12 ms·

New Windows driver signature bypass allows kernel rootkit installs

305 points by sandwichsphinx 2y ago

tomrod 2y ago
I'm not by any means a security guru. I understand some basics, but I think I'm missing a conceptual model somewhere. What is it about Windows that makes it so damn hackable?
- mardifoufs 2y ago
  What do you mean by hackable? I can't really see how other operating systems (say, Linux+any distro) are more secure than windows fundamentally?
- pcdoodle 2y ago
  IMO: The backward compatibility and lots of hands touching many moving parts.
  - jsheard 2y ago
    Yep, the almost impenetrable security of the last few Xboxes shows that Microsoft does have it in them to architect a very secure platform, even against physical attacks, but they don't have the luxury of doing such a clean-slate design with Windows. They can almost never afford to break backwards compatibility and the Xbox approach of running each instance of legacy software in its own fully isolated virtual machine wouldn't really scale to a multitasking environment. For those not keeping score, the Xbox One only recently got a very limited jailbreak a decade after release, that only works on old firmware and only allows access to the innermost level of sandboxing, with the outer system sandbox, hypervisor, bootloader and optical drive handshake remaining unbroken to this day.
    - throwaway48476 2y ago
      The Xbox is 'secure', but against the user. There are a great many PC's out there that this model doesn't work for.
      - lock_it_down 2y ago
        It's secure against everyone, including the user. Windows could relax that part a bit if they wanted.
- high_priest 2y ago
  From my experience, it's that users are administrators by default. And it is super easy to convince them, to run anything with elevated permissions.
  - ajross 2y ago
    The exploit under discussion is an attack on Windows Update, it doesn't AFAICT involved running privileged code as the user. Also the default Windows user has been non-Administrator for many years now. It's true you can fool users into elevating a shell or whatever, but that's true for pretty much all platforms.
    - ethbr1 2y ago
      I'm happy to complain about Windows, but I will say their progress in converting their ecosystem to user-by-default with elevation prompt warnings has been impressive. Especially when they had to drag their developer community kicking and screaming to it. (in Windows Vista ~2006) Afaicr, there's also a neat bit where the lock screen and UAC prompt actually run under an entirely different, privileged and restricted session (than the normal one the user is interacting with and running programs in). Ref: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works#securing-the-elevation-prompt https://learn.microsoft.com/en-us/windows/security/applicati... Apparently now termed the "secure desktop", it's transparently overlaid on top of the user desktop whenever you see a prompt.
      - dimensi0nal 2y ago
        It's not a transparent overlay, it's a completely separate desktop with a screenshot of the user desktop as its background. Really clever.
        wongogue 2y ago
        And 50% of the times, the background fails to load and I have to double check. At first I thought it may be my specfic hardware combo but no.
- high_priest 2y ago
  [flagged]
- Citizen_Lame 2y ago
  It's not an error, it's by design. Only issue is these "vulnerabilities" were reserved for three letter agencies.
- peppermint_gum 2y ago
  What makes you think that it's "so damn hackable"? Also, this particular attack requires administrator privileges and bypasses a security boundary that doesn't even exist on e.g. Linux. Linux doesn't have driver signatures and root can easily install a new kernel module.
  - privacymatters4 2y ago
    Just a quick look at 2024's CVEs, 0days for Windows is a security nightmare. Not singling out Windows specifically, but they have a lot. Browsers only just recently patched browsers being able to be served javascript that scans local devices on 10.* and 192.168.* etc hitting IoT devices with exploits and payloads, hell even hitting open listening sockets on localhost and 0.0.0.0 -- that's cross platform, how many years did that go under the radar? And now Windows is getting 'Recall' which will monitor and scan your every PC action to remember it for you using ML; I don't see that going back at all /s
    - gruez 2y ago
      >Browsers only just recently patched browsers being able to be served javascript that scans local devices on 10.* and 192.168.* etc hitting IoT devices with exploits and payloads, hell even hitting open listening sockets on localhost and 0.0.0.0 -- that's cross platform, how many years did that go under the radar? Ironically windows was not hit by that, but the "secure"(?) operating systems of mac and linux were.
  - formerly_proven 2y ago
    > Linux doesn't have driver signatures and root can easily install a new kernel module. Linux supports signed kernel modules (and not just on paper, this is a widely deployed feature).
    - NekkoDroid 2y ago
      Yep, when booting with secure boot the kernel won't load any unsigned drivers.
- beeboobaa3 2y ago
  It allows it's users to actually use their computer as a computer instead of a glorified phone. MacOS nannies you left and right, preventing you from doing things you want to do because Apple says no. Windows historically didn't have such restrictions because it's a desktop operating system and not a gimped phone. They're slowly being added, but it takes time to overhaul an entire architecture while maintaining backwards compatibility (which MacOS also doesn't care about at all). Linux is of course far more "hackable" but there aren't as many computer illiterates using it.
  - bubblesnort 2y ago
    I let the illiterates use it, but if they don't need root they don't get root. Debian stable with auto-unattend.
  - survivedurcode 2y ago
    LOL you should be upvoted as your comment perfectly captures the blind arrogance of the software industry. When you call people computer illiterate, you are blind to the technocrat injustice imparted onto the general populace. > The obnoxious behavior and obscure interaction that software-based products exhibit is institutionalizing what I call "software apartheid":” > ― Alan Cooper, The Inmates Are Running the Asylum: Why High Tech Products Drive Us Crazy and How to Restore the Sanity > “When programmers speak of "computer literacy," they are drawing red lines around ethnic groups, too, yet few have pointed this out.” > ― Alan Cooper, The Inmates Are Running the Asylum: Why High Tech Products Drive Us Crazy and How to Restore the Sanity You too can see the light and rise above the elitism of computer literacy. You know, there are many smart people that are too prideful to put up with what computer people demand as computer literacy. They suffer in silence, you will not have their loyalty, and they will switch to competing software the moment they are able to.
    - beeboobaa3 2y ago
      What? I never said being computer illiterate is bad. Plenty of fine people are computer illiterate. And plenty of fine people are fantastic at things I'll never be good at. That's fine.
- nwellinghoff 2y ago
  Can’t believe people have not pointed out the biggest reason of them all. Its the most widely deployed desktop os across rich targets (corporations). A lot of time and investment goes into cracking it.
  - Jerrrrrrry 2y ago
    [flagged]
    - throwaway48476 2y ago
      For a while apple had better security. Now it's more even, if you go by the 0day prices. There's not a lot of truly secure options unless you wanted to develop your own phone from the ground up.
      - beng-nl 2y ago
        How about iPhone in lockdown mode?
        Jerrrrrrry 2y ago
        [flagged]
      - edm0nd 2y ago
        GrapheneOS has been doing a lot of great work in the secure mobile OS space.
        Jerrrrrrry 2y ago
        Yeah its a chilling effect where anything useful enough to get popular gets assumed to be compromised. It seems unfalsifiable but it's also not unlikely.
    - cruffle_duffle 2y ago
