11 ms·

Down the Rabbit-Hole

430 points by janvdberg 7y ago

Aissen 7y ago
It looks like it's yet another missed deadline for Microsoft ? https://bugs.chromium.org/p/project-zero/issues/detail?id=1859 https://bugs.chromium.org/p/project-zero/issues/detail?id=18... Edit: it's unclear: https://twitter.com/taviso/status/1161297483139407873 https://twitter.com/taviso/status/1161297483139407873 I'm not surprised, seeing how deep this reaches and the scope of the issues. And the toolset Tavis used is also released (linked in the blog): https://github.com/taviso/ctftool https://github.com/taviso/ctftool
- londons_explore 7y ago
  To be honest, this looks 'broken by design' - it'll probably only get fixed in new versions of windows. Old versions will get 'fixes' which simply patch the specific flaws found, but there will be always more to find in a complex legacy protocol like this.
  - SmileyRedBall 7y ago
    > there will be always more to find in a complex legacy protocol like this .. Wouldn't it be simpler to drop in a CTF replacement unless the ability to read/write to any window, from any other session is generic to Windows.
    - LeonidasXIV 7y ago
      Wouldn't that completely break all IMEs? I doubt people in Japan, Korea or Taiwan would enjoy not being able to write their language for potentially a very long time.
  - mushufasa 7y ago
    I can't even imagine how they could fix this, even in a new version of windows. It seems so fundamental that any fix would break backwards compatibility, which is one of their core values.
    - repolfx 7y ago
      No, I don't think so. The protocol in question is entirely internal. They could rip it out and replace it with something totally different, apps shouldn't notice. The CTF server can also be made to validate its inputs much better, again, no compat impact. This is another case where Google seems to just take delight in screwing Microsoft and its users here. The 90 day deadline is meant for vendors who don't take security seriously, but Microsoft do. I'm not sure what is gained by releasing this before it's fixed.
      - shkkmo 7y ago
        > The 90 day deadline is meant for vendors who don't take security seriously, but Microsoft do. Microsoft dropped the ball for the first 75 days. > I hope you agree that I adequately communicated this attack to you, it seems like some wires got crossed at Microsoft and it didn't get clearly passed along to the engineering team. We're at day 75 now, I think the solutions I can think of for this attack would require a lot of compat testing with IMEs, so I'm hoping you can expedite this now that we're all on the same page.[1] [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=1859#c17 https://bugs.chromium.org/p/project-zero/issues/detail?id=18... edit: For clarity, the context of my quote is talking specifically about the session attack, not all issues raised.
        repolfx 7y ago
        Yes, large companies sometimes screw up. The project zero policy on this is wrong and downvotes won't change my mind on that. You know perfectly well that MS will fix it once the right people are in the case, the 90 day "deadline" with working exploit just risks another EternalBlue type situation where the exploit gets used in real attacks and causes real damage, for what?
        Aissen 7y ago
        > You know perfectly well that MS will fix it once the right people are in the case, No, we don't know that. Companies that were deemed serious have been caught dragging and taking their time with no proof of progress whatsoever (just like in this case?). And think of the message it would send to other (supposedly non-serious) companies: "you've given more time to MS, why not me ? It's only fair". Just like democracy, the P0 policy is the worst form of disclosure, except for all the others. Also, please don't conflate this with EternalBlue, there's no remote component here.
- zawerf 7y ago
  I find the culture around 90-day disclosure deadline fascinating. Is it actually reasonable to disclose this just for missing the deadline given that it has already been exploitable for twenty years? I know nothing about security but I just feel so bad for people who have to scramble to fix this legacy system which they probably had nothing to do with. I don't think I have ever seen a good secure system understood, redesigned and reimplemented in less than a quarter. The exploit author himself seems to have spent months on this without coming up with a fix either.
  - dooglius 7y ago
    It is very fortunate that it wasn't a zero-day then! I'm not sure if it was a "scramble" since it sounds like from the ticket it was ignored until the deadline got close... although it would be interesting to see the activity on Microsoft's internal bug tracker.
  - gwern 7y ago
