3 ms·

>Upon investigation, researchers found a driver containing components that run with ring-0 privileges in the kernel. >"We traced the anomalous behaviour to a d

>Upon investigation, researchers found a driver containing components that run with ring-0 privileges in the kernel. >"We traced the anomalous behaviour to a device management driver developed by Huawei," researchers said in the post. "Digging deeper, we found a lapse in the design that led to a vulnerability that could allow local privilege escalation." >Researchers who reported the vulnerability to Huawei said the company responded and cooperated quickly and professionally. A patch was released earlier this year on 19 January. A rather clickbait-y title for what actually happened. Of course though, rehashed old news is great for harvesting karma when it's the right bogeyman.

ChuckMcM 8y ago
Karma aspersions aside :-) It does sound like "manufacturer driver has an exploit", gets reported, exploit gets fixed. Wrapped around a completely different narrative where an intelligence service 'diverts' a delivery and installs an exploit. Reminding us once again that as far as has been documented in the open media the US is the only country that has been identified as having done this. Sadly this is Tony Morbin's modus operandi.[1] That said, two nice takeaways, one the standard tools that Microsoft shipts found a problem, and the vendor quickly patched it. Both of those things are good news. [1] https://www.scmagazine.com/author/tony-morbin/ https://www.scmagazine.com/author/tony-morbin/
djsumdog 8y ago
I wonder what the lapse in design was. It'd be nice of Huawei disclosed what type of security vulnerability it was and how they fixed it.
- monocasa 8y ago
  Microsoft has a good write up on the flaw at least. https://www.microsoft.com/security/blog/2019/03/25/from-alert-to-driver-vulnerability-microsoft-defender-atp-investigation-unearths-privilege-escalation-flaw/ https://www.microsoft.com/security/blog/2019/03/25/from-aler...
- criddell 8y ago
  Maybe they named the key _NSAKEY which created a namespace collision with a totally non-NSA key that Microsoft added years ago. Just in case you hadn't already seen this: https://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY
  - zigzaggy 8y ago
    Thanks for this new information. It’s especially hilarious that Mr. Campbell was accused of being a conspiracy theorist for thinking _NSAKEY would be exactly what it sounds like. Even better, it turns out the key WAS for the NSA (!) “because the NSA is the technical review authority for U.S. export controls.” How convenient. Sorry I’m not buying it. I worked in .gov contracting long enough to smell a cover story.
    - ryanlol 8y ago
      Well then, get your disassembler out and find the evidence of this backdoor nobody else has managed to find in the past two decades. The whole NSAKEY story is a laughable fabrication, nobody has ever described the mechanism by which the backdoor is supposed to work. This should be a trivial exercise.
deleted 8y ago
[deleted]
colechristensen 8y ago
Backdoors don't have to be, let's call it explicit. A good way to inject a backdoor is to discourage the fixing of poorly designed drivers. I'm certain the NSA has a vast collection of vulnerabilities they exploit to do their work, who would be surprised if they didn't at least once try to discourage the fixing of one of those bugs.

ChuckMcM 8y ago

Karma aspersions aside :-) It does sound like "manufacturer driver has an exploit", gets reported, exploit gets fixed. Wrapped around a completely different narrative where an intelligence service 'diverts' a delivery and installs an exploit. Reminding us once again that as far as has been documented in the open media the US is the only country that has been identified as having done this. Sadly this is Tony Morbin's modus operandi.[1] That said, two nice takeaways, one the standard tools that Microsoft shipts found a problem, and the vendor quickly patched it. Both of those things are good news. [1] https://www.scmagazine.com/author/tony-morbin/ https://www.scmagazine.com/author/tony-morbin/

djsumdog 8y ago

I wonder what the lapse in design was. It'd be nice of Huawei disclosed what type of security vulnerability it was and how they fixed it.

monocasa 8y ago
Microsoft has a good write up on the flaw at least. https://www.microsoft.com/security/blog/2019/03/25/from-alert-to-driver-vulnerability-microsoft-defender-atp-investigation-unearths-privilege-escalation-flaw/ https://www.microsoft.com/security/blog/2019/03/25/from-aler...
criddell 8y ago
Maybe they named the key _NSAKEY which created a namespace collision with a totally non-NSA key that Microsoft added years ago. Just in case you hadn't already seen this: https://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY
- zigzaggy 8y ago
  Thanks for this new information. It’s especially hilarious that Mr. Campbell was accused of being a conspiracy theorist for thinking _NSAKEY would be exactly what it sounds like. Even better, it turns out the key WAS for the NSA (!) “because the NSA is the technical review authority for U.S. export controls.” How convenient. Sorry I’m not buying it. I worked in .gov contracting long enough to smell a cover story.
  - ryanlol 8y ago
    Well then, get your disassembler out and find the evidence of this backdoor nobody else has managed to find in the past two decades. The whole NSAKEY story is a laughable fabrication, nobody has ever described the mechanism by which the backdoor is supposed to work. This should be a trivial exercise.

deleted 8y ago

[deleted]

colechristensen 8y ago

Backdoors don't have to be, let's call it explicit. A good way to inject a backdoor is to discourage the fixing of poorly designed drivers. I'm certain the NSA has a vast collection of vulnerabilities they exploit to do their work, who would be surprised if they didn't at least once try to discourage the fixing of one of those bugs.