      Wait until all those regulations requiring apple to allow different app stores come online and then we will see how secure iOS is. The day Joe Clicks-A-Lot can follow a link in some random pig butchering scam email then “legally” sideload and run whatever crazy weird goop happens to be at other end will really put things to the test. Because letting Susie Easy-To-Phish install anything and everything on her iPhone is going to make things very… interesting. That being said, Joe and Susie can already do that on android right?
- n_plus_1_acc 2y ago
  Tens of millions LOC in legacy C++ with many many compatability layers.
- robhlt 2y ago
  The prevalence of 3rd party kernel-level code is an important factor too. Lots of windows malware relies on a vulnerable 3rd party kernel driver at some point. By comparison, 3rd party kernel modules are rare and looked down upon on Linux and outright banned on macOS.
  - makeitdouble 2y ago
    To note, Windows isn't allowed to completely block third party kernel code. I don't have the reference at hand but it was part of their various anti-trust fallout, as it would give them an unfair advantage regarding to their own products. PS: an analysis of that situation during the Crowdstrike issue, with the relevant bits of the EU ruling: https://www.computerweekly.com/news/366598838/Why-is-CrowdStrike-allowed-to-run-in-the-Windows-kernel https://www.computerweekly.com/news/366598838/Why-is-CrowdSt...
    - spockz 2y ago
      What might be enough is to have windows required to boot in a “install” mode before 3rd party kernel code can be added.
    - LinXitoW 2y ago
      IANAL, but this seems more like a classic temper tantrum thrown by a big corp over reasonable legislation. They could offer an API for security relevant scanning for EVERYONE, including their own antivirus software. But that would make the world better, and make the legislation look justified. It's the exact same thing with the Google Maps integration on Google Search. They could offer an API and a selection of map provider to the user. That would make Google Search better for the user AND enable competition. Instead they threw a temper tantrum and disabled map integration entirely, so they can blame the EU.
      - dwattttt 2y ago
        > They could offer an API for security relevant scanning for EVERYONE, including their own antivirus software I mean, they have _lots_ of APIs. You'll just never have as much control from usermode as you will from the kernel; what API would make you say "yep, don't need a driver now, can do security fine from user"?
- throwaway48476 2y ago
  The problem is that windows was developed before security was important. No one has made the necessary investments to create a truly secure computing platform. Ideally a secure computing platform would have reproducible builds built on public inspectable infrastructure like fdroid. It would also virtualize all untrusted applications in a sandbox and implement the least privilege model. Today we have the worst security. There is unknown, probably untested and insecure code running at every ring, from the CPU's ME, to the UEFI components, to the OS 3rd party drivers. SeL4 has a fully verified kernel but it doesn't do virtualization yet.
  - pjmlp 2y ago
    The same can be told of UNIX, lets not forget the first worm was targeted at UNIX systems, and the root cause keeps being a regular CVE in C and C++ projects.
    - throwaway48476 2y ago
      Of course. A new secure computing platform would have to be built from scratch and from secure primitives that would not be backwards compatible with anything outside of virtualized emulation.
    - ddtaylor 2y ago
      When that worm was created Windows did not exist.
      - pjmlp 2y ago
        And yet the root cause for it still hasn't been fixed in UNIX systems.
        anthk 2y ago
        If you consider plan9/9front Unix 2.0, they did with namespaces.
- Hilift 2y ago
  The driver signing blacklist file DriverSiPolicy.p7b had not been updated for years. It took a CERT analyst (Will Dormann) to ask why in 2022. It's being updated regularly now, but WTF. https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-vulnerable-driver-blocklist-sync-issue/ https://www.bleepingcomputer.com/news/microsoft/microsoft-fi...
- marcosdumay 2y ago
  In principle, there's something about Windows object system being much a much more complex abstraction than Unix's streams. But the reality is not that. Windows is just surrounded by layers and layers of bad code with atrocious interfaces. Any architectural weakness doesn't even register.
- gosub100 2y ago
  - The EULA absolves Microsoft of any liability whatsoever. So they share in none of the risk. Imagine if physical items were like this: hit one bump and your pickup is destroyed. Scissors fall apart irreparably once they contact any material that's not paper. - MS putting backwards compatibility (mainly done for business customers) above everything, at all costs. The peanut butter factory in Indiana that's been running WFW since '89 must never be inconvenienced, even if it means tens of thousands of people have to take their brand new computers to the shop (at their own cost!) multiple times per year because of spyware infections. - Not valuing innovation. A culture where engineers are just a necessity to keep the money-making machine running. All the excitement was drained about the end of the '90s. They made a couple nominal hits with the Surface, Xbox, and Azure, not going to discount that.
- ruthmarx 2y ago
  Windows isn't especially hackable, they've been taking security seriously and doing a decent job for at least a decade, and honestly these days it's a lot better than the alternatives. Really the issue is because it's used on something like 95% of desktops. More eyes on windows means more bugs being found.
  - a_vanderbilt 2y ago
    A lot better than the alternatives in terms of security? Even if we only consider alternatives in wide use like ChromeOS or macOS, I wouldn't in any serious way consider Windows to be more secure. More compatible yes, but not more secure.
    - ruthmarx 2y ago
      It has a significantly better security architecture than macOS, and Linux is a mess as far as desktop use goes. Can't speak to ChromeOS but I understand that's pretty locked down, and honestly that could possibly take the lead, although I was only really thinking of Linux, Mac and Windows.
      - a_vanderbilt 2y ago
        Linux definitely exists in a weird limbo. While it can be secured to an extreme degree, most people aren't using Linux that way on personal devices. Especially on a desktop. ChromeOS is quite secure since it is so locked down, but imagine getting the average Linux user to like it. Curious as to your rationale for the security architecture of macOS being inferior. Is it because of the way the security features are implemented that you lean that way? macOS has its warts, but it also has plenty of security features I'm not aware of Windows/NT having.
        ruthmarx 2y ago
        > Linux definitely exists in a weird limbo. While it can be secured to an extreme degree, most people aren't using Linux that way on personal devices.v For sure. I think my minimal Alpine desktop with well defined SELinux policies is better than Windows or macOS, but most people are using Ubuntu or similar which doesn't have anything like that (AppArmor helps somewhat), and doesn't really have any of the security innovations macOS or Windows have. > Curious as to your rationale for the security architecture of macOS being inferior. Is it because of the way the security features are implemented that you lean that way? macOS has its warts, but it also has plenty of security features I'm not aware of Windows/NT having. I will say I'm a little out of date on new features macOS may have introduced, but back in the day I remember them not even having a proper ASLR implementation, no form of MAC, nothing even close to things like Windows Secure Desktop[1] etc. Microsoft had a well deserved horrible reputation, but they really put in a lot of effort to turn things around, and I think they succeeded but without getting due credit from most techies. Whereas Apple it seemed like were coasting on the fact that macs were not nearly as targeted as a platform. [1] https://learn.microsoft.com/en-us/archive/blogs/uac/user-account-control-prompts-on-the-secure-desktop https://learn.microsoft.com/en-us/archive/blogs/uac/user-acc...