    First, you need a hard bright line as a norm. It's the only thing a corporation will understand, and you can see how often they try to abuse or delay it anyway. Disclosing after the deadline is the only thing that gives the deadlines urgency and means that things which are urgent also get handled quickly. If there isn't a working process for handling as serious a vulnerability as this within 90 days, then there probably isn't a working process for handling serious but time-sensitive vulnerabilities within 90 days either. Use it or lose it. Second, these things are a lot more correlated than you think. Look at Spectre recently: those bugs have been in there in various ways for what, 20+ years? Yet something like 3 different research groups all came across variants of it simultaneously. There are pervasive correlations leading to https://en.wikipedia.org/wiki/Multiple_discovery https://en.wikipedia.org/wiki/Multiple_discovery - people use similar tools like fuzzers, they follow similar research topics and gossip, certain things become 'obvious' to everyone simultaneously, and so on. OP might not think that anyone else is working along similar lines, but how could they know that? How should anyone interested in Spectre have known that there were (at least) that many other groups finding similar problems?
- SethTro 7y ago
  > "Perhaps that means they're supremely confident they completely understand all facets of the issue and have an airtight solution, and were just flexing by wasting the first 30 days of their embargo." https://bugs.chromium.org/p/project-zero/issues/detail?id=1859#c10 https://bugs.chromium.org/p/project-zero/issues/detail?id=18...
lisper 7y ago
Clickbait title. Should be: tracking down an obscure Windows security hole.
- ucaetano 7y ago
  It is a blog post...
- saagarjha 7y ago
  The original title is what the submitter should have used and should not be the title that the moderators should change it to.
- xtiansimon 7y ago
  Totally. Un-clickbaity. Title. It’s meaningless. I saw the url and was curious.
zamalek 7y ago
> (GitHub) There are some requirements for this attack to work, as far as I'm aware it will only work if you have a display language installed that uses an OoP TIP There is an IME installed on every Windows 10 installation for at least a year: the emoji IME. You hit WIN + . to invoke it. I'm not sure if it's a OoP TIP.
SmileyRedBall 7y ago
2002 is calling and wants it's shatter attack back. “Shatter Attacks - How to break Windows.” https://web.archive.org/web/20060904080018/http://security.tombom.co.uk/shatter.html https://web.archive.org/web/20060904080018/http://security.t...
- deckar01 7y ago
  That exploit seems limited to applications that are designed to execute arbitrary commands based on user input (consoles). This exploit goes a step further and finds vulnerabilities in the CTF protocol's implementation so that any process's privileges can be hijacked to run arbitrary code.
  - temac 7y ago
    IIRC shatter attack was exploiting a badly designed general purpose window message protocol that by design quasi-directly allowed arbitrary code execution (especially at the time, with no mitigation). This one is way more indirect and goes through obscure and less reviewed channels, but the end result is kind of the same, even worse; because the integrity level was supposed to fix that mess, except MS was not lying when they said that this was not a security boundary... only they did explain the full picture properly explain so that we could understand that UAC is this much worthless -- lots of people thought of it as reasonable enough when set on Always notify, turns out it seems just plainly broken -- and because there seems to be no proper design comprehensively focused on that topic, it is very possible that there are other avenues to achieve the same result. I think I now understand way better why they want so much (and have started since some years) to leverage virtualization for security purposes: it seems impossible for them to evolve their historical crappy design to something sound (without breaking all kind of crazy 3rd party applications) otherwise.
vardump 7y ago
Crazy. So any process can use MSCTF (Text Services Framework) to elevate itself into NT AUTHORITY\SYSTEM through UAC prompts or logon screen, because Microsoft forgot to implement access control! I wonder whether this can also be used to escape sandboxes, but don't have time right now to analyze that. If so, this will be even more dangerous. Edit: Yup, can be used for sandbox (AppContainer) escapes. The blog post mentions it, just didn't notice at first scan. While I respect Google's security team's 90 day vendor response policy in general, I think it is too reckless in this case. This can too easily escalate previous "harmless" contained sandbox compromises into full system wide ones. A lot of people are potentially now on the harm's way.
- excalibur 7y ago
  Agreed. This isn't a simple patch, and will require significant re-engineering of a critical Windows component. 90 days is entirely unreasonable in this case. Releasing his ctftool was particularly reckless, this is privilege escalation in a bottle.
  - techntoke 7y ago
    Reckless by Microsoft or the researcher? Cause we don't know who has been exploiting this already and by providing the tool adds pressure on Microsoft to expedite this and helps people that may have already been effected have some insight into how they were compromised.
    - vardump 7y ago
