6 ms·

> As a person who is novice to the driver exploitation scene, I was in a search for a driver which is very-easy to exploit. While on the search, I encountered S

by Rygian 4y ago

> As a person who is novice to the driver exploitation scene, I was in a search for a driver which is very-easy to exploit. While on the search, I encountered Souhail Hammou’s really well written blogpost about how he exploited MalwareFox AntiMalware’s driver (zam64.sys) to escalate privileges. Using an anti-malware piece of software as a stepping stone to get Ring0 is beyond irony. I wish for a world where the general public were able to consider all software as malware by default, unless it has been proven "moreless safe" by at least three independent security audits paid with public money.

omnibrain 4y ago
> Using an anti-malware piece of software as a stepping stone to get Ring0 is beyond irony. If you think about it: not really. "Anti-malware" software often uses rootkit technologies to do "its job". In turn it gets handed the keys to the kingdom to do "everything".
badsectoracula 4y ago
> I wish for a world where the general public were able to consider all software as malware by default, unless it has been proven "moreless safe" by at least three independent security audits paid with public money. Yes, what we need is more roadblocks in there, to ensure software that has captured large segments of their respective markets remain entrenched and make it harder for new developers and projects to dethrone them while giving the government (of which country?) control over what software people can run - no way this will be abused at all X-P.
- speed_spread 4y ago
  Food for thought: That's how cars are put on the market nowadays. Not saying you're wrong, though.
  - wongarsu 4y ago
    It's also part of the story how we ended up with a duopoly of airplane manufacturers. I think there's room for regulation and forced audits. The important part is that the compliance costs are small compared to development and production costs. That's true in the car industry unless you have really low volume, while airplanes are pushed over the threshold by much lower volume and much higher regulation.
    - thatguy0900 4y ago
      On the other hand, not everything really needs to be a free market, there are tradeoffs. It might be worth having a airplane duopoly if it ensures airlines arnt trying to buy airplanes that are shoddy with a few corners cut risks be damned (of course, if the reality is that the duopoly gets to make shoddy airplanes anyway, this doesn't apply). Some things are just very, very safety critical in a way that's more important than maximal money saved
      - selfhoster11 4y ago
        737 Max comes to mind, when talking about safety.
        landemva 4y ago
        Boeing took engineering shortcuts of using software to make the plane appear to fly like older 737s to avoid a new type certification and the necessary retraining costs. I think FAA failed here by continuing to allow that to fly without a new type certification.
  - badsectoracula 4y ago
    Cars are a bit different, considering they are physical objects that can easily kill people and you can't exactly manufacture a car in your room with a $50 computer - entry prices are a tiny bit higher there. Meanwhile, i don't think i should have to ask permission from the government to make something like, e.g. a map editing tool for a 90s fps, like i did yesterday[0] (the tool, not requesting permission) or a sprite editor[1] or a quick-and-dirty wiki server to take notes in games[2]. Or really anything that doesn't have to do with areas where lives are at stake (which AFAIK is already being done anyway with programs needing to pass conformance tests - something i'm perfectly fine with, at least in theory, as i don't know in practice if these tests really work or are designed to help existing actors stay entrenched). [0] http://runtimeterror.com/tools/chasmfe/ http://runtimeterror.com/tools/chasmfe/ [1] http://runtimeterror.com/tools/mseditor/ http://runtimeterror.com/tools/mseditor/ [2] http://runtimeterror.com/tools/cppwiki/ http://runtimeterror.com/tools/cppwiki/
    - Rygian 4y ago
      What about megacorps writing operating systems for 99% of the device-owner population of the world? And again, the original comment above is not "ask permission from the government" but instead "pass independent security audits by neutral auditors before exposing your software to the general public."
      - badsectoracula 4y ago
        It was > independent security audits paid with public money The "with public money" part means they are funded and thus controlled by the government. Not that i think a privately owned megacorp is much better, after all i do not like the scare boxes you see on unsigned (and "lesser signed") programs in Windows and macOS unless you pay the certificate mafia protection money - but at least those do not block you completely.
- Rygian 4y ago
  My opinionated "This Is The Way" stance, as a work in progress: Daily fines proportional to installed user base, on the basis of confirmed and not yet fixed CVEs. Amount inversely proportional to price of per-user software license (ie. the cheaper the gadget, the heavier the fines). Exception for AGPL-compatible licenses. Incentives and credits for smaller companies' training and audits. Funded by fines above. Incentives and credits for companies fixing CVEs on AGPL-compatible software. Funded also by fines above. Amount of incentives proportional to installed user base and severity of CVE. Audit practices defined by group of international bodies.
