14 ms·

NScript is the component of mpengine that evaluates any filesystem or network activity that looks like JavaScript. To be clear, this is an unsandboxed and highl

NScript is the component of mpengine that evaluates any filesystem or network activity that looks like JavaScript. To be clear, this is an unsandboxed and highly privileged JavaScript interpreter that is used to evaluate untrusted code, by default on all modern Windows systems. This is as surprising as it sounds. Double You Tee Eff. Why would mpengine ever want to evaluate javascript code coming over the network or file system? Even in a sandboxed environment? What could they protect against by evaluating the code instead of just trying to lexically scan/parse it? (I'm sure they had a reason - wondering what it is)

sevensor 9y ago
Idle speculation -- perhaps they run it in the sandbox to see if it appears to be malicious? I mean, it's kind of like doing crash-tests with live passengers instead of dummies, but I could maybe see somebody deciding this was a good idea.
- viraptor 9y ago
  This is the most likely reason. Moving it to a lower privilege amount was just either missed, or is still on someone's Todo.
  - acdha 9y ago
    I'd expect surprised if it wasn't just the daunting compatibility work: it's a complex legacy codebase and if you make a mistake you impact security or performance on every Windows box in the world.
- statictype 9y ago
  Yeah - that kind of makes sense - maybe using mock objects for filesystem access and seeing what it was doing - but that feels to me a bit like trying to solve the halting problem - putting yourself into the process really seems like it will prevent you from trying to figure out what it actually does. Maybe I'm just wrong about that and this is a standard technique for evaluating security.
  - wfunction 9y ago
    > but that feels to me a bit like trying to solve the halting problem that's literally what every antivirus is already doing though.
  - mikeash 9y ago
    Running the program to see if it ever stops is an easy way to solve the halting problem. The trick, of course, is that you need infinite time to be sure of a "never halts" answer. Turing's proof essentially says that there is no way to be sure of knowing what an arbitrary program will do except for running it and seeing what it does. It's an imperfect technique for real-world programs, but so is everything. Think of it as being like static code analysis versus runtime "sanitizer" tools. Both are useful, and both can detect problems the other can't.
    - zAy0LfpBZLC8mAC 9y ago
      > It's an imperfect technique for real-world programs, but so is everything. No, it's mostly a bullshit technique. The thing is that the malware author can see "how much" of the halting problem AV software "solves", and then deliberately hide their bad/suspicious actions just out of reach of that limit. Simple everyday heuristics are good for a lot of things, but the one thing that they are mostly ineffective against is intentional deception.
- mikeash 9y ago
  It's like doing crash tests with live passengers, but it's OK because you have a machine that can duplicate people and you just kill the duplicates. Except one day you get it mixed up and kill the originals, whoopsie. I greatly enjoy this analogy.
  - Ivoah 9y ago
    You should watch The Prestige[1] [1] http://www.imdb.com/title/tt0482571/ http://www.imdb.com/title/tt0482571/
    - JetSpiegel 9y ago
      Or read the book, if you like framing devices that are flimsy excuses to describe sexy ladies.
    - tormeh 9y ago
      It's so good.
    - moomin 9y ago
      (Spoilers) But yes, watch The Prestige.
    - mikeash 9y ago
      Yes, I keep meaning to, just haven't gotten around to it.
    - lfowles 9y ago
      And if you enjoyed that, you'll probably also enjoy: Think Like a Dinosaur https://www.goodreads.com/book/show/13582015-think-like-a-dinosaur https://www.goodreads.com/book/show/13582015-think-like-a-di...
  - rbanffy 9y ago
    If the copies cannot be distinguished from the originals, there is no problem.
    - 9y ago
- wglb 9y ago
  From the article: MsMpEng runs as NT AUTHORITY\SYSTEM without sandboxing
SomeStupidPoint 9y ago
I'm trying to be charitable, because I don't quite understand the Windows security model, but how is the reasoning to this not just: "We don't trust this code from the internet, let's run it as SYSTEM!" Because that seems insane. It's escalating the runtime permissions of code you don't trust -- moving it from user permission to SYSTEM permission just because it hits internet cache. I keep thinking there must be some part of this I'm missing, because if that's really how it works... "Double You Tee Eff" indeed.
- UnoriginalGuy 9y ago
  There's nothing you're missing, it is insane. So the anti-virus runtime engine has to run as something akin to SYSTEM since it has oversight over the entire system, but once a type is detected it could pass the actual sandboxing into a lowpriv child process and wait for a result. The only explanation I can imagine is performance? But child processes could be pre-spawned or it could use shared memory regions for isolation. There's a number of things you can do here to have your cake and eat it too. I'm legitimately surprised by this from Microsoft, they take security very seriously these days, and I cannot see how this would pass their normal review process? Even just reading the description makes you facepalm.
- userbinator 9y ago
  SYSTEM is even more privileged than Administrator. This is the real "root" user. One thing that sometimes annoys me greatly is that on Windows, Administrator is not the most privileged user and SYSTEM is hard to actually get to when you need it. On a tangential point, one common "hack" when XP was popular was to replace Winlogon.exe with Minlogon, which basically made it an ultra-fast-booting "single user mode" (and coincidentally, also bypassed WPA) and that single user was... SYSTEM. That along with EWF and some creative RAMdisk usage made for some interesting liveCD-like Windows environments.
  - voltagex_ 9y ago
    What advantage would a Minlogon XP have over WinPE?
UnoriginalGuy 9y ago
Because otherwise bad actors could encode, encrypt, or otherwise obfuscate malware inside of a JavaScript file. This type of shielding can be dynamic and near impossible to detect with simple parsing. Executing the JavaScript will run it in a similar way to the client, and perhaps provide the original malware which you can detect against. Malware struggles to stay stealth due to it needing to access specific features or run specific commands to elevate or take control. That isn't true for obfustication techniques which can look and act like "legitimate" JavaScript.
