3 ms·
This is the biggest problem with attribution in network security. If Huawei wanted to do this the smart way they would implement a backdoor that's VERY tough t
by burtonator 8y ago
This is the biggest problem with attribution in network security.
If Huawei wanted to do this the smart way they would implement a backdoor that's VERY tough to find but could also be justified by stupidity.
This way they have plausible deniability.
"We're not malicious. We just screwed up!"
- ryanlol 8y agoWhy would anyone malicious bother hiding a LPE vulnerability in a driver like this? What's the point if you're going to need another backdoor to actually get code exec in order to exploit this backdoor?
- kosievdmerwe 8y agoBecause deniability is valuable in international relations? If a government can't prove something they aren't forced to act. If it was obvious the Chinese government did this, then other world governments would have to respond with sanctions and import bans.
- ryanlol 8y agoWhy would anyone want a LPE backdoor like this? You would need another backdoor to achieve RCE in an order to make use of your silly LPE backdoor.
- monocasa 8y agoI personally of the opinion that this is just a bug, and not an intentional bug That being said, there is value in a LPE as a part of a bigger exploit chain. There's all sorts of exploits that'll give you relatively unprivileged code execution, and you'd want to silently elevate in order to make yourself persistent for instance.
- ryanlol 8y agoWindows LPE bugs tend to be quite cheap and plentiful, I just can't see much value in inserting a bug like this to possibly make it slightly cheaper on a few specific machines.
- monocasa 8y agoWindows LPEs are still up to $80k on zerodium, instead of the up to $50k for Linux, Mac, and BSD. Yes those numbers are funny money, and you're more likely to see a third of that, but they're still useful numbers in a relative sense. Like I said, I think this is just a bug, but Windows LPEs do have value.
- anon4242 8y agoYou can build a complete pwn exploit by chaining several seemingly innocuous (more or less) vulnerabilities together just so. This vuln provides the escalation, another provides the remote execution... Then when someone says: "Huawei pwns us", they can just claim ignorance and stupidity because a small mistake here and there provides better deniability than some whitehat finding out that Huawei provides the Chinese government with the whole set of keys to the kingdom.