4 ms·

Seems quite a baited title, especially given some comments are jumping on Windows or VBA here - the actual title should be "getting ring0 by installing a terrib

Seems quite a baited title, especially given some comments are jumping on Windows or VBA here - the actual title should be "getting ring0 by installing a terribly designed and dubious kernel driver", but that doesn't sound so impressive.

deleted 4y ago
[deleted]
- deleted 4y ago
  [deleted]
trelane 4y ago
> getting ring0 by installing a terribly designed and dubious kernel driver Given that most drivers are software written by hardware companies and, as soon as the device is sold, are just a liability, is this really going to be a huge barrier? How often do drivers get updated, say 1 or 2 years post release? Same thing as many non-subscription wireless routers.
- meandmycode 4y ago
  Sure, but is this unique to Windows or Word? and there are various ways Microsoft could kill bit this driver if it was widely exploited with no support from the company that made it
  - gw99 4y ago
    Word is a useful vector because a lot of hardening software throws a load of stuff on the Windows UI to stop you executing anything but does not touch VBA. I've had to use VBA many times to work around abhorrent user controls that prevented work from being done.
  - trelane 4y ago
    Windows does hardware support primarily though proprietary drivers specific to that hardware. Outside of that, its own innate hardware support is quite lackluster compared to other OSes (especially Linux, due to the pressure to put drivers in the kernel, where they're open and maintained.) Sure, they can unilaterally kill any software on their platform, it's perhaps an important thing to note about it and other platforms where this is true. (Answering questions of ownership and user rights that inherently arise from this and other similar facts are left as an exercise to the reader). However, that also comes at the cost of disabling the hardware that the driver serves, at least until it's fixed.
- Dwedit 4y ago
  In this case, the driver does not have any hardware. It's a purely software driver for an anti-malware scanner.
phpisthebest 4y ago
Office never should have had VBA in it to begin with, and it should have been removed decades ago
- gw99 4y ago
  VBA is one of the best things Microsoft ever produced from an actual business perspective. The killer problem is that people run any old untrusted shit from anywhere.
  - phpisthebest 4y ago
    I would disagree with that. VBA seems like it, but there is a HUGE amount of negative externalities that are never accounted for when people talk about how great VBA is for business In some ways it is like CO2 Emissions on Climate change. You enjoy the benefits today of VBA but the technical debt and other externalities cost the business far more in the future
    - gw99 4y ago
      All tools are compromised in one way or another. That had a decent balance of compromises.
  - anthk 4y ago
    VBA was a godsend for malware. COM/OLE? Win32 calls? Heaven. Now add Ransomware and now you would think VBA should be either sandboxed or killed away.

deleted 4y ago

[deleted]

deleted 4y ago
[deleted]

trelane 4y ago

> getting ring0 by installing a terribly designed and dubious kernel driver Given that most drivers are software written by hardware companies and, as soon as the device is sold, are just a liability, is this really going to be a huge barrier? How often do drivers get updated, say 1 or 2 years post release? Same thing as many non-subscription wireless routers.

meandmycode 4y ago
Sure, but is this unique to Windows or Word? and there are various ways Microsoft could kill bit this driver if it was widely exploited with no support from the company that made it
- gw99 4y ago
  Word is a useful vector because a lot of hardening software throws a load of stuff on the Windows UI to stop you executing anything but does not touch VBA. I've had to use VBA many times to work around abhorrent user controls that prevented work from being done.
- trelane 4y ago
  Windows does hardware support primarily though proprietary drivers specific to that hardware. Outside of that, its own innate hardware support is quite lackluster compared to other OSes (especially Linux, due to the pressure to put drivers in the kernel, where they're open and maintained.) Sure, they can unilaterally kill any software on their platform, it's perhaps an important thing to note about it and other platforms where this is true. (Answering questions of ownership and user rights that inherently arise from this and other similar facts are left as an exercise to the reader). However, that also comes at the cost of disabling the hardware that the driver serves, at least until it's fixed.
Dwedit 4y ago
In this case, the driver does not have any hardware. It's a purely software driver for an anti-malware scanner.

phpisthebest 4y ago

Office never should have had VBA in it to begin with, and it should have been removed decades ago

gw99 4y ago
VBA is one of the best things Microsoft ever produced from an actual business perspective. The killer problem is that people run any old untrusted shit from anywhere.
- phpisthebest 4y ago
  I would disagree with that. VBA seems like it, but there is a HUGE amount of negative externalities that are never accounted for when people talk about how great VBA is for business In some ways it is like CO2 Emissions on Climate change. You enjoy the benefits today of VBA but the technical debt and other externalities cost the business far more in the future
  - gw99 4y ago
    All tools are compromised in one way or another. That had a decent balance of compromises.
- anthk 4y ago
  VBA was a godsend for malware. COM/OLE? Win32 calls? Heaven. Now add Ransomware and now you would think VBA should be either sandboxed or killed away.