ploxiln 9y ago
This is the standard strategy that every antivirus product has used for most of their history. Remember the one about Symantec doing exactly this in a kernel module: https://googleprojectzero.blogspot.com/2016/06/how-to-compromise-enterprise-endpoint.html https://googleprojectzero.blogspot.com/2016/06/how-to-compro... I've known for over a decade that antivirus products are strangely destabilizing and stayed away from them myself. For the last year or so that Tavis has been investigating them, we know why. They're just really dumb. Because the popular commercial computer security product market is a "market for lemons": https://www.schneier.com/blog/archives/2007/04/a_security_mark.html https://www.schneier.com/blog/archives/2007/04/a_security_ma...
- jobu 9y ago
  First I've heard of the "Market for Lemons" concept (https://en.wikipedia.org/wiki/The_Market_for_Lemons https://en.wikipedia.org/wiki/The_Market_for_Lemons) It seems pretty obvious now that I think about it, and it definitely goes hand-in-hand with the "Confusopoly" concept (https://en.wikipedia.org/wiki/Confusopoly https://en.wikipedia.org/wiki/Confusopoly). Why should companies compete on quality or price when they can put all that effort into advertising and marketing that scares or confuses most people into buying their product
  - vanderZwan 9y ago
    I wonder if you can apply that to modern politics as well. Why try to have well-informed citizens when you can scare them?
  - thecrazyone 9y ago
    I don't get this Market for Lemons thing. Am I missing any axioms that make this logic correct?. My quips with the theory are: 1) Why are there only binary (2) qualities of cars - good or bad. And why are they static? What market is this trying to model? 2) Wouldn't it be sufficient for peaches (as opposed to lemons) to be lowered in cost to market price i.e. the avg. Somehow peaches are of immutable cost/ quality with zero seller margins? Aside: 1) Also, why is the state of the cars being considered to be unknowable i.e. even in a given model of car, the units are not of consistent quality? Is this a production quality issue (i.e. inconsistent quality of units in a given model) 2) Why is this state of unknowable or perhaps inconsistent quality an equilibrium? meaning wouldn't a middle man who tests cars try and separate the lot and charge for his services? This market situation that is being modeled seems contrived, at least to the extent that I understand from the Market for lemons wikipedia article
zamalek 9y ago
> Double You Tee Eff Last time there were discussions about AV around here, people were adamant that Defender was simply above this type of thing - mostly based on the word of a browser vendor. Turns out that a homogeneous AV environment is a not a good idea. Who would have thought?
- statictype 9y ago
  Except that all the others do similar and much worse things.
  - zamalek 9y ago
    > all the others That's a very broad generalization. Care to provide a citation of all AVs getting up to no good?
    - tetromino_ 9y ago
      Symantec: remote root via vulnerable kernel-mode filter drivers https://googleprojectzero.blogspot.com/2016/06/how-to-compromise-enterprise-endpoint.html https://googleprojectzero.blogspot.com/2016/06/how-to-compro... ESET NOD32: remote root via vulnerable kernel-mode filter drivers https://googleprojectzero.blogspot.com/2015/06/analysis-and-exploitation-of-eset.html https://googleprojectzero.blogspot.com/2015/06/analysis-and-... Comodo: code execution vulns in virus scanner https://bugs.chromium.org/p/project-zero/issues/detail?id=769 https://bugs.chromium.org/p/project-zero/issues/detail?id=76... and installs an insecure web browser and sets it as the default https://bugs.chromium.org/p/project-zero/issues/detail?id=704 https://bugs.chromium.org/p/project-zero/issues/detail?id=70... Avast: remote code execution in network traffic filter https://bugs.chromium.org/p/project-zero/issues/detail?id=546 https://bugs.chromium.org/p/project-zero/issues/detail?id=54... AVG: installs Chrome extension that leaks your browsing history to anyone who cares to read it https://www.theregister.co.uk/2015/12/29/avg_google_chrome_extension/ https://www.theregister.co.uk/2015/12/29/avg_google_chrome_e... TrendMicro: remote file access with SYSTEM privilege https://bugs.chromium.org/p/project-zero/issues/detail?id=775 https://bugs.chromium.org/p/project-zero/issues/detail?id=77... Kaspersky: a diverse range vulnerabilities over the years, ranging from remote root vulns (https://googleprojectzero.blogspot.com/2015/09/kaspersky-mo-unpackers-mo-problems.html https://googleprojectzero.blogspot.com/2015/09/kaspersky-mo-...) to "merely" making all SSL traffic man-in-the-middleable (https://bugs.chromium.org/p/project-zero/issues/detail?id=978 https://bugs.chromium.org/p/project-zero/issues/detail?id=97...) Etc, etc.
frik 9y ago
As mpengine will unpack arbitrarily deeply nested archives and supports many obscure and esoteric archive formats (such as Amiga ZOO and MagicISO UIF), there is no practical way to identify an exploit at the network level, and administrators should patch as soon as is practically possible. WTF Archive bomb anyone? This isn't a new concept, right? Doing IO intensive work, e.g. build large code base, I always have to deactivate the real time monitor - it slows down the whole process, or worded differently: turning off mpengine almost half's the build time. Reading more and more horror stories about its inner workings and design, it's time to get rid of it for good.
_pmf_ 9y ago
> I'm sure they had a reason There's too much going on to blame this on stupidity. This has to be intentional.
- deleted 9y ago
  [deleted]
codedokode 9y ago
They are evaluating the code in a sandbox to see what it is going to do - for example, is it going to download and run some payload or maybe add itself to autorun registry section. Many antiviruses do the same to discover obfuscated malicious programs.
- deleted 9y ago
  [deleted]
- AnimalMuppet 9y ago
  No. They are evaluating the code not in a sandbox to see what it is going to do. As System. Evaluating it in a sandbox, not as System, would be a reasonable attempt at security. What they are doing is insane.

