4 ms·
The Hyper-V escape seems of particular note - since using Hyper-V for isolation of suspected malware can be compromised via this vuln.
by T3OU-736 5y ago
The Hyper-V escape seems of particular note - since using Hyper-V for isolation of suspected malware can be compromised via this vuln.
- belltaco 5y agoOne would hope that security researchers worth their salt would install Windows updates that are 4 months old at this point.
- ec109685 5y agoDo we think this is the only vulnerability of this type in the RDP codebase now that this new attack vector has been found?
- malcolmst 5y agoThere was apparently also a similar vulnerability that someone else recently found in smart card redirection https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/windows-rdp-client-porting-critical-vulnerabilities-to-hyper-v-manager/ https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-at...
- belltaco 5y agoRDP is a protocol, not a code base. It says so in the name.
- seoaeu 5y agoThe comment you are replying to is clearly referring to the codebase containing Microsoft's implementation of RDP.
- T3OU-736 5y agoFair, but also consider that before a researcher is in the "worth their salt" category, they are learning. Hyper-V seems like a reasonable isolation methodology. Same machine may be either unpatched to evaluate malware against a specific patch level, or was deliberately kept offline. So... possible? More fundamentally, goes to show that it is possible to have an escape like this, over a communication channel which isn't readily obviously so exoloitable. This, beyond the viln itself, seems like a valuable thing.
- belltaco 5y ago>Fair, but also consider that before a researcher is in the "worth their salt" category, they are learning. What part of the learning process is turning off Windows Updates for months on the host machine? That's like saying cutting the brake lines is part of learning to drive. You have to go out of the way to mess things up, not forget or not know to do something.
- Godel_unicode 5y agoThere are a ton of people who turn off updates because they just don't want to reboot (or just because they're incensed that Microsoft made updates opt-out). I have done multiple root cause analyses responding to incidents that have turned out to be out-of-date admin machines.
- belltaco 5y agoWe're talking about security researchers here, who should know better. It'd be like EMTs disabling airbags and not wearing seatbelts. >or just because they're incensed that Microsoft made updates opt-out This is the mentality of a child. Do security researchers that think it's a good idea to make security updates opt in for end users? >I have done multiple root cause analyses responding to incidents that have turned out to be out-of-date admin machines That'd be a fireable offense in many places.
- deleted 5y ago[deleted]
- waz0wski 5y agoThe salty sysadmins will note that Microsoft has a track record of botched patches to things like this, with effects ranging from not-remediated to majorly breaking other OS components
- deleted 5y ago[deleted]