5 ms·

People who delete system binaries due to whacky CVEs deserve a broken system. I don't even know who else to blame for this.

yourusername 4y ago
There are people responsible for the security of Windows systems in some organisations that do not understand their job. They look into their AV solution and it says vulnerable file detected on $x systems and they instruct their IT department to remove the file.
- robertlagrant 4y ago
  Indeed. Whole companies such as Crowdstrike exist just to sit in between automated tools and heavy-handed action based on tool output.
  - hardware2win 4y ago
    Ive been actually impressed by Crowdstrike product (I guess) Ive tested a two or three years old Chrome version with JIT compiler vulnerability and guess what - on empty Linux vm it managed to escape chrome and execute code Meanwhile on Windows with Crowdstrike Chrome just showed some error message about mem. access Im not sure who handled that attack - was it Windows or Crowdstrike, but eitherway Ive been impressed
tyingq 4y ago
I'm guessing a common sequence is someone knowing what curl is, but not knowing that Windows ships with it. So, thinking that System32\curl.exe must have been put there by malware, or put there by someone installing optional software.
- Freak_NL 4y ago
  Microsoft should have renamed it to WINDLHLP.COM or something Windowsy like that, and none of these people would have dared touch it.
  - tyingq 4y ago
    I noticed that "curl" in PowerShell is an alias, so you would have to deliberately say "curl.exe" to get System32\curl.exe C:\> alias curl CommandType Name Version Source ----------- ---- ------- ------ Alias curl -> Invoke-WebRequest
    - justeleblanc 4y ago
      That's not the case in the latest versions of powershell.
      - archgoon 4y ago
        [dead]
    - VWWHFSfQ 4y ago
      Yeah they did the same thing with wget. Just absolutely bonkers
    - phpisthebest 4y ago
      That is for Windows Powershell, not Powershell (and yes Windows Powershell is different from PowerShell [1]) curl > curl.exe > C:\Windows\System32\curl.exe [1] https://learn.microsoft.com/en-us/powershell/scripting/whats-new/differences-from-windows-powershell?view=powershell-7.3 https://learn.microsoft.com/en-us/powershell/scripting/whats...
      - thomasjudge 4y ago
        This is so Microsoft
thaumasiotes 4y ago
They deserve to not be allowed to restore their system to normal? > The people who deleted or replaced the curl executable noticed that they cannot upgrade because the Windows update procedure detects that the Windows install has been tampered with and it refuses to continue. This policy makes absolutely no sense.
- varjag 4y ago
  Since the policy is going an extra mile preventing something rather than simply not caring, it probably does make sense. Just in a way that's not trivial to anticipate.
- bee_rider 4y ago
  curl is used to download files… if it is missing, Windows presumably won’t be able to download something. If they just go for it anyway, the system could end up in some undefined state.
  - alkonaut 4y ago
    I doubt curl is involved in the windows update process itself (seeing as Windows Update is a lot older than the inclusion of curl in Windows)
- aflag 4y ago
  It does make sense, as the upgrade may break the system because of the tampering. Probably say upfront that there's a problem and let the user do a full reinstall when they can rather than attempt to upgrade and break everything. They could have a "force upgrade" button, but many people would just click that without thinking twice then blame MS when it breaks everything.
- dwattttt 4y ago
  Strictly speaking the update process isn't able to update to the new version without the existing file (https://devblogs.microsoft.com/oldnewthing/20200213-00/?p=103436 https://devblogs.microsoft.com/oldnewthing/20200213-00/?p=10...). As noted on the blog post, the solution is to run the system file checker (sfc) to repair it before running the update
Karellen 4y ago
> I don't even know who else to blame for this. The people who told them that deleting system binaries would fix their problems? > I have been pointed to responses on the Microsoft site answers.microsoft.com done by “helpful volunteers” that specifically recommend removing the curl.exe executable as a fix. Don't trust strangers on the internet with advice you don't understand the implications of. Even if they are sincere and mean well, they can still be wrong.
- phpisthebest 4y ago
  The problem here is that if they understand the implications they probably would not be on awnsers.microsoft.com in the first place
  - lodonnell9213 4y ago
    But that's the problem, the people doing this do not understand what curl is/does so want it gone because its got a CVE and some outlet somewhere has said its worse than what it is. if that's the case we should just delete the entire OS as there are vulns all over it.
- remram 4y ago
  > The people who told them that deleting system binaries would fix their problems? If you are responsible for the security posture and compliance in your organization, reading and acting on security assessments, and yet you do random changes based on random comments on forums, you deserve the blame. I don't think we're not talking about individual end-users here. Those do not scan their systems for CVEs and do not have a requirement to get to 0 alerts.
  - Karellen 4y ago