sevensor 9y ago

Idle speculation -- perhaps they run it in the sandbox to see if it appears to be malicious? I mean, it's kind of like doing crash-tests with live passengers instead of dummies, but I could maybe see somebody deciding this was a good idea.

viraptor 9y ago
This is the most likely reason. Moving it to a lower privilege amount was just either missed, or is still on someone's Todo.
- acdha 9y ago
  I'd expect surprised if it wasn't just the daunting compatibility work: it's a complex legacy codebase and if you make a mistake you impact security or performance on every Windows box in the world.
statictype 9y ago
Yeah - that kind of makes sense - maybe using mock objects for filesystem access and seeing what it was doing - but that feels to me a bit like trying to solve the halting problem - putting yourself into the process really seems like it will prevent you from trying to figure out what it actually does. Maybe I'm just wrong about that and this is a standard technique for evaluating security.
- wfunction 9y ago
  > but that feels to me a bit like trying to solve the halting problem that's literally what every antivirus is already doing though.
- mikeash 9y ago
  Running the program to see if it ever stops is an easy way to solve the halting problem. The trick, of course, is that you need infinite time to be sure of a "never halts" answer. Turing's proof essentially says that there is no way to be sure of knowing what an arbitrary program will do except for running it and seeing what it does. It's an imperfect technique for real-world programs, but so is everything. Think of it as being like static code analysis versus runtime "sanitizer" tools. Both are useful, and both can detect problems the other can't.
  - zAy0LfpBZLC8mAC 9y ago
    > It's an imperfect technique for real-world programs, but so is everything. No, it's mostly a bullshit technique. The thing is that the malware author can see "how much" of the halting problem AV software "solves", and then deliberately hide their bad/suspicious actions just out of reach of that limit. Simple everyday heuristics are good for a lot of things, but the one thing that they are mostly ineffective against is intentional deception.
mikeash 9y ago
It's like doing crash tests with live passengers, but it's OK because you have a machine that can duplicate people and you just kill the duplicates. Except one day you get it mixed up and kill the originals, whoopsie. I greatly enjoy this analogy.
- Ivoah 9y ago
  You should watch The Prestige[1] [1] http://www.imdb.com/title/tt0482571/ http://www.imdb.com/title/tt0482571/
  - JetSpiegel 9y ago
    Or read the book, if you like framing devices that are flimsy excuses to describe sexy ladies.
  - tormeh 9y ago
    It's so good.
  - moomin 9y ago
    (Spoilers) But yes, watch The Prestige.
  - mikeash 9y ago
    Yes, I keep meaning to, just haven't gotten around to it.
  - lfowles 9y ago
    And if you enjoyed that, you'll probably also enjoy: Think Like a Dinosaur https://www.goodreads.com/book/show/13582015-think-like-a-dinosaur https://www.goodreads.com/book/show/13582015-think-like-a-di...
- rbanffy 9y ago
  If the copies cannot be distinguished from the originals, there is no problem.
  - 9y ago
wglb 9y ago
From the article: MsMpEng runs as NT AUTHORITY\SYSTEM without sandboxing