  - badsectoracula 4y ago
    > Exception for AGPL-compatible licenses. What have OpenBSD developers done to you? :-P
    - Rygian 4y ago
      Judging from the score of my comment... they've downvoted me :-)
- carapace 4y ago
  The average user has to trust somebody, eh? I can literally dope silicon and make my own chips, but even I have to trust "the system" to buy food and shelter, etc. You can draw a line from the invention of the transistor to the eventual necessity of solving the ultimate human problem: how do we get along with each other?
  - selfhoster11 4y ago
    > I can literally dope silicon and make my own chips How so? The best usable homemade transistor project that I’m aware of, consisted of something on the order of 100 amplifiers/transistors on a chip. And even then, the author had access to professionally made silicon wafers, and likely a whole lot of expensive/dangerous chemicals and equipment. This is very far outside the realm of a casual hacker. Making even the simplest 6502 equivalent by yourself is impossible, forget more complex projects. I feel like this should be urgently addressed, given how important computing is.
    - carapace 4y ago
      You got me. That was more of a rhetorical flourish than something I've actually done, or would do. "I haven't done this recently. Or in the past." Sam Zeloof is doing great things: http://sam.zeloof.xyz/ http://sam.zeloof.xyz/ > Making even the simplest 6502 equivalent by yourself is impossible, forget more complex projects. I feel like this should be urgently addressed, given how important computing is. I've thought about this, more in the context of post-apocalyptic computing rather than trust, FWIW. If I were really going to make my own computers from scratch I think clockwork (Clock of the Long Now) or fluidics would probably be the way to go. Maybe electro-mechanical (relays, etc.) or vacuum tubes? We did pretty well with the abacus and the slide rule, eh?
      - selfhoster11 4y ago
        Sam Zeloof’s project is the exact one I had in mind when writing my comment. His work is extremely impressive, but it’s almost shameful that for over 40 years (collective) we as hobbyists have not had the ability to manufacture even something as simple as a 4004. May Sam’s work progress, and may we all build on his success. > I've thought about this, more in the context of post-apocalyptic computing rather than trust, FWIW. Post-apocalyptic computing is one possible motivation to look at this, but other reduced-tech settings like a fully independent Mars colony also simply cannot function without a way to fab simple IC logic. That, or we’re happy to go back to early Apollo era tech levels. RE: computers from scratch in the absence of IC fabrication. I think our best chance is vacuum tubes. Mechanical relay computers seem to have been phased out in favour of vacuum tube solutions pretty quickly, so I guess there must have been some compelling reasons to do so (my guess - speed and failure rate of individual switching components). Couple that with old-school electromechanical tech for IO/industrial sequencing, several K of delay line/core/Williams Tube memory, and you’re golden.
fazfq 4y ago
This is a company so shitty that their website does not even have a privacy policy: https://www.malwarefox.com/privacy-policy/ https://www.malwarefox.com/privacy-policy/ The exploit suddenly looks much less impressive if it relies on the user having installed something like that.
- 36933 4y ago
  Does it have to be installed though? Can’t you just load the driver, if it’s signed and not on the driver block list now on 22H2?
  - fazfq 4y ago
    You have to be a local administrator to load a driver.
    - wongarsu 4y ago
      Even a "local admin to Ring0 without reboot"-exploit might have some uses in malware.
      - fazfq 4y ago
        But that already exists. There are thousands of signed drivers; many around are bound to be exploitable. But it's not Windows' fault that you installed one. The truth of the matter is that if you are local admin you can already ruin the system in many ways. Once you are admin the game is already over.
        Rygian 4y ago
        Imagine you're my clueless family relative and you end up installing one of those signed-yet-exploitable drivers. Whose fault is it?
        fazfq 4y ago
Cthulhu_ 4y ago
You mean like an app store where an app has to pass a rigorous review process first?
- krono 4y ago
  > by at least three independent security audits paid with public money Clearly not
- wongarsu 4y ago
  I assume the MalwareFox driver already got through automated reviews to be signed by Microsoft?
intelVISA 4y ago
It works quite well, a lot of "anti-malware" is invasive malware by design.
pjmlp 4y ago
That is what OS sandboxes are for, but they tend not to be liked by HN crowd.
- Sakos 4y ago
  I think generally people are okay with the idea of sandboxes. It's issues around how sandboxes break existing workflows and make it difficult to customize to your needs, coupled with devs who are unresponsiven (or even hostile) to user needs. Flatpak felt like a nightmare until Flatseal. Now it's still a nightmare, but I don't cry myself to sleep after using it anymore.
  - anthk 4y ago
    Pledge and Unveil are proper sandboxing.
deepspace 4y ago
> I wish for a world where the general public were able to consider all software as malware by default If I could wish a world into existence, I would choose one where all criminals disappeared in a puff of smoke, letting the rest of us enjoy a key-less password-less worry-free life.

