usually will route packets to hosts on the LAN.
      - eriknstr 9y ago
        The statement "there are far fewer ways to attack a machine behind NAT with no user interaction" is true even though NAT on it's own is not designed to be a firewall.
      - rocqua 9y ago
        Nat certainly does provide basic security. If you aren't routable, they can't setup a connection to you.
        mshook 9y ago
        They can, it's called firewall punching... Skype does that routinely: ever wondered how it can setup a point to point connection without port forwarding? So to agree with PP, NAT is not a firewall...
        dec0dedab0de 9y ago
        I believe that's called ICE. and still needs both clients aware that theyre about to connect, and making outbound connections to each other with the goal of opening up sourceports. This does not negate the fact that NAT(PAT) provides protection against directly connecting to a device.
        mshook 9y ago
        If you know a bug in the DNS resolving stack of the client, you can make it send a query to your DNS server and exploit it to establish a connection. So no, it doesn't have to know it's about to connect. A query is easily triggered by sending an email with a an external picture embedded or something like that. Nothing NAT/PAT can protect you against.
        slau 9y ago
        But why would the client use _your_ DNS server? It will just use its local resolver, which will most likely use the router, or ISPs DNS server, and so forth.
- rdtsc 9y ago
  LAN means "Local area network". Imagine all the computers in your house connected to your router for example. They mentioned it because other vulnerabilities could be classified as remote but still only exploitable on the local network. This one is exploitable from anywhere on the internet apparently. So its impact could be more severe.
buster 9y ago
I'm curious what "don't need to be on the same LAN" means. If it would be exploitable over internet wouldn't you just write that oder even leave the part about LAN out?
- rdtsc 9y ago
  Because other remote vulnerabilities weren't exploitable outside the LAN. So while they are "remote" it's a different class of "remote" so to speak.
Kenji 9y ago
So little information. We will have to wait until this is patched to know more about it, won't we.
disposablename 9y ago
Clickbait title? Zero info? Windows is evil! To the front of hacker news we go!
- anon1385 9y ago
  Are you suggesting that Tavis Ormandy is making this up? This is upvoted because of the reputations of the people reporting it and because it sounds very serious. It's nothing to do with any kind of anti-Windows agenda.
  - UnoriginalGuy 9y ago
    There's absolutely zero info. So even if he isn't making it up, there's still nothing to discuss on this, and he's ratcheted the hype up to 11.
    - rdtsc 9y ago
      > there's still nothing to discuss on this, Oh I think there is a lot to discuss. How Windows has handled vulnerabilities in the past. Can talk about how disclosure works. Maybe mention recent Intel vulnerabilities as well. Connect to CIA and NSA leaks them hoarding 0-days and so on.
- deleted 9y ago
  [deleted]
atroll 9y ago
does this mean that it can be triggered by a web browser ?
ENTP 9y ago
A wild stab in the dark: remote code execution using a standard codec/library, easily triggered in the context of an ad.

99 points by nerdy 9y ago

mynewtb 9y ago

I don't understand the LAN bit, does this mean 'over the internet'?

deleted 9y ago
[deleted]
paulv 9y ago
Yes. Non-LAN meaning the attacker doesn't have to be inside your home/work local network.
- londons_explore 9y ago
  It could mean two things. Either it could mean it is not a requir mentioned to be able to send broadcast packets to the machine. Windows uses broadcast packets for lots of things, like discovering UPnP devices, media centers, other machines file/printer shares, etc. Or it could mean no need to have the ability to send the machine IP packets directly, so one can attack even if the machine is behind NAT. There are far fewer ways to attack a machine behind NAT with no user interaction, but things like sending back false NTP or DNS responses, spoofing windowsupdate servers, or some of the peer to peer services built into windows sound like possible ways.
  - pdkl95 9y ago
    s/NAT/firewall/g NAT does not provide security on its own, it's the firewall that drops packets. Most of the time you see both together on the same device; it's very rare to see a NAT-only device, which usually will route packets to hosts on the LAN.
    - eriknstr 9y ago
      The statement "there are far fewer ways to attack a machine behind NAT with no user interaction" is true even though NAT on it's own is not designed to be a firewall.
    - rocqua 9y ago
      Nat certainly does provide basic security. If you aren't routable, they can't setup a connection to you.
      - mshook 9y ago
        They can, it's called firewall punching... Skype does that routinely: ever wondered how it can setup a point to point connection without port forwarding? So to agree with PP, NAT is not a firewall...
        dec0dedab0de 9y ago
        I believe that's called ICE. and still needs both clients aware that theyre about to connect, and making outbound connections to each other with the goal of opening up sourceports. This does not negate the fact that NAT(PAT) provides protection against directly connecting to a device.
        mshook 9y ago
        If you know a bug in the DNS resolving stack of the client, you can make it send a query to your DNS server and exploit it to establish a connection. So no, it doesn't have to know it's about to connect. A query is easily triggered by sending an email with a an external picture embedded or something like that. Nothing NAT/PAT can protect you against.
        slau 9y ago
        But why would the client use _your_ DNS server? It will just use its local resolver, which will most likely use the router, or ISPs DNS server, and so forth.
rdtsc 9y ago
LAN means "Local area network". Imagine all the computers in your house connected to your router for example. They mentioned it because other vulnerabilities could be classified as remote but still only exploitable on the local network. This one is exploitable from anywhere on the internet apparently. So its impact could be more severe.

buster 9y ago

I'm curious what "don't need to be on the same LAN" means. If it would be exploitable over internet wouldn't you just write that oder even leave the part about LAN out?

rdtsc 9y ago
Because other remote vulnerabilities weren't exploitable outside the LAN. So while they are "remote" it's a different class of "remote" so to speak.

Kenji 9y ago

So little information. We will have to wait until this is patched to know more about it, won't we.

disposablename 9y ago

Clickbait title? Zero info? Windows is evil! To the front of hacker news we go!

anon1385 9y ago
Are you suggesting that Tavis Ormandy is making this up? This is upvoted because of the reputations of the people reporting it and because it sounds very serious. It's nothing to do with any kind of anti-Windows agenda.
- UnoriginalGuy 9y ago
  There's absolutely zero info. So even if he isn't making it up, there's still nothing to discuss on this, and he's ratcheted the hype up to 11.
  - rdtsc 9y ago
    > there's still nothing to discuss on this, Oh I think there is a lot to discuss. How Windows has handled vulnerabilities in the past. Can talk about how disclosure works. Maybe mention recent Intel vulnerabilities as well. Connect to CIA and NSA leaks them hoarding 0-days and so on.
deleted 9y ago
[deleted]

atroll 9y ago

does this mean that it can be triggered by a web browser ?

ENTP 9y ago

A wild stab in the dark: remote code execution using a standard codec/library, easily triggered in the context of an ad.