13 ms·
Remotely Exploitable Type Confusion in Windows 8, 8.1, 10, Windows Server, etc
- dboreham 9y agoIt only took two days to fix this and release the patch? Impressed.
- temac 9y agoThe criticality is insanely high...
- andremat 9y agoNot to belittle MSFT's ability but a high quality repro helps immensely.
- dboreham 9y agoHmm...I guess I was assuming they had fixed all the potential vulnerabilities allowed by running a virus scanner as root, not just the specific vulnerability described in the example exploit.
- scarybeast 9y agoProps on the fast fix; anti-props on running an unsandboxed JavaScript engine at SYSTEM privileges and feeding it files from remote.
- inlined 9y agoI'm really surprised here. When I worked on Windows we used the STRIDE model and had to do formal threat model analysis for every component. The reviews I was in was in for win 8 took a full day. A TMA should have immediately showed that a security boundary was needed.
- UnoriginalGuy 9y agoIf anyone is interested in STRIDE there's an MSDN article here: https://msdn.microsoft.com/en-us/library/ee823878(v=cs.20).aspx https://msdn.microsoft.com/en-us/library/ee823878(v=cs.20).a...
- djsumdog 9y agoLarge company with multiple teams and varying levels of people? I met someone who worked on Office. He told me there were parts of Excel that used a shared code base for Mac/Win/Web, parts that were just Mac/Web with different Win components, and for the Excel graphs, the labels for the graphs were unified for all three platforms but drawing the graph was individual to each platform. Mac Office was a fork from years ago they're finally trying to rebase and bring back into mainline. Some large companies aren't really unified entities with universal standards. You can be using a standard unified approach for the company and still be seated next to an intern not forced to use version control or a brand new Uni hire that's on a totally different process due to the team they get hired into.
- gpvos 9y agoTMA = ? (I'm guessing Threat Model Analysis?)
- inlined 9y agoYes. It's a formal doc that models information following between different actors separated by security boundaries
- statictype 9y agoNScript is the component of mpengine that evaluates any filesystem or network activity that looks like JavaScript. To be clear, this is an unsandboxed and highly privileged JavaScript interpreter that is used to evaluate untrusted code, by default on all modern Windows systems. This is as surprising as it sounds. Double You Tee Eff. Why would mpengine ever want to evaluate javascript code coming over the network or file system? Even in a sandboxed environment? What could they protect against by evaluating the code instead of just trying to lexically scan/parse it? (I'm sure they had a reason - wondering what it is)
- sevensor 9y agoIdle speculation -- perhaps they run it in the sandbox to see if it appears to be malicious? I mean, it's kind of like doing crash-tests with live passengers instead of dummies, but I could maybe see somebody deciding this was a good idea.
- viraptor 9y agoThis is the most likely reason. Moving it to a lower privilege amount was just either missed, or is still on someone's Todo.
- acdha 9y agoI'd expect surprised if it wasn't just the daunting compatibility work: it's a complex legacy codebase and if you make a mistake you impact security or performance on every Windows box in the world.
- statictype 9y agoYeah - that kind of makes sense - maybe using mock objects for filesystem access and seeing what it was doing - but that feels to me a bit like trying to solve the halting problem - putting yourself into the process really seems like it will prevent you from trying to figure out what it actually does. Maybe I'm just wrong about that and this is a standard technique for evaluating security.
- to3m 9y agoSourceTree is pretty much unusable on my laptop, because every time it does anything the antimalware service springs into life and uses up anything from 20%-80% of the CPU power available. I've had it take 30 seconds to revert 1 line. It's stupid. I was very much prepared to blame Atlassian for this, but maybe I need to start thinking about blaming Microsoft instead, because it sounds like they've made a few bad decisions here. (Still, if my options are this, or POSIX, I'll take this, thanks. Dear Antimalware Service Executable, please, take all of my CPUs; whatever SourceTree is doing, I can surely wait. Also, please feel free to continue to run fucking Javascript as administrator... I don't mind. It's a small price to pay if it means I don't have to think about EINTR or CLOEXEC.)
- AdamTReineke 9y agoIf real-time monitoring is running, try adding exceptions for your source and build outputs. It prevents antimalware from watching changes in those folders which can really slow down a build or sync.