by Rygian 4y ago

omnibrain 4y ago

> Using an anti-malware piece of software as a stepping stone to get Ring0 is beyond irony. If you think about it: not really. "Anti-malware" software often uses rootkit technologies to do "its job". In turn it gets handed the keys to the kingdom to do "everything".

badsectoracula 4y ago

> I wish for a world where the general public were able to consider all software as malware by default, unless it has been proven "moreless safe" by at least three independent security audits paid with public money. Yes, what we need is more roadblocks in there, to ensure software that has captured large segments of their respective markets remain entrenched and make it harder for new developers and projects to dethrone them while giving the government (of which country?) control over what software people can run - no way this will be abused at all X-P.

speed_spread 4y ago
Food for thought: That's how cars are put on the market nowadays. Not saying you're wrong, though.
- wongarsu 4y ago
  It's also part of the story how we ended up with a duopoly of airplane manufacturers. I think there's room for regulation and forced audits. The important part is that the compliance costs are small compared to development and production costs. That's true in the car industry unless you have really low volume, while airplanes are pushed over the threshold by much lower volume and much higher regulation.
  - thatguy0900 4y ago
    On the other hand, not everything really needs to be a free market, there are tradeoffs. It might be worth having a airplane duopoly if it ensures airlines arnt trying to buy airplanes that are shoddy with a few corners cut risks be damned (of course, if the reality is that the duopoly gets to make shoddy airplanes anyway, this doesn't apply). Some things are just very, very safety critical in a way that's more important than maximal money saved
    - selfhoster11 4y ago
      737 Max comes to mind, when talking about safety.
      - landemva 4y ago
        Boeing took engineering shortcuts of using software to make the plane appear to fly like older 737s to avoid a new type certification and the necessary retraining costs. I think FAA failed here by continuing to allow that to fly without a new type certification.
- badsectoracula 4y ago
  Cars are a bit different, considering they are physical objects that can easily kill people and you can't exactly manufacture a car in your room with a $50 computer - entry prices are a tiny bit higher there. Meanwhile, i don't think i should have to ask permission from the government to make something like, e.g. a map editing tool for a 90s fps, like i did yesterday[0] (the tool, not requesting permission) or a sprite editor[1] or a quick-and-dirty wiki server to take notes in games[2]. Or really anything that doesn't have to do with areas where lives are at stake (which AFAIK is already being done anyway with programs needing to pass conformance tests - something i'm perfectly fine with, at least in theory, as i don't know in practice if these tests really work or are designed to help existing actors stay entrenched). [0] http://runtimeterror.com/tools/chasmfe/ http://runtimeterror.com/tools/chasmfe/ [1] http://runtimeterror.com/tools/mseditor/ http://runtimeterror.com/tools/mseditor/ [2] http://runtimeterror.com/tools/cppwiki/ http://runtimeterror.com/tools/cppwiki/
  - Rygian 4y ago
    What about megacorps writing operating systems for 99% of the device-owner population of the world? And again, the original comment above is not "ask permission from the government" but instead "pass independent security audits by neutral auditors before exposing your software to the general public."
    - badsectoracula 4y ago
      It was > independent security audits paid with public money The "with public money" part means they are funded and thus controlled by the government. Not that i think a privately owned megacorp is much better, after all i do not like the scare boxes you see on unsigned (and "lesser signed") programs in Windows and macOS unless you pay the certificate mafia protection money - but at least those do not block you completely.
Rygian 4y ago
My opinionated "This Is The Way" stance, as a work in progress: Daily fines proportional to installed user base, on the basis of confirmed and not yet fixed CVEs. Amount inversely proportional to price of per-user software license (ie. the cheaper the gadget, the heavier the fines). Exception for AGPL-compatible licenses. Incentives and credits for smaller companies' training and audits. Funded by fines above. Incentives and credits for companies fixing CVEs on AGPL-compatible software. Funded also by fines above. Amount of incentives proportional to installed user base and severity of CVE. Audit practices defined by group of international bodies.
- badsectoracula 4y ago
  > Exception for AGPL-compatible licenses. What have OpenBSD developers done to you? :-P
  - Rygian 4y ago
    Judging from the score of my comment... they've downvoted me :-)
carapace 4y ago
The average user has to trust somebody, eh? I can literally dope silicon and make my own chips, but even I have to trust "the system" to buy food and shelter, etc. You can draw a line from the invention of the transistor to the eventual necessity of solving the ultimate human problem: how do we get along with each other?
- selfhoster11 4y ago
  > I can literally dope silicon and make my own chips How so? The best usable homemade transistor project that I’m aware of, consisted of something on the order of 100 amplifiers/transistors on a chip. And even then, the author had access to professionally made silicon wafers, and likely a whole lot of expensive/dangerous chemicals and equipment. This is very far outside the realm of a casual hacker. Making even the simplest 6502 equivalent by yourself is impossible, forget more complex projects. I feel like this should be urgently addressed, given how important computing is.
  - carapace 4y ago
    You got me. That was more of a rhetorical flourish than something I've actually done, or would do. "I haven't done this recently. Or in the past." Sam Zeloof is doing great things: http://sam.zeloof.xyz/ http://sam.zeloof.xyz/ > Making even the simplest 6502 equivalent by yourself is impossible, forget more complex projects. I feel like this should be urgently addressed, given how important computing is. I've thought about this, more in the context of post-apocalyptic computing rather than trust, FWIW. If I were really going to make my own computers from scratch I think clockwork (Clock of the Long Now) or fluidics would probably be the way to go. Maybe electro-mechanical (relays, etc.) or vacuum tubes? We did pretty well with the abacus and the slide rule, eh?
    - selfhoster11 4y ago
      Sam Zeloof’s project is the exact one I had in mind when writing my comment. His work is extremely impressive, but it’s almost shameful that for over 40 years (collective) we as hobbyists have not had the ability to manufacture even something as simple as a 4004. May Sam’s work progress, and may we all build on his success. > I've thought about this, more in the context of post-apocalyptic computing rather than trust, FWIW. Post-apocalyptic computing is one possible motivation to look at this, but other reduced-tech settings like a fully independent Mars colony also simply cannot function without a way to fab simple IC logic. That, or we’re happy to go back to early Apollo era tech levels. RE: computers from scratch in the absence of IC fabrication. I think our best chance is vacuum tubes. Mechanical relay computers seem to have been phased out in favour of vacuum tube solutions pretty quickly, so I guess there must have been some compelling reasons to do so (my guess - speed and failure rate of individual switching components). Couple that with old-school electromechanical tech for IO/industrial sequencing, several K of delay line/core/Williams Tube memory, and you’re golden.

