16 ms·
Windows 0day privilege escalation still not fixed
- zaltekk 6y ago> In May, Kaspersky (@oct0xor) discovered CVE-2020-0986 in Windows splwow64 was exploited itw as a 0day. Microsoft released a patch in June, but that patch didnt fix the vuln. After reporting that bad fix in Sept under a 90day deadline, it's still not fixed. https://twitter.com/maddiestone/status/1341781305126612995 https://twitter.com/maddiestone/status/1341781305126612995
- zaltekk 6y agoMore details on the original bug: https://securelist.com/operation-powerfall-cve-2020-0986-and-variants/98329/ https://securelist.com/operation-powerfall-cve-2020-0986-and...
- sedatk 6y ago> 2020-12-03 Microsoft advises that due to issues identified in testing, the fix will now slip to January 2021.
- app4soft 6y agoThis is a feature, not a bug.
- high_density 6y agojust wondering... is there any defense normies like me can do? eg. turn some windows feature off?
- andrewxdiamond 6y agoInstall a better OS
- colejohnson66 6y agoThat’s not a very helpful comment. Not everyone has a choice in what OS they use (especially if it’s at work)
- corty 6y agoAt work, when windows is corporate policy, you do not need to care about exploits. It is literally other peoples' problem.
- annoyingnoob 6y agoIts a problem for someone and knowing about any mitigation is helpful.
- corty 6y agoOK, yes, if you are the IT dept, you are on the hook. At least if you are the ones who picked windows. But maybe you didn't and strategically protested the directive to use windows that came from up above. Then again, you don't really have to care, not your problem...
- deleted 6y ago[deleted]
- colejohnson66 6y agoIt is your problem because IT’s job is to prevent this stuff from happening. It doesn’t matter if the order came down from above, you need to do what you can to mitigate damage.
- corty 6y agoThere is a world of difference between "job" (try to do it properly) and "responsibility" (you are on the hook if things go wrong). If the order came from above and you pointed out the problems, it might still be your job. But not your responsibility.
- willcipriano 6y agoPihole with the right block list can prevent known malicious software from hitting its command and control endpoints. They can always use DOH but you can block DOH domains via the pinhole as well.
- high_density 6y agoisn't PiHole some kind of external firewall? that works 90% of the average-joe known botnets against a desktop PC, but it's not helpful for laptops / unknown-control endpoints. (or endpoints that are really good at hiding)
- benglish11 6y agoPiHole is a network wide ad blocker that works at the DNS level. Basically you route all of your network's DNS requests through PiHole and it blocks any domains that are known ad/malware domains.
- david_perason 6y agoWhy would you not just modify your hosts file on your machine? Do you really need a raspberry pi for this?
- duckmysick 6y agoSometimes you don't have access to the hosts file, like on an unrooted phone or a smart TV.
- tinus_hn 6y agoNo, it’s a DNS server with blacklisting features. It can’t block traffic, it can only prevent some software from looking up addresses.
- dspillett 6y agoYou can use PiHole or one of the many equivalents on a laptop or other location shifting device in a few ways: 1. Run it locally and have it configured to use a public name server as its source (if you run Windows/other there are not doubt native options that'll work this way too). Even if the network you connect to redirects requests to public DNS resolvers you'll still be going through your local filter. Though you'll need to set your machine to ignore DNS config via DHCP, and you'll have to point it at the local resolvers if the network simply blocks public DNS servers. 2. Run it in a VM or container, this would mean you can run PiHole specifically even if you are running Windows, and configure as above. Memory requirements are pretty low so unless you are using very low spec device it should fit. 3. If you have a hosted server (you can get a VPS big enough for PiHole for a few $/year) or a publicly addressable address at home, you can run a VPN and access it that way (assuming the network you are on does not block your VPN of choice of course). You don't have to run a VPN, but I'd not recommend running a publicly addressable DNS server. This will even work on phones depending on the OS there and the chosen VPN. Of course these are not viable options for a lesser techie user.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- xeeeeeeeeeeenu 6y agoIt isn't exploitable remotely, so just don't run shady software.
- etiam 6y agoIt may seem pedantic, but since this vulnerability is publicly known since months back, and furthermore has been exploited in the wild (according to description in the target article), is it not per definition not a 0day.
- tinus_hn 6y agoNot if the definition is ‘a known security issue with no patch’
- qeternity 6y agoWhich it isn’t...
- FreshFries 6y agoWhich I thought was wrong, but even Wikipedia agrees with you: "A zero-day (also known as 0-day) vulnerability is a computer-software vulnerability that is unknown to those who should be interested in mitigating the vulnerability (including the vendor of the target software)." Personally I have always used it as "there is not mitigation / patch available". Thanks for pointing me in the proper direction. Edit: I am old and stubborn, I still use 'hacker' as a compliment.