the_arun 2y ago
Hard to believe Microsoft is disagreeing when there is a demo. In that Vimeo account there are ton of other security discoveries. Eg WhatsApp running python script. Is this real or scam?
- 9029 2y ago
  Well the demo is showing a crossing of something that ms has defined to not be a real security boundary: "Administrative processes and users are considered part of the Trusted Computing Base (TCB) for Windows and are therefore not strong isolated from the kernel boundary." [0] Another recent case: https://arstechnica.com/security/2024/03/hackers-exploited-windows-0-day-for-6-months-after-microsoft-knew-of-it/ https://arstechnica.com/security/2024/03/hackers-exploited-w... [0] https://www.microsoft.com/en-us/msrc/windows-security-servicing-criteria https://www.microsoft.com/en-us/msrc/windows-security-servic...
  - morpheuskafka 2y ago
    On the Linux side, SELinux which sets guardrails on the root user at the kernel level is mandatory for protecting classified information. Thus, there is most certainly a security boundary between root, let alone regular users with "admin" groups/perms, and the kernel. How can Windows, which is used all over the government, have a policy that admin users can do whatever they want with the kernel without it being a security vulnerability?
    - dwattttt 2y ago
      Because their policy is to not give admin to a user if you don't want them to have control of the computer?
      - kchr 2y ago
        Even approved and trusted admins can be a liability (disgruntled employee, social engineering). Like OP said, mandatory access control (MAC) implementations like SELinux can be used to even further restrict what an administrator (or process running with admin privileges) is allowed to do.
mrinfinitiesx 2y ago
The owner of this website (www.bleepingcomputer.com) has banned your IP address (IP) K. edit: VPN, ssh -D to vps & socks5 localhost worked. Can't have anything anymore.
- alpaca128 2y ago
  If you have a dynamic IP it was probably banned because of someone else who had it in the past.
  - dkasper 2y ago
    Haunted IPs are a thing, same as the haunted domains article also on the front page right now! https://news.ycombinator.com/item?id=41951131 https://news.ycombinator.com/item?id=41951131
  - worewood 2y ago
    With widespread CGNAT and the exhaustion of IPv4 addresses this will become more and more common each day...
- deleted 2y ago
  [deleted]
- snvzz 2y ago
  Headscale, the open source backend alternative to tailscale, which frontend is open source to begin with, is worth looking into.
- a2128 2y ago
  In the future, everything will block you unless you're on a residential IP address in a Western country, running Chrome on the latest version of Windows or iOS, you have remote attestation, and your ISP's ASN isn't haunted because someone in your neighborhood had downloaded malware a few years ago
  - perching_aix 2y ago
    You mean MacOS, and I'll block that too :)
ajross 2y ago
Seems like the attack is suspiciously simple: Fool the update process into installing old versions of kernel components with known vulnerabilities. I'm no expert, but surely MS has already thought about this and has a blacklist or revocation facility or whatever? Is the root cause here an OS design issue or just a process failure where they failed to note the broken/bad hashes in the correct spot? The latter is much easier to fix, but the (slightly spun, as always) security announcement seems to claim the former.
- SoftTalker 2y ago
  Maybe they have to allow downgrades because enterprise users will insist on being able to downgrade if an update breaks something?
  - marcosdumay 2y ago
    Windows automatically downgrades when an update breaks everything... And then schedules the update again... What is a fairly common thing to happen...
bubblesnort 2y ago
> possible by gaining kernel code execution as an administrator The root user can install rootkits as usual. Don't forget to brand it a cool name.... Oh wait: > The researcher published a tool called Windows Downdate There you go, here's your 0xF minutes of fame, well played.
- jojonas 2y ago
  The concept that there is a root/superuser account that can do anything they like is quite a common one, but it is an OS design choice. Any user account is just an object in the operating system and one can as well design an OS that enforces certain rules against all user accounts, even if that means limiting superuser accounts. Legitimate reasons I can think of would be for example to protect certain secrets even in the event of an administrator compromise (like a TPM) or just to prevent administrators from accidentally messing up their systems to an extent that they wouldn't boot. Another (more controversial) goal is to enforce DRM. Anyways, that's exactly what Microsoft is attempting to do with Windows: the OS tries to prevent administrative accounts from interfering with the kernel/installing rootkits (for whatever reason). Also note that it's always important in this discussion to differentiate between administrative user accounts (in the OS) and "administrators" (people) with physical/hardware access.
- ruthmarx 2y ago
  > here's your 0xF minutes Writing '15' would have been easier here. Nothing wrong with writing 0xF but it's a weird choice that irked my curiosity. You just did it for style reasons?
  - ddingus 2y ago
    > here's your $F minutes Another weird choice, different syntax. I triggered a little when I saw the comment too. 0xF has always been hard to read for me. $F is hard to read for others, and it all seems to depend on where and on what we all started with.
    - ruthmarx 2y ago
thrtythreeforty 2y ago
I'm kind of with Microsoft on this one: the administrator can do arbitrary things to the computer, film at 11. Is there a nuance that I'm missing that raises the severity of this? See also Raymond Chen's summary of this class of attack: https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283 https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...
- kgeist 2y ago
  My thought exactly. If someone is already able to replace arbitrary DLLs on the system (a precondition for this "exploit" to work), all bets are off, and their ability to bypass driver signatures is probably the least of your concerns.
  - jeroenhd 2y ago
    In practice there's no good defence against this, but Windows is designed to protect itself against these kinds of attacks if all components work together. With secure boot + driver signature validation + DLL signature validation, you can't just run any code by putting it in a DLL file. You're not hacking any normal computer by replacing user32.dll with virus.dll. Downgrade protection is quite a hard problem to solve without at least breaking the automatic recovery tools. In theory Microsoft could register the versions of every system file somewhere, sign+hash that, and store it some place secure, but then they'd need to deal with reverts of system components after a failed update or restored system images becoming unbootable. In practice, I don't see the use case for this attack, though. You can just put a legitimate, signed driver with a known exploit inside your executable and load that. Microsoft chooses to keep unpatched, vulnerable drivers rather than break hardware support for millions of users.
    - unnouinceput 2y ago
      Which is the wrong path IMO. If users want to shoot themselves in the foot, let them do it. The only way to learn responsibility is to let get their systems pawnd. Maybe they will finally learn the Linux way - never login as admin, always as normal user. You want admin login? Cool, then the "su" equivalent in Windows is called "runas".
quotemstr 2y ago
So the kernel is enforcing file sharing rules (mandatory locking, in effect) by scanning on open all open file handles for conflicting mandatory locks, but doesn't check for memory mappings of these files with conflicting permissions. Oops. Seems like a straightforward fix though. It's worth noting that Linux just got rid of its last vestige of mandatory locking. Now you can write a loaded executable without getting EBUSY. Interesting how exactly the same feature on one OS can be a load bearing part of the security infrastructure and on another OS legacy crud to be deleted.
