9 ms·

NTFS Corruption on Win10

136 points by leosarev 6y ago

proactivesvcs 6y ago
https://www.bleepingcomputer.com/news/security/windows-10-bug-corrupts-your-hard-drive-on-seeing-this-files-icon/ https://www.bleepingcomputer.com/news/security/windows-10-bu... for a Twitter-free analysis.
- codetrotter 6y ago
  Different bug AFAICT. The Twitter thread is talking about corruption happening from trying to open some path. Your link talks about trying to show a specific icon leading to corruption.
  - 0x0 6y ago
    They're talking about the same bug. The article even embeds the tweet starting the twitter thread. The stuff about icons is just using a filetype to trigger the bug quickly by forcing windows to look up the path embedded in the icon.
- josteink 6y ago
  Moderators: Twitter is a terrible medium for long-format "articles". Can the main link be updated to this one, instead of the twitter-link? Also: With twitter starting banning random accounts, like sci-hub, seemingly without any consistent justifications, shouldn't we reconsider twitter as valid source for HN news-stories? Edit: seemingly different bug. Twitter is still all over terrible though.
  - stefan_ 6y ago
    Well, particularly this breathless, content-free Twitter thread.
  - forgingahead 6y ago
    Nitter.net is probably better if we did need to link to the Tweets to begin with: https://nitter.net/jonasLyk/status/1347900440000811010 https://nitter.net/jonasLyk/status/1347900440000811010
    - SkitterDotOrg 6y ago
      Only problem with nitter.net is that 'this instance is over loaded' and so on. Nitter.net is running on some hetzner low instance and at least since beginning of 2021 nitter has said ' this instance is over loaded ' half the time you use nitter. So it goes
  - jabberwcky 6y ago
    Counter case: Twitter forces authors to be succinct and to the point, and encourages them write in a style similar to the classical newspaper article structure where the most pertinent information is presented first There is a wide variety of research published only on Twitter, precisely because the publishing process is so lightweight for writers, and every single paragraph can form the leaves of a single giant conversation. A high quality Twitter thread cannot easily be replicated using alternative media
    - kevincox 6y ago
      You raise a good point, but an email on a mailing list lets you reply to specific sentences/paragraphs. I guess the fairly unique value that twitter is adding here is going from the specific paragraph to see if there are any replies. Maybe webmention needs the ability to reference parts of a page, although I guess you could do that by linking to an anchor.
    - alexvoda 6y ago
      Commenting per paragraph has also been done by Medium. I'm not saying that Medium is good, it has its own problems. But that feature can be replicated outside Twitter/Mastodon/etc.
- JeremyNT 6y ago
  Much better source - can the original link be updated on the submission?
petters 6y ago
Yikes! May be triggerable from a web page even. Hopefully fixed very soon.
bob_page 6y ago
I've been calling it the Not Trustworthy FileSystem for ages. Didn't even know it was this bad. Haven't found a way to run it on ZFS yet. There's a project that implements btrfs here: https://github.com/maharmstone/btrfs https://github.com/maharmstone/btrfs
faeyanpiraat 6y ago
This needs more upvotes. Probably will be afraid to browse around random websites. Just like in the old days.
- TonyTrapp 6y ago
  As long as you don't download anything, it should be fine? The last time I checked, browser caches don't use original filenames for storing cached objects on disk (like IE did in the old days).
uncledave 6y ago
I don’t think this is actually a corruption issue. I spent a lot of time with this yesterday analysing it in a VM and I couldn’t find any cases where on reboot it caused chkdsk to actually take any actions. It always found the file system clean. What it seems to do is trigger a consistency check for the next reboot and some alarmist notifications. This is probably a simple check assertion somewhere which is seeing unexpected data passing through a call. That is a problem but significantly less of one than actual corruption. If anyone has evidence to the contrary and steps to reproduce it I’d be interested to try them.
- sterlind 6y ago
  Not doubting you, but the repro video in the bleepingcomputer article showed a green screen of death during chkdsk. Maybe there's something finicky?
  - uncledave 6y ago
    I ran the test case and then chkdsk 5 times each on 1903, 2004 and 20H2 and it came back clean every time. It’s definitely possible I missed something but until it’s consistently reproducible then I’m on the fence. One complaint is I’d expect something at the level of MFT corruption to trigger a bugcheck (panic). Doesn’t seem safe behaviour to let the system carry on with a corrupt MFT.
- londons_explore 6y ago
  The article suggests a .url file could be found empty after the reboot. Perhaps the check assertion causes the filesystem to become read-only or discard the write cache or some other side effects that could lead to corruption? If it's something along these lines, it may not be reproducible in a VM (where the host is responsible for waiting around for flushing delays)
  - uncledave 6y ago
    That’s certainly a possibility. Will go and try it. The MFT writes are transactional in theory from my understanding and small files are stored in the MFT and shortcuts are small files. Could be that the MFT is not flushed to disk after that event? That would suggest anything after the event would be broken. Also in line with my worries that this should be a bugcheck/panic rather than a soft assertion.
0x0 6y ago
Does this affect windows-based web/file servers too? If a client can request an URL or similar with the pattern triggering a folder lookup on the server's NTFS volume?
- freeone3000 6y ago
  Yes, but you wouldn't normally be able to access this file as a web client. Being able to view arbitrarily files as a web client is already a security concern.
pdenton 6y ago
The article says the path to the icon is cleared after a reboot, but what if it tries to access the icon first and fails to actually write the path to the shortcut (given that the filesystem is already hosed at that time). I wonder what happens if one creates the shortcut offline, e.g. using older MS-Windows, wine, reactOS or whatever. Then just copy the crafted lnk file to \Users\Public\Desktop and see what happens.
- deleted 6y ago
  [deleted]
vlpty 6y ago
You have to be inclusive! Why should you be the only one allowed to write to your hard drive? Anyone in the world should have this right! Brought to you by the new Microsoft collective.
CawCawCaw 6y ago
This bug is extraordinarily fascinating. Also, it presents one of the rare cases where running chkdsk might actually do something useful.