      Perhaps the pressure could have been applied privately. Like researcher gaining access to achieved milestones. As long as Microsoft's progress would have been reasonable, no release. This issue is very time consuming to fix and very easy to exploit, and it affects a large number of people, directly and indirectly. A full system compromise from unprivileged process or sandbox. Even if you don't personally use Windows, this might for example be used to compromise your data processed somewhere else. I completely agree there needs to be very strong pressure on the vendors, and 90 day response is a very effective tool at that. But there should be some kind of alternative way to apply pressure on the vendor in cases that take a long time to fix and cause devastating collateral damage. Any script kiddie can now start to use this in hours or days.
deleted 7y ago
[deleted]
jmartinpetersen 7y ago
"I decided it would be worth it to spend a couple of weeks reverse engineering CTF to understand the security properties." Just, wow, that he gets to spend a couple of weeks on stuff like that.
- dooglius 7y ago
  Well, it is his job
- PeCaN 7y ago
  As someone who occasionally reverse engineers things for fun, the fact that he managed to completely RE the whole thing to such a high level of detail in only a couple weeks is mind boggling.
  - mkl 7y ago
    I think that was his initial idea, but he kept going when he found stuff. From later in the article: "This was a bigger job than I had anticipated, and after a few weeks [...]".
saagarjha 7y ago
> the kernel is creating a new window on behalf of a process > The kernel forces applications to connect to the ctfmon service when they start > the kernel invokes a callback > the kernel still forces AppContainer processes to join the ctf session I know next-to-nothing about Windows's architecture, but why does the kernel do all of these things? Seems like something a more purpose-built process should do? (Aside: my browser does not allow for loading Consolas, and the code snippets don't have a fallback to monospace so they render in a serif font. It'd be nice if they didn't do this.)
- repolfx 7y ago
  It's called Windows for a reason ;) Even in Windows 10, the Windows kernel does a LOT of stuff that's GUI centric. Indeed the entire Windows API is totally GUI centric. The fundamental IPC primitive is window messages, which is a microkernel-esque very fast inter-thread/process context switch tool. Like in seL4 or similar you get to send two numbers this way and not more, and it's optimised heavily. Other IPC systems you'd expect to be GUI independent like DCOM end up using this under the hood. It used to be that the entire GUI subsystem ran in kernel mode, because context switching was very slow and it made a big difference. In Vista+ large parts of it moved out into a separate privileged process, but the kernel is still involved in IPC, I believe. So when Tavis says "the kernel is creating a new window on behalf of the process" that's not quite correct, I think. Various subsystems get involved in creating windows and mostly not running in kernel mode anymore.
  - kyberias 7y ago
    > Indeed the entire Windows API is totally GUI centric. I think this is fundamentally incorrect. Windows certainly allows processes and threads to exist with no GUI. The process doesn't need to have message loop, etc. I suggest you check your other facts as well. Windows Internals is a good book to start.
    - temac 7y ago
      You are technically correct about processes not absolutely needing to use graphical resources. But the whole thing is nevertheless backed in and coupled with low layers, including the kernel. There is just a kind of lazy init of GDI resources and the like so that the init is skipped for those processes which don't use them ever. It is fundamentally different from a general purpose OS like Linux which does not care that much (or even at all? I haven't checked) about graphic shits for processes.
typeformer 7y ago
Thank you team Project Zero, certainly my favorite team inside Google.
lowdose 7y ago
Google just buried Windows. Google came in with what seemed to be a spectacular bouquet of flowers, but left a cactus in MS rear end. This is how Taviso 63 days earlier was being treated by Microsoft. > They called me and told me my career would be destroyed. In one particularly memorable call they told me that their PR and legal department only had two settings, "off and destroy" and (in a rather menacing tone) that they would "air my dirty laundry in public". https://news.ycombinator.com/item?id=20171450 https://news.ycombinator.com/item?id=20171450 This is such an Easter Egg they should send some Bunny suits to those clowns at Microsoft HQ.
- bbernoulli 7y ago
  Maybe I misunderstand your comment, but @taviso was recalling a story that seems to be from 2010.
  - lowdose 7y ago
    Sounds like the ultimate payback for behavior in 2010 which violated all code of ethics.
- dooglius 7y ago
  In other words, Microsoft literally committed a federal crime (extortion presumably across state lines)? A shame the police did not get involved.
dirtylowprofile 7y ago
Any response from Microsoft?