    > I don't think we're not talking about individual end-users here. Are you sure about that? From TFA: > Lots of Windows users everywhere runs security scanners on their systems with regular intervals in order to verify that their systems are fine. At some point after December 21, 2022, some of these scanners started to detect installations of curl that included the above mentioned CVE. Nessus apparently started this on February 23. > This is not helpful. > Lots of Windows users everywhere then started to panic when these security applications warned them about their vulnerable curl.exe. That sounded like it included individual end-users to me. Anectodally, I know a few Windows users who don't trust Microsoft to do security well, but can't bring themselves to move off Windows for whatever reason, so run 3rd party AV and security tools to help protect themselves.
alexb_ 4y ago
As mentioned in the article: >Many Windows users are even contractually “forced” to fix (all) such security warnings within a certain time period or risk bad consequences and penalties. So the blame would be on managers who think checking boxes is how every single job works.
- zaphar 4y ago
  Many times those managers are not responsible for the contractual obligation either. It's one of those comedy of errors type situations where no one single group is fully responsible but put all the decisions together and bad things result.
0xbadcafebee 4y ago
> I don't even know who else to blame for this. Microsoft. It's their binary shipped in their system, and their customers are being directed to break their own systems. It's on them to remediate the situation.
- zaphar 4y ago
  Not really. They aren't the ones directing customers to break their systems. They could ban anti-virus software and get slammed for being anti-competitive I suppose. Or they could try to track down all the vendors who are being stupid and ask them to please stop but that probably won't remediate it. They don't have a lot of moves here nor does the curl project.
  - 0xbadcafebee 4y ago
    Their platform (Windows) is getting a bad reputation due to the problem they neglected to fix (shipping a "vulnerable" curl, informing users when the old curl was getting flagged). They could pass the buck but it's just going to be bad for them later when users think Windows itself has security vulns and breaks itself when the users do what they're told to do by vendors. If they don't want the bad rep, they need to be proactive and work with vendors and better inform customers. If I was the CEO I'd do something about it.
- lodonnell9213 4y ago
  But Microsoft are not advising them to remove curl AFAIK, in that case Microsoft should fix every issue ever within Windows, even if its self inflicted. End of the day this as Daniel says is scare mongering by others who don't know what they are doing. The phrase, if someone told you to jump off a cliff, would you?, and, Your scientists were so preoccupied with whether or not they could, they didn't stop to think if they should...
archgoon 4y ago
[dead]
hiccuphippo 4y ago
How do I know which CVE is wacky and which isn't? Do we need another database for actually-real-CVEs?
- viraptor 4y ago
  Follow the links to the actual issue description and check if it makes sense in your context. While the current aggregators are not perfect, there will always be edge cases where you care about some issues more/less than someone else. The whole idea of having a single number has limitations.
- cratermoon 4y ago
  The last couple of CVEs I was forced to address were in docker images based on alpine or debian, in which the some library version on the system was hit with a High or Critical level CVE. But in reality the ability to exploit the vulnerability required being able to execute a particular program on the running system. The levels of exploit required to even get to being able to exploit this vulnerability in the context I was required to mitigate it meant that in reality, your systems have already been compromised even before this can be exploited. CVE numbers have exploded while their quality has declined partly due to things like company and project bug bounties, where individuals get bonuses internally for submitting CVEs that get an ID. There's a virtual army of people doing nothing but looking for subtle ways to exploit key tools just to be able to earn a bonus. Some bigger projects, like the linux kernel, dispute some CVEs (e.g. CVE-2023-23005) because they are b.s., but smaller projects don't have the luxury. See the curl maintainer's take on this: https://daniel.haxx.se/blog/2023/03/06/nvd-makes-up-vulnerability-severity-levels/ https://daniel.haxx.se/blog/2023/03/06/nvd-makes-up-vulnerab...
patrakov 4y ago
The UK government. This is a quote from the Cyber Essentials requirements (https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-for-Infrastructure-v3-0-January-2022.pdf https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-...): """ The Applicant must be active in its management of computers and network devices. It must routinely ... remove or disable unnecessary software (including applications, system utilities and network services) """ So, based on the quote above, curl.exe must be removed if it is not used, no matter whether it is vulnerable or not (yes I know it is a misreading, but it's frightening that the most literal interpretation is a misreading).