136 points by leosarev 6y ago

https://www.bleepingcomputer.com/news/security/windows-10-bug-corrupts-your-hard-drive-on-seeing-this-files-icon/ https://www.bleepingcomputer.com/news/security/windows-10-bu... for a Twitter-free analysis.

codetrotter 6y ago
Different bug AFAICT. The Twitter thread is talking about corruption happening from trying to open some path. Your link talks about trying to show a specific icon leading to corruption.
- 0x0 6y ago
  They're talking about the same bug. The article even embeds the tweet starting the twitter thread. The stuff about icons is just using a filetype to trigger the bug quickly by forcing windows to look up the path embedded in the icon.
josteink 6y ago
Moderators: Twitter is a terrible medium for long-format "articles". Can the main link be updated to this one, instead of the twitter-link? Also: With twitter starting banning random accounts, like sci-hub, seemingly without any consistent justifications, shouldn't we reconsider twitter as valid source for HN news-stories? Edit: seemingly different bug. Twitter is still all over terrible though.
- stefan_ 6y ago
  Well, particularly this breathless, content-free Twitter thread.
- forgingahead 6y ago
  Nitter.net is probably better if we did need to link to the Tweets to begin with: https://nitter.net/jonasLyk/status/1347900440000811010 https://nitter.net/jonasLyk/status/1347900440000811010
  - SkitterDotOrg 6y ago
    Only problem with nitter.net is that 'this instance is over loaded' and so on. Nitter.net is running on some hetzner low instance and at least since beginning of 2021 nitter has said ' this instance is over loaded ' half the time you use nitter. So it goes
- jabberwcky 6y ago
  Counter case: Twitter forces authors to be succinct and to the point, and encourages them write in a style similar to the classical newspaper article structure where the most pertinent information is presented first There is a wide variety of research published only on Twitter, precisely because the publishing process is so lightweight for writers, and every single paragraph can form the leaves of a single giant conversation. A high quality Twitter thread cannot easily be replicated using alternative media
  - kevincox 6y ago
    You raise a good point, but an email on a mailing list lets you reply to specific sentences/paragraphs. I guess the fairly unique value that twitter is adding here is going from the specific paragraph to see if there are any replies. Maybe webmention needs the ability to reference parts of a page, although I guess you could do that by linking to an anchor.
  - alexvoda 6y ago
    Commenting per paragraph has also been done by Medium. I'm not saying that Medium is good, it has its own problems. But that feature can be replicated outside Twitter/Mastodon/etc.
JeremyNT 6y ago
Much better source - can the original link be updated on the submission?