fullspectrumdev 2y ago
So what’s interesting is MS say that UAC isn’t a security boundary. Which is some users to admin. Then they say admin to kernel (in this case) isn’t a security boundary. While also saying that driver signing enforcement is a security feature. Which is what’s being bypassed here. But they claim in this case it’s not crossing a security boundary. Please make sense.
- prettyStandard 2y ago
  This is a value system disagreement. I have a theory that there's basically two types of disagreements, disagreements on definitions, and disagreements on value systems. In this case Microsoft values downplaying this issue, so when that is at the top of their value system their decisions should make sense following that. Since this is just a pet theory I'm very interested to hear critiques on it. Disagreements on definition are a little bit easier, because then you can just talk about the definitions and resolve your differences there... For example let's say IDK You're trying to sort out how to design a software system, and everyone is speaking in terms of design patterns, but they haven't yet spelled out the details of what those designed patterns are, then that could probably lead to a lot of confusion if when you say A I think of A', and another person is thinking of A''.
  - Buttons840 2y ago
    I like this. I first noticed this with gay marriage. Some would say "gay people should be able to do what they want and form 'civil unions' with all the tax and contractual benefits and requirements of marriage, but they shouldn't be able to get 'married'". For these people, it was all about the definition of a word. Other people opposed gay marriage because it went against their values. No matter what you wanted to call it, they were opposed to gay people living together and sharing their lives. I chose this example because it's the first time I noticed that some disagreements are about the definition of a word, and it's an especially clear example of that. It's silly how huge disagreements about a single word can become. There are also people who disguise their value disagreement as a definition disagreement. This is a form of bad faith arguing.
quotemstr 2y ago
It's also interesting how on both Windows and Linux normal-privilege local accounts are, practically, root equivalent. In Linux, we train people to type "sudo" in front of anything system relevant. On Windows, we train users to click through UAC prompts. When was the last time sudo said "no" to somebody for a reason other than a password typo? (UAC is marginally better than sudo: UAC is system managed UI, while sudo is just a program. An attacker can plug in a malicious shell alias for sudo and steal your password.) IMHO, it'd be more convenient for users and more reflective of actual security posture to get rid of both sudo and UAC (in the default setup of course) and stop pretending that there's a firm security boundary between root and the primary human local user account.
- a2128 2y ago
  On Linux, most modern user-facing applications are using polkit instead of sudo. You can actually just use pkexec instead of sudo in the terminal as well. Instead of just running arbitrary commands as root, applications can use specific pre-defined actions like "org.freedesktop.udisks2.filesystem-mount". This shows a nice localized message to the end user about what the app is trying to do, so they can decide whether to allow it or not. The system administrator can also configure certain actions to not even require authentication, useful for e.g. flatpak updates, or to block certain actions altogether.
- adrian_b 2y ago
  On Linux, I do not install sudo, because I do not need very often to become root, and when I need that I usually want to do multiple operations. I believe that "sudo" is useful only on multi-user computers (including company-owned and company-managed computers), where the administrator may want to give to some users the power to do only a restricted set of privileged operations. I always use a different user account than root, mainly not for security, but to avoid any accidental mistakes, when I could delete or overwrite other files than intended. I believe that this is a good enough reason to justify the need to type infrequently a password in order to change roles.
- dwattttt 2y ago
  I think an equivalent way to phrase this that feels very different is: "On both Windows and Linux the default installed users are, practically, root equivalent". I guess on the basis that the user performing the installation should be in control of the system (I mean, they are; they could've just not done the installation. Where are your access controls now, blank system!) > When was the last time sudo said "no" to somebody for a reason other than a password typo? Sudo doesn't say no to people, much like UAC doesn't say "no" to people. In both cases, people (admins) are meant to say "no" when they don't expect to be performing an administrative operation. People who are not admins and yet need to do such operations need an administrator to authorise it. In both cases, if it's not a single-person system, whoever is setting the machine up should be setting up limited accounts for regular use.
TheRealPomax 2y ago
it also allows tampering with Windows 11 to actually make it a better OS because it bypasses all the Microsoft lockdown bullshit, but let's focus on the rootkits instead.
- Sakos 2y ago
  I've noticed that a surprising number of people here on HN are in favour of locking down Windows and preventing any kernel access at all to Windows users. It reeks of the "think of the children" arguments.
  - lock_it_down 2y ago
    No, as a user which has no need for kernel access I want it locked down so the real things I care about, my data, is more secure. It's called security in depth.
    - Sakos 2y ago
      As a user who does have need for kernel access, because it's my god damn system and not yours, Microsoft's or anybody else's, I don't want it locked down. It's called security in depth. That means you don't need to prevent all kernel access for users, because there are layers of defense.
      - ruthmarx 2y ago
        > As a user who does have need for kernel access, Why do you need it?
    - TheRealPomax 2y ago
      But you know what's even better? Having a choice. Want to lock down Windows? You should have that power. It would be absolutely idiotic if you couldn't secure a computer. But, do you want to fuck with the kernel, patch out something you think should never be called by anything because there is no legitimate use case? You should also have that power. Because one thing that stuff like this doesn't do is "make it easier for the bad guys": want to deliver a malicious payload by exploiting Windows, either because of its design or a recently found vector? I hope you die in a fire but you already have so many options that this one really doesn't give you more power than before. It's just another option in a litany of options. After all, Windows is only as safe as its users with admin powers, which is literally every home user thanks to elevated access being a single "ok" button, if they even have UAC still turned on "because it's so annoying".
de6u99er 2y ago
When I have to use Windows I always assume the computer has been compromised.
wslh 2y ago
Wow! I remember the hard time we all had at [1] (doing deep packet inspection drivers for [2]). when Microsoft first required driver signing in Windows. The workflow seemed, at first glance, even tougher than getting an app approved on the Apple Store, with documentation that was far from clear. Personally, this feels like a huge setback considering the resources companies have poured into complying with Microsoft’s requirements, only to see it exploited in this way. Of course, vulnerabilities are always out there, but it would have been reassuring if someone had uncovered this one earlier. Kudos to Alon Leviev and SafeBreach for discovering it. [1] https://www.nektra.com/ https://www.nektra.com/ [2] https://www.verizon.com/business/en-nl/products/security/managed-detection-response-services/network-detection-response/ https://www.verizon.com/business/en-nl/products/security/man...

