5 ms·

It looks like it's yet another missed deadline for Microsoft ? https://bugs.chromium.org/p/project-zero/issues/detail?id=1859 https://bugs.chromium.org/p/proje

by Aissen 7y ago

It looks like it's yet another missed deadline for Microsoft ? https://bugs.chromium.org/p/project-zero/issues/detail?id=1859 https://bugs.chromium.org/p/project-zero/issues/detail?id=18... Edit: it's unclear: https://twitter.com/taviso/status/1161297483139407873 https://twitter.com/taviso/status/1161297483139407873 I'm not surprised, seeing how deep this reaches and the scope of the issues. And the toolset Tavis used is also released (linked in the blog): https://github.com/taviso/ctftool https://github.com/taviso/ctftool

londons_explore 7y ago
To be honest, this looks 'broken by design' - it'll probably only get fixed in new versions of windows. Old versions will get 'fixes' which simply patch the specific flaws found, but there will be always more to find in a complex legacy protocol like this.
- SmileyRedBall 7y ago
  > there will be always more to find in a complex legacy protocol like this .. Wouldn't it be simpler to drop in a CTF replacement unless the ability to read/write to any window, from any other session is generic to Windows.
  - LeonidasXIV 7y ago
    Wouldn't that completely break all IMEs? I doubt people in Japan, Korea or Taiwan would enjoy not being able to write their language for potentially a very long time.
- mushufasa 7y ago
  I can't even imagine how they could fix this, even in a new version of windows. It seems so fundamental that any fix would break backwards compatibility, which is one of their core values.
  - repolfx 7y ago
    No, I don't think so. The protocol in question is entirely internal. They could rip it out and replace it with something totally different, apps shouldn't notice. The CTF server can also be made to validate its inputs much better, again, no compat impact. This is another case where Google seems to just take delight in screwing Microsoft and its users here. The 90 day deadline is meant for vendors who don't take security seriously, but Microsoft do. I'm not sure what is gained by releasing this before it's fixed.
    - shkkmo 7y ago
      > The 90 day deadline is meant for vendors who don't take security seriously, but Microsoft do. Microsoft dropped the ball for the first 75 days. > I hope you agree that I adequately communicated this attack to you, it seems like some wires got crossed at Microsoft and it didn't get clearly passed along to the engineering team. We're at day 75 now, I think the solutions I can think of for this attack would require a lot of compat testing with IMEs, so I'm hoping you can expedite this now that we're all on the same page.[1] [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=1859#c17 https://bugs.chromium.org/p/project-zero/issues/detail?id=18... edit: For clarity, the context of my quote is talking specifically about the session attack, not all issues raised.
      - repolfx 7y ago
        Yes, large companies sometimes screw up. The project zero policy on this is wrong and downvotes won't change my mind on that. You know perfectly well that MS will fix it once the right people are in the case, the 90 day "deadline" with working exploit just risks another EternalBlue type situation where the exploit gets used in real attacks and causes real damage, for what?
        Aissen 7y ago
        > You know perfectly well that MS will fix it once the right people are in the case, No, we don't know that. Companies that were deemed serious have been caught dragging and taking their time with no proof of progress whatsoever (just like in this case?). And think of the message it would send to other (supposedly non-serious) companies: "you've given more time to MS, why not me ? It's only fair". Just like democracy, the P0 policy is the worst form of disclosure, except for all the others. Also, please don't conflate this with EternalBlue, there's no remote component here.
zawerf 7y ago
I find the culture around 90-day disclosure deadline fascinating. Is it actually reasonable to disclose this just for missing the deadline given that it has already been exploitable for twenty years? I know nothing about security but I just feel so bad for people who have to scramble to fix this legacy system which they probably had nothing to do with. I don't think I have ever seen a good secure system understood, redesigned and reimplemented in less than a quarter. The exploit author himself seems to have spent months on this without coming up with a fix either.
- dooglius 7y ago
  It is very fortunate that it wasn't a zero-day then! I'm not sure if it was a "scramble" since it sounds like from the ticket it was ignored until the deadline got close... although it would be interesting to see the activity on Microsoft's internal bug tracker.
- gwern 7y ago
  First, you need a hard bright line as a norm. It's the only thing a corporation will understand, and you can see how often they try to abuse or delay it anyway. Disclosing after the deadline is the only thing that gives the deadlines urgency and means that things which are urgent also get handled quickly. If there isn't a working process for handling as serious a vulnerability as this within 90 days, then there probably isn't a working process for handling serious but time-sensitive vulnerabilities within 90 days either. Use it or lose it. Second, these things are a lot more correlated than you think. Look at Spectre recently: those bugs have been in there in various ways for what, 20+ years? Yet something like 3 different research groups all came across variants of it simultaneously. There are pervasive correlations leading to https://en.wikipedia.org/wiki/Multiple_discovery https://en.wikipedia.org/wiki/Multiple_discovery - people use similar tools like fuzzers, they follow similar research topics and gossip, certain things become 'obvious' to everyone simultaneously, and so on. OP might not think that anyone else is working along similar lines, but how could they know that? How should anyone interested in Spectre have known that there were (at least) that many other groups finding similar problems?
SethTro 7y ago
> "Perhaps that means they're supremely confident they completely understand all facets of the issue and have an airtight solution, and were just flexing by wasting the first 30 days of their embargo." https://bugs.chromium.org/p/project-zero/issues/detail?id=1859#c10 https://bugs.chromium.org/p/project-zero/issues/detail?id=18...

by Aissen 7y ago

londons_explore 7y ago

To be honest, this looks 'broken by design' - it'll probably only get fixed in new versions of windows. Old versions will get 'fixes' which simply patch the specific flaws found, but there will be always more to find in a complex legacy protocol like this.