430 points by janvdberg 7y ago

It looks like it's yet another missed deadline for Microsoft ? https://bugs.chromium.org/p/project-zero/issues/detail?id=1859 https://bugs.chromium.org/p/project-zero/issues/detail?id=18... Edit: it's unclear: https://twitter.com/taviso/status/1161297483139407873 https://twitter.com/taviso/status/1161297483139407873 I'm not surprised, seeing how deep this reaches and the scope of the issues. And the toolset Tavis used is also released (linked in the blog): https://github.com/taviso/ctftool https://github.com/taviso/ctftool

londons_explore 7y ago
To be honest, this looks 'broken by design' - it'll probably only get fixed in new versions of windows. Old versions will get 'fixes' which simply patch the specific flaws found, but there will be always more to find in a complex legacy protocol like this.
- SmileyRedBall 7y ago
  > there will be always more to find in a complex legacy protocol like this .. Wouldn't it be simpler to drop in a CTF replacement unless the ability to read/write to any window, from any other session is generic to Windows.
  - LeonidasXIV 7y ago
    Wouldn't that completely break all IMEs? I doubt people in Japan, Korea or Taiwan would enjoy not being able to write their language for potentially a very long time.
- mushufasa 7y ago
  I can't even imagine how they could fix this, even in a new version of windows. It seems so fundamental that any fix would break backwards compatibility, which is one of their core values.
  - repolfx 7y ago
    No, I don't think so. The protocol in question is entirely internal. They could rip it out and replace it with something totally different, apps shouldn't notice. The CTF server can also be made to validate its inputs much better, again, no compat impact. This is another case where Google seems to just take delight in screwing Microsoft and its users here. The 90 day deadline is meant for vendors who don't take security seriously, but Microsoft do. I'm not sure what is gained by releasing this before it's fixed.
    - shkkmo 7y ago
      > The 90 day deadline is meant for vendors who don't take security seriously, but Microsoft do. Microsoft dropped the ball for the first 75 days. > I hope you agree that I adequately communicated this attack to you, it seems like some wires got crossed at Microsoft and it didn't get clearly passed along to the engineering team. We're at day 75 now, I think the solutions I can think of for this attack would require a lot of compat testing with IMEs, so I'm hoping you can expedite this now that we're all on the same page.[1] [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=1859#c17 https://bugs.chromium.org/p/project-zero/issues/detail?id=18... edit: For clarity, the context of my quote is talking specifically about the session attack, not all issues raised.
      - repolfx 7y ago
        Yes, large companies sometimes screw up. The project zero policy on this is wrong and downvotes won't change my mind on that. You know perfectly well that MS will fix it once the right people are in the case, the 90 day "deadline" with working exploit just risks another EternalBlue type situation where the exploit gets used in real attacks and causes real damage, for what?
        Aissen 7y ago
        > You know perfectly well that MS will fix it once the right people are in the case, No, we don't know that. Companies that were deemed serious have been caught dragging and taking their time with no proof of progress whatsoever (just like in this case?). And think of the message it would send to other (supposedly non-serious) companies: "you've given more time to MS, why not me ? It's only fair". Just like democracy, the P0 policy is the worst form of disclosure, except for all the others. Also, please don't conflate this with EternalBlue, there's no remote component here.
zawerf 7y ago
I find the culture around 90-day disclosure deadline fascinating. Is it actually reasonable to disclose this just for missing the deadline given that it has already been exploitable for twenty years? I know nothing about security but I just feel so bad for people who have to scramble to fix this legacy system which they probably had nothing to do with. I don't think I have ever seen a good secure system understood, redesigned and reimplemented in less than a quarter. The exploit author himself seems to have spent months on this without coming up with a fix either.
- dooglius 7y ago
  It is very fortunate that it wasn't a zero-day then! I'm not sure if it was a "scramble" since it sounds like from the ticket it was ignored until the deadline got close... although it would be interesting to see the activity on Microsoft's internal bug tracker.
- gwern 7y ago
  First, you need a hard bright line as a norm. It's the only thing a corporation will understand, and you can see how often they try to abuse or delay it anyway. Disclosing after the deadline is the only thing that gives the deadlines urgency and means that things which are urgent also get handled quickly. If there isn't a working process for handling as serious a vulnerability as this within 90 days, then there probably isn't a working process for handling serious but time-sensitive vulnerabilities within 90 days either. Use it or lose it. Second, these things are a lot more correlated than you think. Look at Spectre recently: those bugs have been in there in various ways for what, 20+ years? Yet something like 3 different research groups all came across variants of it simultaneously. There are pervasive correlations leading to https://en.wikipedia.org/wiki/Multiple_discovery https://en.wikipedia.org/wiki/Multiple_discovery - people use similar tools like fuzzers, they follow similar research topics and gossip, certain things become 'obvious' to everyone simultaneously, and so on. OP might not think that anyone else is working along similar lines, but how could they know that? How should anyone interested in Spectre have known that there were (at least) that many other groups finding similar problems?
SethTro 7y ago
> "Perhaps that means they're supremely confident they completely understand all facets of the issue and have an airtight solution, and were just flexing by wasting the first 30 days of their embargo." https://bugs.chromium.org/p/project-zero/issues/detail?id=1859#c10 https://bugs.chromium.org/p/project-zero/issues/detail?id=18...