I'm not by any means a security guru. I understand some basics, but I think I'm missing a conceptual model somewhere. What is it about Windows that makes it so damn hackable?

mardifoufs 2y ago
What do you mean by hackable? I can't really see how other operating systems (say, Linux+any distro) are more secure than windows fundamentally?
pcdoodle 2y ago
IMO: The backward compatibility and lots of hands touching many moving parts.
- jsheard 2y ago
  Yep, the almost impenetrable security of the last few Xboxes shows that Microsoft does have it in them to architect a very secure platform, even against physical attacks, but they don't have the luxury of doing such a clean-slate design with Windows. They can almost never afford to break backwards compatibility and the Xbox approach of running each instance of legacy software in its own fully isolated virtual machine wouldn't really scale to a multitasking environment. For those not keeping score, the Xbox One only recently got a very limited jailbreak a decade after release, that only works on old firmware and only allows access to the innermost level of sandboxing, with the outer system sandbox, hypervisor, bootloader and optical drive handshake remaining unbroken to this day.
  - throwaway48476 2y ago
    The Xbox is 'secure', but against the user. There are a great many PC's out there that this model doesn't work for.
    - lock_it_down 2y ago
      It's secure against everyone, including the user. Windows could relax that part a bit if they wanted.
high_priest 2y ago
From my experience, it's that users are administrators by default. And it is super easy to convince them, to run anything with elevated permissions.
- ajross 2y ago
  The exploit under discussion is an attack on Windows Update, it doesn't AFAICT involved running privileged code as the user. Also the default Windows user has been non-Administrator for many years now. It's true you can fool users into elevating a shell or whatever, but that's true for pretty much all platforms.
  - ethbr1 2y ago
    I'm happy to complain about Windows, but I will say their progress in converting their ecosystem to user-by-default with elevation prompt warnings has been impressive. Especially when they had to drag their developer community kicking and screaming to it. (in Windows Vista ~2006) Afaicr, there's also a neat bit where the lock screen and UAC prompt actually run under an entirely different, privileged and restricted session (than the normal one the user is interacting with and running programs in). Ref: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works#securing-the-elevation-prompt https://learn.microsoft.com/en-us/windows/security/applicati... Apparently now termed the "secure desktop", it's transparently overlaid on top of the user desktop whenever you see a prompt.
    - dimensi0nal 2y ago
      It's not a transparent overlay, it's a completely separate desktop with a screenshot of the user desktop as its background. Really clever.
      - wongogue 2y ago
        And 50% of the times, the background fails to load and I have to double check. At first I thought it may be my specfic hardware combo but no.
high_priest 2y ago
[flagged]
Citizen_Lame 2y ago
It's not an error, it's by design. Only issue is these "vulnerabilities" were reserved for three letter agencies.
peppermint_gum 2y ago
What makes you think that it's "so damn hackable"? Also, this particular attack requires administrator privileges and bypasses a security boundary that doesn't even exist on e.g. Linux. Linux doesn't have driver signatures and root can easily install a new kernel module.
- privacymatters4 2y ago
  Just a quick look at 2024's CVEs, 0days for Windows is a security nightmare. Not singling out Windows specifically, but they have a lot. Browsers only just recently patched browsers being able to be served javascript that scans local devices on 10.* and 192.168.* etc hitting IoT devices with exploits and payloads, hell even hitting open listening sockets on localhost and 0.0.0.0 -- that's cross platform, how many years did that go under the radar? And now Windows is getting 'Recall' which will monitor and scan your every PC action to remember it for you using ML; I don't see that going back at all /s
  - gruez 2y ago
    >Browsers only just recently patched browsers being able to be served javascript that scans local devices on 10.* and 192.168.* etc hitting IoT devices with exploits and payloads, hell even hitting open listening sockets on localhost and 0.0.0.0 -- that's cross platform, how many years did that go under the radar? Ironically windows was not hit by that, but the "secure"(?) operating systems of mac and linux were.
- formerly_proven 2y ago
  > Linux doesn't have driver signatures and root can easily install a new kernel module. Linux supports signed kernel modules (and not just on paper, this is a widely deployed feature).
  - NekkoDroid 2y ago
    Yep, when booting with secure boot the kernel won't load any unsigned drivers.
beeboobaa3 2y ago
It allows it's users to actually use their computer as a computer instead of a glorified phone. MacOS nannies you left and right, preventing you from doing things you want to do because Apple says no. Windows historically didn't have such restrictions because it's a desktop operating system and not a gimped phone. They're slowly being added, but it takes time to overhaul an entire architecture while maintaining backwards compatibility (which MacOS also doesn't care about at all). Linux is of course far more "hackable" but there aren't as many computer illiterates using it.
- bubblesnort 2y ago
  I let the illiterates use it, but if they don't need root they don't get root. Debian stable with auto-unattend.
- survivedurcode 2y ago
  LOL you should be upvoted as your comment perfectly captures the blind arrogance of the software industry. When you call people computer illiterate, you are blind to the technocrat injustice imparted onto the general populace. > The obnoxious behavior and obscure interaction that software-based products exhibit is institutionalizing what I call "software apartheid":” > ― Alan Cooper, The Inmates Are Running the Asylum: Why High Tech Products Drive Us Crazy and How to Restore the Sanity > “When programmers speak of "computer literacy," they are drawing red lines around ethnic groups, too, yet few have pointed this out.” > ― Alan Cooper, The Inmates Are Running the Asylum: Why High Tech Products Drive Us Crazy and How to Restore the Sanity You too can see the light and rise above the elitism of computer literacy. You know, there are many smart people that are too prideful to put up with what computer people demand as computer literacy. They suffer in silence, you will not have their loyalty, and they will switch to competing software the moment they are able to.
  - beeboobaa3 2y ago
    What? I never said being computer illiterate is bad. Plenty of fine people are computer illiterate. And plenty of fine people are fantastic at things I'll never be good at. That's fine.
nwellinghoff 2y ago
Can’t believe people have not pointed out the biggest reason of them all. Its the most widely deployed desktop os across rich targets (corporations). A lot of time and investment goes into cracking it.
- Jerrrrrrry 2y ago
  [flagged]
  - throwaway48476 2y ago
    For a while apple had better security. Now it's more even, if you go by the 0day prices. There's not a lot of truly secure options unless you wanted to develop your own phone from the ground up.
    - beng-nl 2y ago
      How about iPhone in lockdown mode?
      - Jerrrrrrry 2y ago
        [flagged]
    - edm0nd 2y ago
      GrapheneOS has been doing a lot of great work in the secure mobile OS space.
      - Jerrrrrrry 2y ago
        Yeah its a chilling effect where anything useful enough to get popular gets assumed to be compromised. It seems unfalsifiable but it's also not unlikely.
  - cruffle_duffle 2y ago