yourusername 4y ago

There are people responsible for the security of Windows systems in some organisations that do not understand their job. They look into their AV solution and it says vulnerable file detected on $x systems and they instruct their IT department to remove the file.

robertlagrant 4y ago
Indeed. Whole companies such as Crowdstrike exist just to sit in between automated tools and heavy-handed action based on tool output.
- hardware2win 4y ago
  Ive been actually impressed by Crowdstrike product (I guess) Ive tested a two or three years old Chrome version with JIT compiler vulnerability and guess what - on empty Linux vm it managed to escape chrome and execute code Meanwhile on Windows with Crowdstrike Chrome just showed some error message about mem. access Im not sure who handled that attack - was it Windows or Crowdstrike, but eitherway Ive been impressed

tyingq 4y ago

I'm guessing a common sequence is someone knowing what curl is, but not knowing that Windows ships with it. So, thinking that System32\curl.exe must have been put there by malware, or put there by someone installing optional software.

Freak_NL 4y ago
Microsoft should have renamed it to WINDLHLP.COM or something Windowsy like that, and none of these people would have dared touch it.
- tyingq 4y ago
  I noticed that "curl" in PowerShell is an alias, so you would have to deliberately say "curl.exe" to get System32\curl.exe C:\> alias curl CommandType Name Version Source ----------- ---- ------- ------ Alias curl -> Invoke-WebRequest
  - justeleblanc 4y ago
    That's not the case in the latest versions of powershell.
    - archgoon 4y ago
      [dead]
  - VWWHFSfQ 4y ago
    Yeah they did the same thing with wget. Just absolutely bonkers
  - phpisthebest 4y ago
    That is for Windows Powershell, not Powershell (and yes Windows Powershell is different from PowerShell [1]) curl > curl.exe > C:\Windows\System32\curl.exe [1] https://learn.microsoft.com/en-us/powershell/scripting/whats-new/differences-from-windows-powershell?view=powershell-7.3 https://learn.microsoft.com/en-us/powershell/scripting/whats...
    - thomasjudge 4y ago
      This is so Microsoft

thaumasiotes 4y ago

They deserve to not be allowed to restore their system to normal? > The people who deleted or replaced the curl executable noticed that they cannot upgrade because the Windows update procedure detects that the Windows install has been tampered with and it refuses to continue. This policy makes absolutely no sense.

varjag 4y ago
Since the policy is going an extra mile preventing something rather than simply not caring, it probably does make sense. Just in a way that's not trivial to anticipate.
bee_rider 4y ago
curl is used to download files… if it is missing, Windows presumably won’t be able to download something. If they just go for it anyway, the system could end up in some undefined state.
- alkonaut 4y ago
  I doubt curl is involved in the windows update process itself (seeing as Windows Update is a lot older than the inclusion of curl in Windows)
aflag 4y ago
It does make sense, as the upgrade may break the system because of the tampering. Probably say upfront that there's a problem and let the user do a full reinstall when they can rather than attempt to upgrade and break everything. They could have a "force upgrade" button, but many people would just click that without thinking twice then blame MS when it breaks everything.
dwattttt 4y ago
Strictly speaking the update process isn't able to update to the new version without the existing file (https://devblogs.microsoft.com/oldnewthing/20200213-00/?p=103436 https://devblogs.microsoft.com/oldnewthing/20200213-00/?p=10...). As noted on the blog post, the solution is to run the system file checker (sfc) to repair it before running the update

Karellen 4y ago

> I don't even know who else to blame for this. The people who told them that deleting system binaries would fix their problems? > I have been pointed to responses on the Microsoft site answers.microsoft.com done by “helpful volunteers” that specifically recommend removing the curl.exe executable as a fix. Don't trust strangers on the internet with advice you don't understand the implications of. Even if they are sincere and mean well, they can still be wrong.

