4 ms·

So, they didn't install and attempt to run any ransomware. I suspect they could have, but if the claim is that it "won't run," it seems you need to actually go

So, they didn't install and attempt to run any ransomware. I suspect they could have, but if the claim is that it "won't run," it seems you need to actually go ahead and try to run it.

AdmiralAsshat 9y ago
Not really. Most Proof of Concepts for Windows exploits merely launch something like calculator.exe as a placeholder, just to prove that malicious code could have run here. I think it's sufficient that if they could prove they achieved privileged code execution, it is safe to assume that ransomware could have run at that point unabated.
- bradford 9y ago
  Running calculator.exe isn't sufficient enough for the claims that are made in this article, since it's already in the 'trusted' domain of the OS. If they could get 'myPersonallyDevelopedExecutable.exe' to run, then the article would have a point, but the researcher stopped short of trying, so this article ends up being shitty journalism. [disclaimer, MS employee].
  - yifanlu 9y ago
    > Hickey created a malicious, macro-based Word document on his own computer that when opened would allow him to carry out a reflective DLL injection attack, allowing him to bypass the app store restrictions by injecting code into an existing, authorized process. That's enough to show that you could have run ransomware. Unsigned code execution under Word privileges (which presumably has write permissions to user documents) is enough to encrypt user documents. I think the point is that it's dishonest/irresponsible for Microsoft to advertise 10 S in this way. Even though technically they're not saying you can't get hacked by ransomware--anyone without technical knowledge can reasonably assume that's the case. The article showed that MS didn't really put too much work into adding extra security/mitigation. Just shutting down side loading isn't work proportional to what they advertise.
  - darklajid 9y ago
    As an MS employee: Is SYSTEM really restricted by the sandbox as well?
  - fatratchet 9y ago
    Why? They are already running their own unsigned DLL injected code that can do anything they want. Even if the OS wouldn't allow it to launch an unsigned .exe, any malware can just be shipped in that DLL as easily.
    - bradford 9y ago
      This is an argument against running word as an admin and then explicitly allowing macros to execute, it has little to do with breaking the app-containment, which is the claim made in the article.
    - deleted 9y ago
      [deleted]

So, they didn't install and attempt to run any ransomware. I suspect they could have, but if the claim is that it "won't run," it seems you need to actually go ahead and try to run it.

AdmiralAsshat 9y ago

Not really. Most Proof of Concepts for Windows exploits merely launch something like calculator.exe as a placeholder, just to prove that malicious code could have run here. I think it's sufficient that if they could prove they achieved privileged code execution, it is safe to assume that ransomware could have run at that point unabated.

bradford 9y ago
Running calculator.exe isn't sufficient enough for the claims that are made in this article, since it's already in the 'trusted' domain of the OS. If they could get 'myPersonallyDevelopedExecutable.exe' to run, then the article would have a point, but the researcher stopped short of trying, so this article ends up being shitty journalism. [disclaimer, MS employee].
- yifanlu 9y ago
  > Hickey created a malicious, macro-based Word document on his own computer that when opened would allow him to carry out a reflective DLL injection attack, allowing him to bypass the app store restrictions by injecting code into an existing, authorized process. That's enough to show that you could have run ransomware. Unsigned code execution under Word privileges (which presumably has write permissions to user documents) is enough to encrypt user documents. I think the point is that it's dishonest/irresponsible for Microsoft to advertise 10 S in this way. Even though technically they're not saying you can't get hacked by ransomware--anyone without technical knowledge can reasonably assume that's the case. The article showed that MS didn't really put too much work into adding extra security/mitigation. Just shutting down side loading isn't work proportional to what they advertise.
- darklajid 9y ago
  As an MS employee: Is SYSTEM really restricted by the sandbox as well?
- fatratchet 9y ago
  Why? They are already running their own unsigned DLL injected code that can do anything they want. Even if the OS wouldn't allow it to launch an unsigned .exe, any malware can just be shipped in that DLL as easily.
  - bradford 9y ago
    This is an argument against running word as an admin and then explicitly allowing macros to execute, it has little to do with breaking the app-containment, which is the claim made in the article.
  - deleted 9y ago
    [deleted]