SomeStupidPoint 9y ago

I'm trying to be charitable, because I don't quite understand the Windows security model, but how is the reasoning to this not just: "We don't trust this code from the internet, let's run it as SYSTEM!" Because that seems insane. It's escalating the runtime permissions of code you don't trust -- moving it from user permission to SYSTEM permission just because it hits internet cache. I keep thinking there must be some part of this I'm missing, because if that's really how it works... "Double You Tee Eff" indeed.

UnoriginalGuy 9y ago
There's nothing you're missing, it is insane. So the anti-virus runtime engine has to run as something akin to SYSTEM since it has oversight over the entire system, but once a type is detected it could pass the actual sandboxing into a lowpriv child process and wait for a result. The only explanation I can imagine is performance? But child processes could be pre-spawned or it could use shared memory regions for isolation. There's a number of things you can do here to have your cake and eat it too. I'm legitimately surprised by this from Microsoft, they take security very seriously these days, and I cannot see how this would pass their normal review process? Even just reading the description makes you facepalm.
userbinator 9y ago
SYSTEM is even more privileged than Administrator. This is the real "root" user. One thing that sometimes annoys me greatly is that on Windows, Administrator is not the most privileged user and SYSTEM is hard to actually get to when you need it. On a tangential point, one common "hack" when XP was popular was to replace Winlogon.exe with Minlogon, which basically made it an ultra-fast-booting "single user mode" (and coincidentally, also bypassed WPA) and that single user was... SYSTEM. That along with EWF and some creative RAMdisk usage made for some interesting liveCD-like Windows environments.
- voltagex_ 9y ago
  What advantage would a Minlogon XP have over WinPE?

UnoriginalGuy 9y ago

Because otherwise bad actors could encode, encrypt, or otherwise obfuscate malware inside of a JavaScript file. This type of shielding can be dynamic and near impossible to detect with simple parsing. Executing the JavaScript will run it in a similar way to the client, and perhaps provide the original malware which you can detect against. Malware struggles to stay stealth due to it needing to access specific features or run specific commands to elevate or take control. That isn't true for obfustication techniques which can look and act like "legitimate" JavaScript.

ploxiln 9y ago

This is the standard strategy that every antivirus product has used for most of their history. Remember the one about Symantec doing exactly this in a kernel module: https://googleprojectzero.blogspot.com/2016/06/how-to-compromise-enterprise-endpoint.html https://googleprojectzero.blogspot.com/2016/06/how-to-compro... I've known for over a decade that antivirus products are strangely destabilizing and stayed away from them myself. For the last year or so that Tavis has been investigating them, we know why. They're just really dumb. Because the popular commercial computer security product market is a "market for lemons": https://www.schneier.com/blog/archives/2007/04/a_security_mark.html https://www.schneier.com/blog/archives/2007/04/a_security_ma...