lisper 7y ago

Clickbait title. Should be: tracking down an obscure Windows security hole.

ucaetano 7y ago
It is a blog post...
saagarjha 7y ago
The original title is what the submitter should have used and should not be the title that the moderators should change it to.
xtiansimon 7y ago
Totally. Un-clickbaity. Title. It’s meaningless. I saw the url and was curious.

zamalek 7y ago

> (GitHub) There are some requirements for this attack to work, as far as I'm aware it will only work if you have a display language installed that uses an OoP TIP There is an IME installed on every Windows 10 installation for at least a year: the emoji IME. You hit WIN + . to invoke it. I'm not sure if it's a OoP TIP.

SmileyRedBall 7y ago

2002 is calling and wants it's shatter attack back. “Shatter Attacks - How to break Windows.” https://web.archive.org/web/20060904080018/http://security.tombom.co.uk/shatter.html https://web.archive.org/web/20060904080018/http://security.t...

deckar01 7y ago
That exploit seems limited to applications that are designed to execute arbitrary commands based on user input (consoles). This exploit goes a step further and finds vulnerabilities in the CTF protocol's implementation so that any process's privileges can be hijacked to run arbitrary code.
- temac 7y ago
  IIRC shatter attack was exploiting a badly designed general purpose window message protocol that by design quasi-directly allowed arbitrary code execution (especially at the time, with no mitigation). This one is way more indirect and goes through obscure and less reviewed channels, but the end result is kind of the same, even worse; because the integrity level was supposed to fix that mess, except MS was not lying when they said that this was not a security boundary... only they did explain the full picture properly explain so that we could understand that UAC is this much worthless -- lots of people thought of it as reasonable enough when set on Always notify, turns out it seems just plainly broken -- and because there seems to be no proper design comprehensively focused on that topic, it is very possible that there are other avenues to achieve the same result. I think I now understand way better why they want so much (and have started since some years) to leverage virtualization for security purposes: it seems impossible for them to evolve their historical crappy design to something sound (without breaking all kind of crazy 3rd party applications) otherwise.

vardump 7y ago

Crazy. So any process can use MSCTF (Text Services Framework) to elevate itself into NT AUTHORITY\SYSTEM through UAC prompts or logon screen, because Microsoft forgot to implement access control! I wonder whether this can also be used to escape sandboxes, but don't have time right now to analyze that. If so, this will be even more dangerous. Edit: Yup, can be used for sandbox (AppContainer) escapes. The blog post mentions it, just didn't notice at first scan. While I respect Google's security team's 90 day vendor response policy in general, I think it is too reckless in this case. This can too easily escalate previous "harmless" contained sandbox compromises into full system wide ones. A lot of people are potentially now on the harm's way.