petters 6y ago

Yikes! May be triggerable from a web page even. Hopefully fixed very soon.

bob_page 6y ago

I've been calling it the Not Trustworthy FileSystem for ages. Didn't even know it was this bad. Haven't found a way to run it on ZFS yet. There's a project that implements btrfs here: https://github.com/maharmstone/btrfs https://github.com/maharmstone/btrfs

faeyanpiraat 6y ago

This needs more upvotes. Probably will be afraid to browse around random websites. Just like in the old days.

TonyTrapp 6y ago
As long as you don't download anything, it should be fine? The last time I checked, browser caches don't use original filenames for storing cached objects on disk (like IE did in the old days).

uncledave 6y ago

I don’t think this is actually a corruption issue. I spent a lot of time with this yesterday analysing it in a VM and I couldn’t find any cases where on reboot it caused chkdsk to actually take any actions. It always found the file system clean. What it seems to do is trigger a consistency check for the next reboot and some alarmist notifications. This is probably a simple check assertion somewhere which is seeing unexpected data passing through a call. That is a problem but significantly less of one than actual corruption. If anyone has evidence to the contrary and steps to reproduce it I’d be interested to try them.

sterlind 6y ago
Not doubting you, but the repro video in the bleepingcomputer article showed a green screen of death during chkdsk. Maybe there's something finicky?
- uncledave 6y ago
  I ran the test case and then chkdsk 5 times each on 1903, 2004 and 20H2 and it came back clean every time. It’s definitely possible I missed something but until it’s consistently reproducible then I’m on the fence. One complaint is I’d expect something at the level of MFT corruption to trigger a bugcheck (panic). Doesn’t seem safe behaviour to let the system carry on with a corrupt MFT.
londons_explore 6y ago
The article suggests a .url file could be found empty after the reboot. Perhaps the check assertion causes the filesystem to become read-only or discard the write cache or some other side effects that could lead to corruption? If it's something along these lines, it may not be reproducible in a VM (where the host is responsible for waiting around for flushing delays)
- uncledave 6y ago
  That’s certainly a possibility. Will go and try it. The MFT writes are transactional in theory from my understanding and small files are stored in the MFT and shortcuts are small files. Could be that the MFT is not flushed to disk after that event? That would suggest anything after the event would be broken. Also in line with my worries that this should be a bugcheck/panic rather than a soft assertion.

0x0 6y ago

Does this affect windows-based web/file servers too? If a client can request an URL or similar with the pattern triggering a folder lookup on the server's NTFS volume?

freeone3000 6y ago
Yes, but you wouldn't normally be able to access this file as a web client. Being able to view arbitrarily files as a web client is already a security concern.

pdenton 6y ago

The article says the path to the icon is cleared after a reboot, but what if it tries to access the icon first and fails to actually write the path to the shortcut (given that the filesystem is already hosed at that time). I wonder what happens if one creates the shortcut offline, e.g. using older MS-Windows, wine, reactOS or whatever. Then just copy the crafted lnk file to \Users\Public\Desktop and see what happens.

deleted 6y ago
[deleted]

vlpty 6y ago

You have to be inclusive! Why should you be the only one allowed to write to your hard drive? Anyone in the world should have this right! Brought to you by the new Microsoft collective.

CawCawCaw 6y ago

This bug is extraordinarily fascinating. Also, it presents one of the rare cases where running chkdsk might actually do something useful.