- qeternity 6y agoIt seems that 0d has since become a synonym by some for unpatched exploit.
- Scuds 6y agoIt feels l33t to appropriate the terminology of a professional - like "We need to control the optics of the situation" "I flashed my cellphone but it failed and now it's bricked." but the unsophisticated public gets it wrong and now here we are, every recent unpatched exploit is now 0day
- 6y ago
- ffpip 6y agoWhat is the point of disclosing it if it is not fixed? I understand it is to put pressure and likeness, but doesn't it cause more harm than good? Windows is very popular.
- deleted 6y ago[deleted]
- theptip 6y agoThis is a foundational policy question in security research, and Project Zero gives a lot of detail on its aproach, e.g. https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-faq.html https://googleprojectzero.blogspot.com/p/vulnerability-discl... https://googleprojectzero.blogspot.com/2020/01/policy-and-disclosure-2020-edition.html https://googleprojectzero.blogspot.com/2020/01/policy-and-di...
- ffpip 6y agoThanks for sharing the links. I knew it was a policy, but never really looked more into it.
- gene91 6y agoIt is in the public's best interest to demand timely fix because you never really know whether bad actors know about it. A demand has no teeth, therefore you have to make a threat (fix in 90 days, or we disclose publicly). A threat is only good if you have a track record of delivering on it without exceptions. Therefore, it isn't an option to not disclose it at 90 days.
- albntomat0 6y agoA while ago, responsibly disclosed bugs took an extraordinarily long time to be patched. Disclosure deadlines ensure things are patched in a responsive manner. They only work though when the reporter actually follows through if the deadline is missed (and has standing & legal projection to execute like the Project Zero folks).
- TheDong 6y ago
- stefan_ 6y agoI'm dumbfounded why Microsoft can't fix this, it's essentially just a parameter validation issue. They must have some ghoulish software actually relying on the broken behavior. Add to that their recklessly incompetent initial fix: https://twitter.com/maddiestone/status/1341781306766573568 https://twitter.com/maddiestone/status/1341781306766573568
- q3k 6y agoI assume it's bigcorp slowness, having to roll up all updates into patch batches, following release schedules, testing against all release trains, going through QA, etc. No accelerated way to push critical, but trivial software fixes.
- Retric 6y agoMicrosoft has patched issues fairly quickly in the past. This may be a “critical” issue, but I think they have even higher internal classifications which this doesn’t qualify for.
- the8472 6y agoMS can and does issue out of schedule patches every now and then. This presumably doesn't meet the bar since it only is a local privesc.
- foepys 6y agoLast year they pushed some "simple" fixes fast and broke quite a few older VB applications. That was quite a fun day at my office when some customers couldn't work anymore...
- dmix 6y agoThis is interesting do you have more details you could share or point to a link?
- foepys 6y agohttps://www.zdnet.com/article/microsoft-these-windows-10-updates-fix-broken-visual-basic-apps-but-not-for-1903/ https://www.zdnet.com/article/microsoft-these-windows-10-upd... https://answers.microsoft.com/en-us/msoffice/forum/all/windows-update-2019-08-cumulative-update-has/baeea089-9bba-4a2a-9660-0a220f1656e9?page=2 https://answers.microsoft.com/en-us/msoffice/forum/all/windo...
- Jare 6y ago> 2020-12-03 Microsoft advises that due to issues identified in testing, the fix will now slip to January 2021. > 2020-12-08 Meeting between MSRC and Project Zero leadership to determine details and discuss next steps. The 14-day grace period is unavailable as Microsoft do not plan to patch this issue before Jan 6 (next patch Tuesday is Jan 12). > 2020-12-23 90 day deadline exceeded - derestricting issue. Ouch. With xmas in the middle the grace period, I could see how this can be considered too strict on P0's part. Then, again, the initial bad fix surely harmed whatever trust there was between the parties.
- hackcasual 6y agoIt's being actively exploited, so frankly a 14 day grace is the best MS can hope for
- corty 6y agoAny grace period for actively exploited bugs is irresponsible. Stuff that the bad guys use needs to be public asap.
- black3r 6y ago> The only difference between CVE-2020-0986 is that for CVE-2020-0986 the attacker sent a pointer and now the attacker sends an offset. CVE-2020-0986 had been discovered in the wild in May. Microsoft claimed to have fixed it, so this was logged as a separate CVE, even though it's essentially the same bug (the fix can be trivially circumvented) and P0 has given it a new 90 day period, which has now ran out. I wouldn't call it too strict, they had much more than 90 days to fix it properly.
- deleted 6y ago[deleted]
- geofft 6y agoNot being super familiar with Windows, is an escalation from "low privilege" to "medium privilege" actually concerning in practice? (e.g., this be used for something like breaking out of a Chrome sandbox?)