- to3m 9y agoI've always been a bit wary of doing that, as I've seen infected EXEs committed to version control a number of times because of it :( What I have done - well, what I think I have done! - the UI is appalling - is added SourceTree.exe and git.exe as exclusions. My intention here is that the antimalware service won't then monitor their activity while they're doing stuff, but will still check working copies when it does a routine scan... but sadly this didn't seem to make any difference at all, literally none whatsoever, and SourceTree continued to be what I can only describe as "slow as fuck" - if you'll forgive the technical jargon. The odd thing is, though, which just occurred to me like literally right now, it might actually be safer to add the folder exclusion after all! Because then there's zero risk of the Javascript interpreter springing into action :-| What a time to be alive! (But I still stand by everything I said about POSIX.)
- pitay 9y agoThe malware protection system running uses a filesystem minifilter so may not matter what executable is running just that files are changed in the NTFS filesystem. So the grandparent post has great advice. It is definitely worth trying even if you may not want it to be the long term solution.
- deleted 9y ago[deleted]
- jbergstroem 9y agoExploitability Assessment for Latest Software Release: 2 - Exploitation Less Likely Exploitability Assessment for Older Software Release: 2 - Exploitation Less Likely Anyone with ideas on how they came to this conclusion? Yes, I read the linked document but felt that the index assessment didn't really reflect that google (Natalie?) seems to have found this "in the wild".
- sigmar 9y agoNot sure but the last comment on the bug report says: "RCE risk should be lowered due to CFG (on platforms where CFG is in effect)." >the index assessment didn't really reflect that google (Natalie?) seems to have found this "in the wild". Did she? How do you know this? edit: MS seems to explicitly say they are not aware of it being used. "Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security advisory was originally issued."
- jbergstroem 9y ago> Did she? How do you know this? Left column says: Finder-natashenka twitter.com/natashenka -> Natalie I added a "seems" since I wasn't sure, but let me use it again: there sure seems to be a connection.
- ajdlinux 9y agoThat doesn't address the "in the wild" part of your claim.
- jbergstroem 9y agoYou are right. That comment was based on this quote: "The debugging session below was captured after visiting a website that did this:" In hindsight: It can be interpreted in many ways and my standpoint was too pessimistic/bold from a security standpoint.
- winteriscoming 9y ago
- deleted 9y ago[deleted]
- caf 9y agoAs mpengine will unpack arbitrarily deeply nested archives... Surely not - what happens if you feed it the zipfile quine?
- Terr_ 9y agoIf that broke it, I imagine it would've been discovered by now. A simple mitigation would be to check if the newly-unpacked file is the same. However... suppose someone crafted an alternating version -- where A.zip contains B.zip contains A.zip etc. -- I bet there are systems out there which only do one tier of checking.
- qb45 9y agoThere exists a much simpler way, it is for example how C++ compilers deal with recursion in template instantiation: for level = 1 to arbitrary_depth: do_some_work_which_may_produce_more_work() You just have to select arbitrary_depth large enough that nobody notices and there you have it - arbitrarily deep recursion without infinite loop ;) Totally wouldn't be surprised if MS did it this way too. Otherwise you are right - they would need to remember at least hashes of all "outer" archives unpacked so far.
- nathan_f77 9y agoHaha, that's how I like to write all my code now. Sometimes I'll write a function that generates a random id, and checks the database to make sure that it doesn't already exist. I always like to add a counter and throw an error (or just return some default value) if it gets up to 100 or so. It might not ever happen in this universe, but I like to imagine there's a parallel universe out there where I saved some server from going into an infinite loop. I actually did this recently for a random phone number generator, using the phony Ruby library to validate numbers. It was just for some test fixtures, but it's nice to know that it will always fallback to a default test number in case something goes wrong and it runs out of attempts. Or I'm in some universe where my random number generator suddenly starts producing an endless stream of zero bits. This is just a little 'tick'. I also find myself using 12px and 14px a lot more frequently than 13px.
- pierrec 9y agoI think this sentence sums up the severity pretty well: The attached proof of concept demonstrates this, but please be aware that downloading it will immediately crash MsMpEng in its default configuration and possibly destabilize your system. Extra care should be taken sharing this report with other Windows users via Exchange, or web services based on IIS, and so on. And I think the intended formulation was "care should be taken sharing this report with other Windows users or via Exchange, or web services based on IIS..." (because they're afraid it could crash the servers even if sharing between non-Windows users!)
- jonstewart 9y agoDoes MsMpEng actually do file analysis itself, unpacking, unarchiving, &c? That's the kind of stuff that should usually be sandboxed. If its zip/rar/7zip/cab/whatever support hasn't been formally verified and those components run as SYSTEM, es no bueño.
- arca_vorago 9y agoI'm pretty close to just saying saying I refuse to work on Windows systems anymore.