    Wait until all those regulations requiring apple to allow different app stores come online and then we will see how secure iOS is. The day Joe Clicks-A-Lot can follow a link in some random pig butchering scam email then “legally” sideload and run whatever crazy weird goop happens to be at other end will really put things to the test. Because letting Susie Easy-To-Phish install anything and everything on her iPhone is going to make things very… interesting. That being said, Joe and Susie can already do that on android right?
n_plus_1_acc 2y ago
Tens of millions LOC in legacy C++ with many many compatability layers.
robhlt 2y ago
The prevalence of 3rd party kernel-level code is an important factor too. Lots of windows malware relies on a vulnerable 3rd party kernel driver at some point. By comparison, 3rd party kernel modules are rare and looked down upon on Linux and outright banned on macOS.
- makeitdouble 2y ago
  To note, Windows isn't allowed to completely block third party kernel code. I don't have the reference at hand but it was part of their various anti-trust fallout, as it would give them an unfair advantage regarding to their own products. PS: an analysis of that situation during the Crowdstrike issue, with the relevant bits of the EU ruling: https://www.computerweekly.com/news/366598838/Why-is-CrowdStrike-allowed-to-run-in-the-Windows-kernel https://www.computerweekly.com/news/366598838/Why-is-CrowdSt...
  - spockz 2y ago
    What might be enough is to have windows required to boot in a “install” mode before 3rd party kernel code can be added.
  - LinXitoW 2y ago
    IANAL, but this seems more like a classic temper tantrum thrown by a big corp over reasonable legislation. They could offer an API for security relevant scanning for EVERYONE, including their own antivirus software. But that would make the world better, and make the legislation look justified. It's the exact same thing with the Google Maps integration on Google Search. They could offer an API and a selection of map provider to the user. That would make Google Search better for the user AND enable competition. Instead they threw a temper tantrum and disabled map integration entirely, so they can blame the EU.
    - dwattttt 2y ago
      > They could offer an API for security relevant scanning for EVERYONE, including their own antivirus software I mean, they have _lots_ of APIs. You'll just never have as much control from usermode as you will from the kernel; what API would make you say "yep, don't need a driver now, can do security fine from user"?
throwaway48476 2y ago
The problem is that windows was developed before security was important. No one has made the necessary investments to create a truly secure computing platform. Ideally a secure computing platform would have reproducible builds built on public inspectable infrastructure like fdroid. It would also virtualize all untrusted applications in a sandbox and implement the least privilege model. Today we have the worst security. There is unknown, probably untested and insecure code running at every ring, from the CPU's ME, to the UEFI components, to the OS 3rd party drivers. SeL4 has a fully verified kernel but it doesn't do virtualization yet.
- pjmlp 2y ago
  The same can be told of UNIX, lets not forget the first worm was targeted at UNIX systems, and the root cause keeps being a regular CVE in C and C++ projects.
  - throwaway48476 2y ago
    Of course. A new secure computing platform would have to be built from scratch and from secure primitives that would not be backwards compatible with anything outside of virtualized emulation.
  - ddtaylor 2y ago
    When that worm was created Windows did not exist.
    - pjmlp 2y ago
      And yet the root cause for it still hasn't been fixed in UNIX systems.
      - anthk 2y ago
        If you consider plan9/9front Unix 2.0, they did with namespaces.
Hilift 2y ago
The driver signing blacklist file DriverSiPolicy.p7b had not been updated for years. It took a CERT analyst (Will Dormann) to ask why in 2022. It's being updated regularly now, but WTF. https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-vulnerable-driver-blocklist-sync-issue/ https://www.bleepingcomputer.com/news/microsoft/microsoft-fi...
marcosdumay 2y ago
In principle, there's something about Windows object system being much a much more complex abstraction than Unix's streams. But the reality is not that. Windows is just surrounded by layers and layers of bad code with atrocious interfaces. Any architectural weakness doesn't even register.
gosub100 2y ago
- The EULA absolves Microsoft of any liability whatsoever. So they share in none of the risk. Imagine if physical items were like this: hit one bump and your pickup is destroyed. Scissors fall apart irreparably once they contact any material that's not paper. - MS putting backwards compatibility (mainly done for business customers) above everything, at all costs. The peanut butter factory in Indiana that's been running WFW since '89 must never be inconvenienced, even if it means tens of thousands of people have to take their brand new computers to the shop (at their own cost!) multiple times per year because of spyware infections. - Not valuing innovation. A culture where engineers are just a necessity to keep the money-making machine running. All the excitement was drained about the end of the '90s. They made a couple nominal hits with the Surface, Xbox, and Azure, not going to discount that.
ruthmarx 2y ago
Windows isn't especially hackable, they've been taking security seriously and doing a decent job for at least a decade, and honestly these days it's a lot better than the alternatives. Really the issue is because it's used on something like 95% of desktops. More eyes on windows means more bugs being found.
- a_vanderbilt 2y ago
  A lot better than the alternatives in terms of security? Even if we only consider alternatives in wide use like ChromeOS or macOS, I wouldn't in any serious way consider Windows to be more secure. More compatible yes, but not more secure.
  - ruthmarx 2y ago
    It has a significantly better security architecture than macOS, and Linux is a mess as far as desktop use goes. Can't speak to ChromeOS but I understand that's pretty locked down, and honestly that could possibly take the lead, although I was only really thinking of Linux, Mac and Windows.
    - a_vanderbilt 2y ago
      Linux definitely exists in a weird limbo. While it can be secured to an extreme degree, most people aren't using Linux that way on personal devices. Especially on a desktop. ChromeOS is quite secure since it is so locked down, but imagine getting the average Linux user to like it. Curious as to your rationale for the security architecture of macOS being inferior. Is it because of the way the security features are implemented that you lean that way? macOS has its warts, but it also has plenty of security features I'm not aware of Windows/NT having.
      - ruthmarx 2y ago
        > Linux definitely exists in a weird limbo. While it can be secured to an extreme degree, most people aren't using Linux that way on personal devices.v For sure. I think my minimal Alpine desktop with well defined SELinux policies is better than Windows or macOS, but most people are using Ubuntu or similar which doesn't have anything like that (AppArmor helps somewhat), and doesn't really have any of the security innovations macOS or Windows have. > Curious as to your rationale for the security architecture of macOS being inferior. Is it because of the way the security features are implemented that you lean that way? macOS has its warts, but it also has plenty of security features I'm not aware of Windows/NT having. I will say I'm a little out of date on new features macOS may have introduced, but back in the day I remember them not even having a proper ASLR implementation, no form of MAC, nothing even close to things like Windows Secure Desktop[1] etc. Microsoft had a well deserved horrible reputation, but they really put in a lot of effort to turn things around, and I think they succeeded but without getting due credit from most techies. Whereas Apple it seemed like were coasting on the fact that macs were not nearly as targeted as a platform. [1] https://learn.microsoft.com/en-us/archive/blogs/uac/user-account-control-prompts-on-the-secure-desktop https://learn.microsoft.com/en-us/archive/blogs/uac/user-acc...