fazfq 4y ago

This is a company so shitty that their website does not even have a privacy policy: https://www.malwarefox.com/privacy-policy/ https://www.malwarefox.com/privacy-policy/ The exploit suddenly looks much less impressive if it relies on the user having installed something like that.

36933 4y ago
Does it have to be installed though? Can’t you just load the driver, if it’s signed and not on the driver block list now on 22H2?
- fazfq 4y ago
  You have to be a local administrator to load a driver.
  - wongarsu 4y ago
    Even a "local admin to Ring0 without reboot"-exploit might have some uses in malware.
    - fazfq 4y ago
      But that already exists. There are thousands of signed drivers; many around are bound to be exploitable. But it's not Windows' fault that you installed one. The truth of the matter is that if you are local admin you can already ruin the system in many ways. Once you are admin the game is already over.
      - Rygian 4y ago
        Imagine you're my clueless family relative and you end up installing one of those signed-yet-exploitable drivers. Whose fault is it?
        fazfq 4y ago

Cthulhu_ 4y ago

You mean like an app store where an app has to pass a rigorous review process first?

krono 4y ago
> by at least three independent security audits paid with public money Clearly not
wongarsu 4y ago
I assume the MalwareFox driver already got through automated reviews to be signed by Microsoft?

intelVISA 4y ago

It works quite well, a lot of "anti-malware" is invasive malware by design.

pjmlp 4y ago

That is what OS sandboxes are for, but they tend not to be liked by HN crowd.

Sakos 4y ago
I think generally people are okay with the idea of sandboxes. It's issues around how sandboxes break existing workflows and make it difficult to customize to your needs, coupled with devs who are unresponsiven (or even hostile) to user needs. Flatpak felt like a nightmare until Flatseal. Now it's still a nightmare, but I don't cry myself to sleep after using it anymore.
- anthk 4y ago
  Pledge and Unveil are proper sandboxing.

deepspace 4y ago

> I wish for a world where the general public were able to consider all software as malware by default If I could wish a world into existence, I would choose one where all criminals disappeared in a puff of smoke, letting the rest of us enjoy a key-less password-less worry-free life.