- ChairmanPao 9y agoThey fixed this in two days. Go play with your Macintosh.
- michaelmcmillan 9y agoNot a fan either, but it would be silly to think that there does not exist equally harmful vulnerabilities in similar software for other platforms. They just remain to be discovered.
- deleted 9y ago[deleted]
- krylon 9y agoTo be fair, I suspect that Windows simply makes for an attractive target, both for security researchers and malware authors, because about 90% of desktop computers are running Windows. If GNU/Linux had a market share of >50%, I would expect similar news to pile up at a comparable rate. For the moment, GNU/Linux enjoys kind of a reverse herd immunity, but I do not believe it is inherently more secure than Windows.
- windsurfer 9y agoThis also includes Windows 7 and anything running Microsoft Security Essentials, but does not include any Windows Server other than 2016.
- rubatuga 9y agoCongratulations Microsoft, on your best exploit yet!
- krylon 9y agoRemember the RPC vulnerabilities from ~2003? Back then, a machine connected to the Internet without some firewall in front of it would get infected before the installation routine was finished. This one is really bad, of course, but historically, it's not the worst.
- ms_skunkworks 9y agoWas mpengine developed by Microsoft Research?
- binome 9y agoAt least the good guys found this one first, and it is in Windows Defender, and the definitions should automatically update in 24hrs or less silently without a reboot.
- janwillemb 9y ago> the good guys found this one first Not necessarily
- NKCSS 9y agoTurn of Windows Defender: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender] "DisableAntiSpyware"=dword:00000001 Then reboot. On the other hand: Microsoft has already issued a fix: https://twitter.com/msftsecresponse/status/861734360193552385 https://twitter.com/msftsecresponse/status/86173436019355238... But still; the auto-unpack of archives leaves me wanting to just disable it completely.
- Kenji 9y agoMe, almost a year ago: https://news.ycombinator.com/item?id=12184173 https://news.ycombinator.com/item?id=12184173 Despite getting all the downvotes, who is looking stupid now?
- xxxxxxxx 9y agoYou listed a lot of bad experiences, but none of them related to security.
- jeffy 9y agoContents of the PoC are a ".zip" file that is actually plain-text (the engine ignores extension/mime types) and contains just this line of JS and 90kb of nonsense JS for entropy. (new Error()).toString.call({message: 0x41414141 >> 1}) It's hard to imagine MS doesn't receive tons of watson crash reports of MsMpEng from trying to run bits of random JS. If they haven't looked at them, they probably should start now.
- madshiva 9y agoHey Tavis, if you read this, could you tell to Microsoft for fix the issue with definition updates that won't remove after update? The definition kept growing and waste space. (the problem auto solve if the computer is rebooted). Thanks :)
- imipak 9y agoThis may help... $ /cygdrive/c/Program\ Files/Windows\ Defender/MpCmdRun.exe /h Windows Defender Command Line Utility (c)2006-2008 Microsoft Corp Use this tool to automate and troubleshoot Windows Defender [...]
- madshiva 9y agoThanks, it's strange how hackernews users are so agressive with downvote...
- imipak 9y agoMight help: <code> $ /cygdrive/c/Program\ Files/Windows\ Defender/MpCmdRun.exe /h Windows Defender Command Line Utility (c)2006-2008 Microsoft Corp Use this tool to automate and troubleshoot Windows Defender </code>
- e12e 9y agoDid anyone manage to figure out a simple powershell-incantation to figure out if a system is properly patched/secure? https://technet.microsoft.com/en-us/library/security/4022344 https://technet.microsoft.com/en-us/library/security/4022344 Simply lists: "Verify that the update is installed Customers should verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded and installed for their Microsoft antimalware products. For more information on how to verify the version number for the Microsoft Malware Protection Engine that your software is currently using, see the section, "Verifying Update Installation", in Microsoft Knowledge Base Article 2510781. For affected software, verify that the Microsoft Malware Protection Engine version is 1.1.10701.0 or later." As far as I can figure out, if: Get-MpComputerStatus|where -Property AMEngineVersion -ge [version]1.1.10701.0|select AMEngineVersion prints something like: AMEngineVersion --------------- 1.1.13704.0 according to MS one should be patched-up and good to go? (The command should print nothing on vulnerable systems). However a hyper-vm last patched before Christmas (it's not networked), lists it's version as: 1.1.12805.0 -- which certainly seems to be a higher version than 1.1.10701.0? I'll also note that using "[version]x.y.z.a" apparently does not force some kind of magic "version compare"-predicate, based on some simple tests. Any powershell gurus that'd care to share a one-liner to check if one has the relevant patches installed? Am I looking at the wrong property?