- gruez 6y agohttps://chromium.googlesource.com/chromium/src/+/master/docs/design/sandbox.md#The-integrity-levels https://chromium.googlesource.com/chromium/src/+/master/docs... >Integrity levels are available on Windows Vista and later versions. They don‘t define a security boundary in the strict sense, but they do provide a form of mandatory access control (MAC) and act as the basis of Microsoft’s Internet Explorer sandbox. And yes, chrome uses it as a sandbox.
- ChrisSD 6y agoTo be clear, Chrome uses it as part of a "defense-in-depth" strategy, but its sandbox does not rely on it. From your link: > So, the integrity level is a bit redundant with the other measures, but it can be seen as an additional degree of defense-in-depth, and its use has no visible impact on performance or resource usage.
- tonyedgecombe 6y agoThe print spooler runs under the local system account so you effectively get admin rights over the local machine. If it's a terminal server then you control the server. Not sure about Chrome though.
- ChrisSD 6y agoThis vulnerability is about `splwow64.exe`. It's started by the malware but explorer has it on a whitelist that automatically elevates it to medium integrity. It's not running as admin or system.
- tonyedgecombe 6y ago
- ta1272814 6y agoIssues like these, the massive hack of US government, etc. Taken together these things feel like the death knell of Wintel.
- deleted 6y ago[deleted]
- intricatedetail 6y agoThat's why I don't use Windows for work. It's not a system for professionals. As usual with Microsoft - smoke and mirrors and money is what matters the most.
- xyst 6y agoNow I can grant myself admin privileges on my work computer and remove all of the corporate shitware/spyware on it :)
- ChrisSD 6y agoThis allows you to go from low integrity to medium. So it's a sandbox escape. It won't give you admin if you don't already have it.
- tsjq 6y agohaven't got the approval to fix this from whichever agencies are benefiting by this .
- efitz 6y agoI think that it’s jackassery by Google project 0 folks to publish proof of concept code when Microsoft is clearly trying to fix the issue. It puts millions of people at risk. Microsoft issued a patch; it didn’t fully fix the problem, ergo let’s be asses.
- albntomat0 6y agoCheck out this discussion on that issue here: https://news.ycombinator.com/item?id=25520299 https://news.ycombinator.com/item?id=25520299
- ylyn 6y agoYou need to understand why this is done before calling it "jackassery".
- efitz 6y agoI understand exactly why they do it. And it’s jackassery. If Microsoft had not done anything then I’d fully support responsible disclosure. But Microsoft did issue a patch which did fix the originally reported issue. It’s not clear that the second exploit path was called out in the initial project zero report. IMHO the fact that the vendor is responsive and working on the issue means that publishing exploit code puts millions of users at additional risk with no tangible security benefit. And yes, I am a career IT security professional. Project Zero is a good idea in general; in this case disclosure was irresponsible IMO.
- albntomat0 6y agoThe report timeline was listed in the link, with this new variant being reported on September 23rd. Having disclosure deadlines is the only way to get away from companies taking literal years to provide patches, and the deadlines only matter if they're actually enforced.
- saagarjha 6y agoThe patch appears to have been fairly trivial to work around.
- ChrisSD 6y agoThere seems to be some confusion in the comments about the nature of this exploit. This exploit is a kind of sandbox escape. It allow a low integrity process to run code as a medium (aka normal) integrity process. The exploit runs `splwow64.exe` which explorer "helpfully" auto elevates to medium integrity. The exploit then tricks `splwow64.exe` into running arbitrary code. It does not grant admin privileges. In practice this vulnerability isn't that scary on its own. Sandboxes don't (or shouldn't) rely solely on this form of mandatory access control for their security. However this attack could be used as part of a chain of exploits in ored to escape a sandbox.
- yuhong 6y agoI believe splwow64.exe is used for printing from WOW64 processes, to allow 64-bit printer drivers to be used.
- lahcim2000 6y ago#Google once again is being irresponsible by disclosing this vulnerability. Look at the timeline, there was a meeting between Google and Microsoft where Microsoft requested more time for the fix to roll out out. And Google decided to do irresponsible thing and just disclosing vuln, so now more and more attackers can use it instead of doing what's good for customers/users. Google... Don't be evil??? Lol. So not true now...
- saagarjha 6y agoGoogle Project Zero is fairly firm about their timelines.
- corty 6y agoDelayed disclosure is irresponsible. Doubly so if the vulnerability is the same as an old one. Triply so if there is active exploitation going on. So yes, Google is evil, for not doing immediate full public disclosure 90 days ago.
- lahcim2000 6y agoI disagree.
- artiszt 6y agowith M$ everyday is 0day [same applies to Goo only their troll army, yet, is larger. as long as it lasts ..]
- junon 6y agoDoesn't surprise me. I've been sitting on a WSL1 root escalation script that I found by accident. I messaged one of the WSL leads and he didn't seem to care about it. It's been months. Microsoft and security don't exactly go together in my head.