excalibur 7y ago
Agreed. This isn't a simple patch, and will require significant re-engineering of a critical Windows component. 90 days is entirely unreasonable in this case. Releasing his ctftool was particularly reckless, this is privilege escalation in a bottle.
- techntoke 7y ago
  Reckless by Microsoft or the researcher? Cause we don't know who has been exploiting this already and by providing the tool adds pressure on Microsoft to expedite this and helps people that may have already been effected have some insight into how they were compromised.
  - vardump 7y ago
    Perhaps the pressure could have been applied privately. Like researcher gaining access to achieved milestones. As long as Microsoft's progress would have been reasonable, no release. This issue is very time consuming to fix and very easy to exploit, and it affects a large number of people, directly and indirectly. A full system compromise from unprivileged process or sandbox. Even if you don't personally use Windows, this might for example be used to compromise your data processed somewhere else. I completely agree there needs to be very strong pressure on the vendors, and 90 day response is a very effective tool at that. But there should be some kind of alternative way to apply pressure on the vendor in cases that take a long time to fix and cause devastating collateral damage. Any script kiddie can now start to use this in hours or days.

deleted 7y ago

[deleted]

jmartinpetersen 7y ago

"I decided it would be worth it to spend a couple of weeks reverse engineering CTF to understand the security properties." Just, wow, that he gets to spend a couple of weeks on stuff like that.

dooglius 7y ago
Well, it is his job
PeCaN 7y ago
As someone who occasionally reverse engineers things for fun, the fact that he managed to completely RE the whole thing to such a high level of detail in only a couple weeks is mind boggling.
- mkl 7y ago
  I think that was his initial idea, but he kept going when he found stuff. From later in the article: "This was a bigger job than I had anticipated, and after a few weeks [...]".

saagarjha 7y ago

> the kernel is creating a new window on behalf of a process > The kernel forces applications to connect to the ctfmon service when they start > the kernel invokes a callback > the kernel still forces AppContainer processes to join the ctf session I know next-to-nothing about Windows's architecture, but why does the kernel do all of these things? Seems like something a more purpose-built process should do? (Aside: my browser does not allow for loading Consolas, and the code snippets don't have a fallback to monospace so they render in a serif font. It'd be nice if they didn't do this.)

repolfx 7y ago
It's called Windows for a reason ;) Even in Windows 10, the Windows kernel does a LOT of stuff that's GUI centric. Indeed the entire Windows API is totally GUI centric. The fundamental IPC primitive is window messages, which is a microkernel-esque very fast inter-thread/process context switch tool. Like in seL4 or similar you get to send two numbers this way and not more, and it's optimised heavily. Other IPC systems you'd expect to be GUI independent like DCOM end up using this under the hood. It used to be that the entire GUI subsystem ran in kernel mode, because context switching was very slow and it made a big difference. In Vista+ large parts of it moved out into a separate privileged process, but the kernel is still involved in IPC, I believe. So when Tavis says "the kernel is creating a new window on behalf of the process" that's not quite correct, I think. Various subsystems get involved in creating windows and mostly not running in kernel mode anymore.
- kyberias 7y ago
  > Indeed the entire Windows API is totally GUI centric. I think this is fundamentally incorrect. Windows certainly allows processes and threads to exist with no GUI. The process doesn't need to have message loop, etc. I suggest you check your other facts as well. Windows Internals is a good book to start.
  - temac 7y ago
    You are technically correct about processes not absolutely needing to use graphical resources. But the whole thing is nevertheless backed in and coupled with low layers, including the kernel. There is just a kind of lazy init of GDI resources and the like so that the init is skipped for those processes which don't use them ever. It is fundamentally different from a general purpose OS like Linux which does not care that much (or even at all? I haven't checked) about graphic shits for processes.

typeformer 7y ago

Thank you team Project Zero, certainly my favorite team inside Google.

lowdose 7y ago

Google just buried Windows. Google came in with what seemed to be a spectacular bouquet of flowers, but left a cactus in MS rear end. This is how Taviso 63 days earlier was being treated by Microsoft. > They called me and told me my career would be destroyed. In one particularly memorable call they told me that their PR and legal department only had two settings, "off and destroy" and (in a rather menacing tone) that they would "air my dirty laundry in public". https://news.ycombinator.com/item?id=20171450 https://news.ycombinator.com/item?id=20171450 This is such an Easter Egg they should send some Bunny suits to those clowns at Microsoft HQ.

bbernoulli 7y ago
Maybe I misunderstand your comment, but @taviso was recalling a story that seems to be from 2010.
- lowdose 7y ago
  Sounds like the ultimate payback for behavior in 2010 which violated all code of ethics.
dooglius 7y ago
In other words, Microsoft literally committed a federal crime (extortion presumably across state lines)? A shame the police did not get involved.

dirtylowprofile 7y ago

Any response from Microsoft?