jobu 9y ago
First I've heard of the "Market for Lemons" concept (https://en.wikipedia.org/wiki/The_Market_for_Lemons https://en.wikipedia.org/wiki/The_Market_for_Lemons) It seems pretty obvious now that I think about it, and it definitely goes hand-in-hand with the "Confusopoly" concept (https://en.wikipedia.org/wiki/Confusopoly https://en.wikipedia.org/wiki/Confusopoly). Why should companies compete on quality or price when they can put all that effort into advertising and marketing that scares or confuses most people into buying their product
- vanderZwan 9y ago
  I wonder if you can apply that to modern politics as well. Why try to have well-informed citizens when you can scare them?
- thecrazyone 9y ago
  I don't get this Market for Lemons thing. Am I missing any axioms that make this logic correct?. My quips with the theory are: 1) Why are there only binary (2) qualities of cars - good or bad. And why are they static? What market is this trying to model? 2) Wouldn't it be sufficient for peaches (as opposed to lemons) to be lowered in cost to market price i.e. the avg. Somehow peaches are of immutable cost/ quality with zero seller margins? Aside: 1) Also, why is the state of the cars being considered to be unknowable i.e. even in a given model of car, the units are not of consistent quality? Is this a production quality issue (i.e. inconsistent quality of units in a given model) 2) Why is this state of unknowable or perhaps inconsistent quality an equilibrium? meaning wouldn't a middle man who tests cars try and separate the lot and charge for his services? This market situation that is being modeled seems contrived, at least to the extent that I understand from the Market for lemons wikipedia article

zamalek 9y ago

> Double You Tee Eff Last time there were discussions about AV around here, people were adamant that Defender was simply above this type of thing - mostly based on the word of a browser vendor. Turns out that a homogeneous AV environment is a not a good idea. Who would have thought?

statictype 9y ago
Except that all the others do similar and much worse things.
- zamalek 9y ago
  > all the others That's a very broad generalization. Care to provide a citation of all AVs getting up to no good?
  - tetromino_ 9y ago
    Symantec: remote root via vulnerable kernel-mode filter drivers https://googleprojectzero.blogspot.com/2016/06/how-to-compromise-enterprise-endpoint.html https://googleprojectzero.blogspot.com/2016/06/how-to-compro... ESET NOD32: remote root via vulnerable kernel-mode filter drivers https://googleprojectzero.blogspot.com/2015/06/analysis-and-exploitation-of-eset.html https://googleprojectzero.blogspot.com/2015/06/analysis-and-... Comodo: code execution vulns in virus scanner https://bugs.chromium.org/p/project-zero/issues/detail?id=769 https://bugs.chromium.org/p/project-zero/issues/detail?id=76... and installs an insecure web browser and sets it as the default https://bugs.chromium.org/p/project-zero/issues/detail?id=704 https://bugs.chromium.org/p/project-zero/issues/detail?id=70... Avast: remote code execution in network traffic filter https://bugs.chromium.org/p/project-zero/issues/detail?id=546 https://bugs.chromium.org/p/project-zero/issues/detail?id=54... AVG: installs Chrome extension that leaks your browsing history to anyone who cares to read it https://www.theregister.co.uk/2015/12/29/avg_google_chrome_extension/ https://www.theregister.co.uk/2015/12/29/avg_google_chrome_e... TrendMicro: remote file access with SYSTEM privilege https://bugs.chromium.org/p/project-zero/issues/detail?id=775 https://bugs.chromium.org/p/project-zero/issues/detail?id=77... Kaspersky: a diverse range vulnerabilities over the years, ranging from remote root vulns (https://googleprojectzero.blogspot.com/2015/09/kaspersky-mo-unpackers-mo-problems.html https://googleprojectzero.blogspot.com/2015/09/kaspersky-mo-...) to "merely" making all SSL traffic man-in-the-middleable (https://bugs.chromium.org/p/project-zero/issues/detail?id=978 https://bugs.chromium.org/p/project-zero/issues/detail?id=97...) Etc, etc.

frik 9y ago

As mpengine will unpack arbitrarily deeply nested archives and supports many obscure and esoteric archive formats (such as Amiga ZOO and MagicISO UIF), there is no practical way to identify an exploit at the network level, and administrators should patch as soon as is practically possible. WTF Archive bomb anyone? This isn't a new concept, right? Doing IO intensive work, e.g. build large code base, I always have to deactivate the real time monitor - it slows down the whole process, or worded differently: turning off mpengine almost half's the build time. Reading more and more horror stories about its inner workings and design, it's time to get rid of it for good.

_pmf_ 9y ago

> I'm sure they had a reason There's too much going on to blame this on stupidity. This has to be intentional.

deleted 9y ago
[deleted]

codedokode 9y ago

They are evaluating the code in a sandbox to see what it is going to do - for example, is it going to download and run some payload or maybe add itself to autorun registry section. Many antiviruses do the same to discover obfuscated malicious programs.

deleted 9y ago
[deleted]
AnimalMuppet 9y ago
No. They are evaluating the code not in a sandbox to see what it is going to do. As System. Evaluating it in a sandbox, not as System, would be a reasonable attempt at security. What they are doing is insane.