6 ms·
There is no valid reason, ever, for a driver to do what the Huawei driver did here. That should be obvious given the detection methods that Microsoft implemente
by stefan_ 8y ago
There is no valid reason, ever, for a driver to do what the Huawei driver did here. That should be obvious given the detection methods that Microsoft implemented in the kernel to find and prevent just this behavior.
The Microsoft blog might stop short of calling it malware, but I think we don't need the faux politeness here. The fact that their malware also contained a privilege escalation (the "vulnerability") is merely icing on the cake.
- GalacticDomin8r 8y agoReally? Because MS and others have stated what Huawei did here isn't unheard of. This is simply news because it's Huawei and many want them to be guilty of backdooring US entities. Perhaps they are, but no more many other "respected" US companies.
- deogeo 8y agoTo be fair, doing things for which "There is no valid reason, ever" is not unheard of, especially in software.
- _cs2017_ 8y agoSince you make a very strong claim on a very complex topic, would you mind if I asked you to share whether you have expertise / credentials on drivers and security? Edit: I'm not sure if it's considered appropriate to ask for credentials on HN. There's one way to find out :)
- stefan_ 8y agoWhat is so complex about it? This is a very simple code injection technique ported to kernel space. Only, of course, there is essentially no use for code injection in any sort of production software.
- deleted 8y ago[deleted]
- rujuladanh 8y agoA driver allowing to map any page is like recording a magician from all angles. The only reasonable usage of such a situation is for the magician him/herself, to study his/her own performance. And even then, it is not usually done that way.
- monocasa 8y agoThere's a lot of situations where you map in trampolines to perform work inside a process on behalf of that process.
- rujuladanh 8y agoThe article is about a driver that allows to map any physical page.
- monocasa 8y agoThat majority isn't. And while there's better ways to handle it, and it wouldn't pass a design review of mine, it's pretty common to make a driver specific /dev/mem equivalent. For isntance https://forum.xda-developers.com/showthread.php?t=2057818 https://forum.xda-developers.com/showthread.php?t=2057818
- rujuladanh 8y agoI am not sure what you are trying to say. Any driver for a multiuser OS that essentially bypasses protection mechanisms by the kernel for non-root users is broken, period. There is no argument about it.
- monocasa 8y agoI mean, it's goofy, hacky, and has obvious security flaws but doesn't look malicious. Calling it a "backdoor" ascribes a certain intentionality to the vulnerability that's not clear is warranted. It's about the code quality I expect from the management shovelware that comes preloaded on laptops from any major brand. Source: I've written kernel drivers and exploits.
- noir_lord 8y agoOn the other hand a reliable backdoor that also looks like sloppy code is better, as most of us are familiar with truly awful code it’s a nice layer of plausible deniability. As the full saying goes. Never attribute to malice what can be explained by stupidity...but don’t rule out malice.
- monocasa 8y agoBy that logic we should be calling all vulnerabilities "backdoors" just in case.
- peteradio 8y agoPerhaps you should because the end result is the same, shit code sinks ships. Somebody could have written it intentionally or somebody could have been a dumbshit. Doesn't matter to me because now my computer is compromised.
- monocasa 8y agoI mean, the term 'backdoor' has a connotation of intentionality. Unless you write perfect code 100% of the time, you probably rely on the difference.
- bsder 8y agoFreetype buffer overflow leads to privilege escalataion. All code is security code.
- padiyar83 8y agoHanlon's razor - Never attribute to malice that which is adequately explained by stupidity.
- colordrops 8y agoHanlon's razor is used by the malicious to fool the stupid. While we are spouting aphorisms, here's another one: "never say never".
- geezerjay 8y agoHonest question: is it plausible that someone who is knowledgeable enough to understand and implement this exploit is also oblivious to ita exploitability?
- aw3c2 8y agoHell yes, device drivers and related tools are a cesspit of demon-worshipping excrements from outer space.