phpisthebest 4y ago
The problem here is that if they understand the implications they probably would not be on awnsers.microsoft.com in the first place
- lodonnell9213 4y ago
  But that's the problem, the people doing this do not understand what curl is/does so want it gone because its got a CVE and some outlet somewhere has said its worse than what it is. if that's the case we should just delete the entire OS as there are vulns all over it.
remram 4y ago
> The people who told them that deleting system binaries would fix their problems? If you are responsible for the security posture and compliance in your organization, reading and acting on security assessments, and yet you do random changes based on random comments on forums, you deserve the blame. I don't think we're not talking about individual end-users here. Those do not scan their systems for CVEs and do not have a requirement to get to 0 alerts.
- Karellen 4y ago
  > I don't think we're not talking about individual end-users here. Are you sure about that? From TFA: > Lots of Windows users everywhere runs security scanners on their systems with regular intervals in order to verify that their systems are fine. At some point after December 21, 2022, some of these scanners started to detect installations of curl that included the above mentioned CVE. Nessus apparently started this on February 23. > This is not helpful. > Lots of Windows users everywhere then started to panic when these security applications warned them about their vulnerable curl.exe. That sounded like it included individual end-users to me. Anectodally, I know a few Windows users who don't trust Microsoft to do security well, but can't bring themselves to move off Windows for whatever reason, so run 3rd party AV and security tools to help protect themselves.

alexb_ 4y ago

As mentioned in the article: >Many Windows users are even contractually “forced” to fix (all) such security warnings within a certain time period or risk bad consequences and penalties. So the blame would be on managers who think checking boxes is how every single job works.

zaphar 4y ago
Many times those managers are not responsible for the contractual obligation either. It's one of those comedy of errors type situations where no one single group is fully responsible but put all the decisions together and bad things result.

0xbadcafebee 4y ago

> I don't even know who else to blame for this. Microsoft. It's their binary shipped in their system, and their customers are being directed to break their own systems. It's on them to remediate the situation.

zaphar 4y ago
Not really. They aren't the ones directing customers to break their systems. They could ban anti-virus software and get slammed for being anti-competitive I suppose. Or they could try to track down all the vendors who are being stupid and ask them to please stop but that probably won't remediate it. They don't have a lot of moves here nor does the curl project.
- 0xbadcafebee 4y ago
  Their platform (Windows) is getting a bad reputation due to the problem they neglected to fix (shipping a "vulnerable" curl, informing users when the old curl was getting flagged). They could pass the buck but it's just going to be bad for them later when users think Windows itself has security vulns and breaks itself when the users do what they're told to do by vendors. If they don't want the bad rep, they need to be proactive and work with vendors and better inform customers. If I was the CEO I'd do something about it.
lodonnell9213 4y ago
But Microsoft are not advising them to remove curl AFAIK, in that case Microsoft should fix every issue ever within Windows, even if its self inflicted. End of the day this as Daniel says is scare mongering by others who don't know what they are doing. The phrase, if someone told you to jump off a cliff, would you?, and, Your scientists were so preoccupied with whether or not they could, they didn't stop to think if they should...

archgoon 4y ago

[dead]

hiccuphippo 4y ago

How do I know which CVE is wacky and which isn't? Do we need another database for actually-real-CVEs?

viraptor 4y ago
Follow the links to the actual issue description and check if it makes sense in your context. While the current aggregators are not perfect, there will always be edge cases where you care about some issues more/less than someone else. The whole idea of having a single number has limitations.
cratermoon 4y ago
The last couple of CVEs I was forced to address were in docker images based on alpine or debian, in which the some library version on the system was hit with a High or Critical level CVE. But in reality the ability to exploit the vulnerability required being able to execute a particular program on the running system. The levels of exploit required to even get to being able to exploit this vulnerability in the context I was required to mitigate it meant that in reality, your systems have already been compromised even before this can be exploited. CVE numbers have exploded while their quality has declined partly due to things like company and project bug bounties, where individuals get bonuses internally for submitting CVEs that get an ID. There's a virtual army of people doing nothing but looking for subtle ways to exploit key tools just to be able to earn a bonus. Some bigger projects, like the linux kernel, dispute some CVEs (e.g. CVE-2023-23005) because they are b.s., but smaller projects don't have the luxury. See the curl maintainer's take on this: https://daniel.haxx.se/blog/2023/03/06/nvd-makes-up-vulnerability-severity-levels/ https://daniel.haxx.se/blog/2023/03/06/nvd-makes-up-vulnerab...

patrakov 4y ago

The UK government. This is a quote from the Cyber Essentials requirements (https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-for-Infrastructure-v3-0-January-2022.pdf https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-...): """ The Applicant must be active in its management of computers and network devices. It must routinely ... remove or disable unnecessary software (including applications, system utilities and network services) """ So, based on the quote above, curl.exe must be removed if it is not used, no matter whether it is vulnerable or not (yes I know it is a misreading, but it's frightening that the most literal interpretation is a misreading).