the_arun 2y ago

Hard to believe Microsoft is disagreeing when there is a demo. In that Vimeo account there are ton of other security discoveries. Eg WhatsApp running python script. Is this real or scam?

9029 2y ago
Well the demo is showing a crossing of something that ms has defined to not be a real security boundary: "Administrative processes and users are considered part of the Trusted Computing Base (TCB) for Windows and are therefore not strong isolated from the kernel boundary." [0] Another recent case: https://arstechnica.com/security/2024/03/hackers-exploited-windows-0-day-for-6-months-after-microsoft-knew-of-it/ https://arstechnica.com/security/2024/03/hackers-exploited-w... [0] https://www.microsoft.com/en-us/msrc/windows-security-servicing-criteria https://www.microsoft.com/en-us/msrc/windows-security-servic...
- morpheuskafka 2y ago
  On the Linux side, SELinux which sets guardrails on the root user at the kernel level is mandatory for protecting classified information. Thus, there is most certainly a security boundary between root, let alone regular users with "admin" groups/perms, and the kernel. How can Windows, which is used all over the government, have a policy that admin users can do whatever they want with the kernel without it being a security vulnerability?
  - dwattttt 2y ago
    Because their policy is to not give admin to a user if you don't want them to have control of the computer?
    - kchr 2y ago
      Even approved and trusted admins can be a liability (disgruntled employee, social engineering). Like OP said, mandatory access control (MAC) implementations like SELinux can be used to even further restrict what an administrator (or process running with admin privileges) is allowed to do.

mrinfinitiesx 2y ago

The owner of this website (www.bleepingcomputer.com) has banned your IP address (IP) K. edit: VPN, ssh -D to vps & socks5 localhost worked. Can't have anything anymore.

alpaca128 2y ago
If you have a dynamic IP it was probably banned because of someone else who had it in the past.
- dkasper 2y ago
  Haunted IPs are a thing, same as the haunted domains article also on the front page right now! https://news.ycombinator.com/item?id=41951131 https://news.ycombinator.com/item?id=41951131
- worewood 2y ago
  With widespread CGNAT and the exhaustion of IPv4 addresses this will become more and more common each day...
deleted 2y ago
[deleted]
snvzz 2y ago
Headscale, the open source backend alternative to tailscale, which frontend is open source to begin with, is worth looking into.
a2128 2y ago
In the future, everything will block you unless you're on a residential IP address in a Western country, running Chrome on the latest version of Windows or iOS, you have remote attestation, and your ISP's ASN isn't haunted because someone in your neighborhood had downloaded malware a few years ago
- perching_aix 2y ago
  You mean MacOS, and I'll block that too :)

ajross 2y ago

Seems like the attack is suspiciously simple: Fool the update process into installing old versions of kernel components with known vulnerabilities. I'm no expert, but surely MS has already thought about this and has a blacklist or revocation facility or whatever? Is the root cause here an OS design issue or just a process failure where they failed to note the broken/bad hashes in the correct spot? The latter is much easier to fix, but the (slightly spun, as always) security announcement seems to claim the former.