SmileyRedBall 7y ago
> there will be always more to find in a complex legacy protocol like this .. Wouldn't it be simpler to drop in a CTF replacement unless the ability to read/write to any window, from any other session is generic to Windows.
- LeonidasXIV 7y ago
  Wouldn't that completely break all IMEs? I doubt people in Japan, Korea or Taiwan would enjoy not being able to write their language for potentially a very long time.
mushufasa 7y ago
I can't even imagine how they could fix this, even in a new version of windows. It seems so fundamental that any fix would break backwards compatibility, which is one of their core values.
- repolfx 7y ago
  No, I don't think so. The protocol in question is entirely internal. They could rip it out and replace it with something totally different, apps shouldn't notice. The CTF server can also be made to validate its inputs much better, again, no compat impact. This is another case where Google seems to just take delight in screwing Microsoft and its users here. The 90 day deadline is meant for vendors who don't take security seriously, but Microsoft do. I'm not sure what is gained by releasing this before it's fixed.
  - shkkmo 7y ago
    > The 90 day deadline is meant for vendors who don't take security seriously, but Microsoft do. Microsoft dropped the ball for the first 75 days. > I hope you agree that I adequately communicated this attack to you, it seems like some wires got crossed at Microsoft and it didn't get clearly passed along to the engineering team. We're at day 75 now, I think the solutions I can think of for this attack would require a lot of compat testing with IMEs, so I'm hoping you can expedite this now that we're all on the same page.[1] [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=1859#c17 https://bugs.chromium.org/p/project-zero/issues/detail?id=18... edit: For clarity, the context of my quote is talking specifically about the session attack, not all issues raised.
    - repolfx 7y ago
      Yes, large companies sometimes screw up. The project zero policy on this is wrong and downvotes won't change my mind on that. You know perfectly well that MS will fix it once the right people are in the case, the 90 day "deadline" with working exploit just risks another EternalBlue type situation where the exploit gets used in real attacks and causes real damage, for what?
      - Aissen 7y ago
        > You know perfectly well that MS will fix it once the right people are in the case, No, we don't know that. Companies that were deemed serious have been caught dragging and taking their time with no proof of progress whatsoever (just like in this case?). And think of the message it would send to other (supposedly non-serious) companies: "you've given more time to MS, why not me ? It's only fair". Just like democracy, the P0 policy is the worst form of disclosure, except for all the others. Also, please don't conflate this with EternalBlue, there's no remote component here.

zawerf 7y ago

I find the culture around 90-day disclosure deadline fascinating. Is it actually reasonable to disclose this just for missing the deadline given that it has already been exploitable for twenty years? I know nothing about security but I just feel so bad for people who have to scramble to fix this legacy system which they probably had nothing to do with. I don't think I have ever seen a good secure system understood, redesigned and reimplemented in less than a quarter. The exploit author himself seems to have spent months on this without coming up with a fix either.

dooglius 7y ago
It is very fortunate that it wasn't a zero-day then! I'm not sure if it was a "scramble" since it sounds like from the ticket it was ignored until the deadline got close... although it would be interesting to see the activity on Microsoft's internal bug tracker.
gwern 7y ago
First, you need a hard bright line as a norm. It's the only thing a corporation will understand, and you can see how often they try to abuse or delay it anyway. Disclosing after the deadline is the only thing that gives the deadlines urgency and means that things which are urgent also get handled quickly. If there isn't a working process for handling as serious a vulnerability as this within 90 days, then there probably isn't a working process for handling serious but time-sensitive vulnerabilities within 90 days either. Use it or lose it. Second, these things are a lot more correlated than you think. Look at Spectre recently: those bugs have been in there in various ways for what, 20+ years? Yet something like 3 different research groups all came across variants of it simultaneously. There are pervasive correlations leading to https://en.wikipedia.org/wiki/Multiple_discovery https://en.wikipedia.org/wiki/Multiple_discovery - people use similar tools like fuzzers, they follow similar research topics and gossip, certain things become 'obvious' to everyone simultaneously, and so on. OP might not think that anyone else is working along similar lines, but how could they know that? How should anyone interested in Spectre have known that there were (at least) that many other groups finding similar problems?

SethTro 7y ago

> "Perhaps that means they're supremely confident they completely understand all facets of the issue and have an airtight solution, and were just flexing by wasting the first 30 days of their embargo." https://bugs.chromium.org/p/project-zero/issues/detail?id=1859#c10 https://bugs.chromium.org/p/project-zero/issues/detail?id=18...