- spydum 9y agoYou have the right idea but wrong version number.. 1.1.13701, not 10701.
- e12e 9y agoThat makes more sense, thanks. Still can't get powershell to compare in away that makes 1.1.12805.0 be less than 1.1.13701.0, but at least manual inspection makes sense now: # On old hyper-v vm: Get-MpComputerStatus \ |where -Property AMEngineVersion \ -gt [version]1.1.13701.0 \ |select AMEngineVersion AMEngineVersion --------------- 1.1.12805.0 I guess one out of two isn't bad...
- polskibus 9y agoI wonder how does it affect Azure? Can such security hole affect Azure security?
- pedrow 9y agoQuick question on the timings of this. The report says that "This bug is subject to a 90 day disclosure deadline." - does that mean it was discovered 90 days ago and has been published now, or it was discovered on May 6 (as dates on the comments seem to suggest) and Microsoft has responded very quickly? In either case it seems strange not to have waited a couple more days because (for my system, anyway) I was still running the vulnerable version even after the report was made public.
- mattcoles 9y agoIt was discovered May 6th. MS has responded and fixed very quickly. I'm not overly familiar with Windows but I've seen multiple people saying that Defender patched itself without requiring any action on their part.
- iofiiiiiiiii 9y agoTheir policy is to publish when a fix is available. Yes, Microsoft responded very quickly in this case.
- ifdefdebug 9y agoThey disclosed after Microsoft had released an advisory for this issue (see comment 11) so it was public anyway.
- ezoe 9y agoSo MS's anti malware software does: 1. Execute NScript, a JavaScript-like language. 2. Run as high privileged, non-sandboxed process. 3. Intercept filesystem changes and run NScript code written to anywhere, including browser cache. 4. Do not check code signing. This is unbelievably ridiculous. It shall not happen to the software which claims to improve "security". As I always said, there is no good anti malware software. Everything sucks. An additional software is an additional security risk.
- speps 9y ago"NScript is the component of mpengine that evaluates any filesystem or network activity that looks like JavaScript." It's the name of the component.
- nthcolumn 9y agomalware injection service lol.
- icf80 9y agoThe affected products: Microsoft Forefront Endpoint Protection 2010 Microsoft Endpoint Protection Microsoft Forefront Security for SharePoint Service Pack 3 Microsoft System Center Endpoint Protection Microsoft Security Essentials Windows Defender for Windows 7 Windows Defender for Windows 8.1 Windows Defender for Windows RT 8.1 Windows Defender for Windows 10, Windows 10 1511, Windows 10 1607, Windows Server 2016, Windows 10 1703 Windows Intune Endpoint Protection Last version of the Microsoft Malware Protection Engine affected by this vulnerability Version 1.1.13701.0 First version of the Microsoft Malware Protection Engine with this vulnerability addressed Version 1.1.13704.0 https://technet.microsoft.com/en-us/library/security/4022344 https://technet.microsoft.com/en-us/library/security/4022344
- dagaci 9y agoI am not happy that Google has published a full exploit well before it has been possible to anyone to actually deploy the patch and within just 3 days of notifying the vendor. It seems that Google is eager for someone to use this exploit to attack as many systems as possible before they can be patched against it.
- AlphaWeaver 9y agoThe exploit is deployed quickly via the automatic daily update of the Windows Defender engine (the same thing that fetches new virus defintions) if I understand correctly. My system already had the patch when I checked.
- yAak 9y agoGoogle only made it publicly visible after Microsoft publicly published this: https://technet.microsoft.com/en-us/library/security/4022344 https://technet.microsoft.com/en-us/library/security/4022344
- dagaci 9y agoI know but the exploit, a template virus, has been published before i could actually install the fix, and this applies to everyone. I actually think this behaviour is appalling. This kind of exploit could propagate very quickly.
- nathan_f77 9y agoThis is amazing work. Does anyone know how much someone like Tavis Ormandy would be getting paid? Would it be 7 figures?
- lawnchair_larry 9y agoIt wouldn't be close to that. Closer to the 250-350 range for engineers at that level at Google. Also, Tavis didn't find this one.
- mixologic 9y agoLooks like a joint discovery? https://twitter.com/taviso/status/860679110728622080 https://twitter.com/taviso/status/860679110728622080
- btb 9y agoGood that it was fixed. But now bad actors will be looking very hard for other bugs in the unsandboxed javascript interpreter. Tempting to just disable windows defender completely.