SoftTalker 2y ago
Maybe they have to allow downgrades because enterprise users will insist on being able to downgrade if an update breaks something?
- marcosdumay 2y ago
  Windows automatically downgrades when an update breaks everything... And then schedules the update again... What is a fairly common thing to happen...

bubblesnort 2y ago

> possible by gaining kernel code execution as an administrator The root user can install rootkits as usual. Don't forget to brand it a cool name.... Oh wait: > The researcher published a tool called Windows Downdate There you go, here's your 0xF minutes of fame, well played.

jojonas 2y ago
The concept that there is a root/superuser account that can do anything they like is quite a common one, but it is an OS design choice. Any user account is just an object in the operating system and one can as well design an OS that enforces certain rules against all user accounts, even if that means limiting superuser accounts. Legitimate reasons I can think of would be for example to protect certain secrets even in the event of an administrator compromise (like a TPM) or just to prevent administrators from accidentally messing up their systems to an extent that they wouldn't boot. Another (more controversial) goal is to enforce DRM. Anyways, that's exactly what Microsoft is attempting to do with Windows: the OS tries to prevent administrative accounts from interfering with the kernel/installing rootkits (for whatever reason). Also note that it's always important in this discussion to differentiate between administrative user accounts (in the OS) and "administrators" (people) with physical/hardware access.
ruthmarx 2y ago
> here's your 0xF minutes Writing '15' would have been easier here. Nothing wrong with writing 0xF but it's a weird choice that irked my curiosity. You just did it for style reasons?
- ddingus 2y ago
  > here's your $F minutes Another weird choice, different syntax. I triggered a little when I saw the comment too. 0xF has always been hard to read for me. $F is hard to read for others, and it all seems to depend on where and on what we all started with.
  - ruthmarx 2y ago

thrtythreeforty 2y ago

I'm kind of with Microsoft on this one: the administrator can do arbitrary things to the computer, film at 11. Is there a nuance that I'm missing that raises the severity of this? See also Raymond Chen's summary of this class of attack: https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283 https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...

kgeist 2y ago
My thought exactly. If someone is already able to replace arbitrary DLLs on the system (a precondition for this "exploit" to work), all bets are off, and their ability to bypass driver signatures is probably the least of your concerns.
- jeroenhd 2y ago
  In practice there's no good defence against this, but Windows is designed to protect itself against these kinds of attacks if all components work together. With secure boot + driver signature validation + DLL signature validation, you can't just run any code by putting it in a DLL file. You're not hacking any normal computer by replacing user32.dll with virus.dll. Downgrade protection is quite a hard problem to solve without at least breaking the automatic recovery tools. In theory Microsoft could register the versions of every system file somewhere, sign+hash that, and store it some place secure, but then they'd need to deal with reverts of system components after a failed update or restored system images becoming unbootable. In practice, I don't see the use case for this attack, though. You can just put a legitimate, signed driver with a known exploit inside your executable and load that. Microsoft chooses to keep unpatched, vulnerable drivers rather than break hardware support for millions of users.
  - unnouinceput 2y ago
    Which is the wrong path IMO. If users want to shoot themselves in the foot, let them do it. The only way to learn responsibility is to let get their systems pawnd. Maybe they will finally learn the Linux way - never login as admin, always as normal user. You want admin login? Cool, then the "su" equivalent in Windows is called "runas".

quotemstr 2y ago

So the kernel is enforcing file sharing rules (mandatory locking, in effect) by scanning on open all open file handles for conflicting mandatory locks, but doesn't check for memory mappings of these files with conflicting permissions. Oops. Seems like a straightforward fix though. It's worth noting that Linux just got rid of its last vestige of mandatory locking. Now you can write a loaded executable without getting EBUSY. Interesting how exactly the same feature on one OS can be a load bearing part of the security infrastructure and on another OS legacy crud to be deleted.

fullspectrumdev 2y ago

So what’s interesting is MS say that UAC isn’t a security boundary. Which is some users to admin. Then they say admin to kernel (in this case) isn’t a security boundary. While also saying that driver signing enforcement is a security feature. Which is what’s being bypassed here. But they claim in this case it’s not crossing a security boundary. Please make sense.

prettyStandard 2y ago
This is a value system disagreement. I have a theory that there's basically two types of disagreements, disagreements on definitions, and disagreements on value systems. In this case Microsoft values downplaying this issue, so when that is at the top of their value system their decisions should make sense following that. Since this is just a pet theory I'm very interested to hear critiques on it. Disagreements on definition are a little bit easier, because then you can just talk about the definitions and resolve your differences there... For example let's say IDK You're trying to sort out how to design a software system, and everyone is speaking in terms of design patterns, but they haven't yet spelled out the details of what those designed patterns are, then that could probably lead to a lot of confusion if when you say A I think of A', and another person is thinking of A''.
- Buttons840 2y ago
  I like this. I first noticed this with gay marriage. Some would say "gay people should be able to do what they want and form 'civil unions' with all the tax and contractual benefits and requirements of marriage, but they shouldn't be able to get 'married'". For these people, it was all about the definition of a word. Other people opposed gay marriage because it went against their values. No matter what you wanted to call it, they were opposed to gay people living together and sharing their lives. I chose this example because it's the first time I noticed that some disagreements are about the definition of a word, and it's an especially clear example of that. It's silly how huge disagreements about a single word can become. There are also people who disguise their value disagreement as a definition disagreement. This is a form of bad faith arguing.

quotemstr 2y ago

It's also interesting how on both Windows and Linux normal-privilege local accounts are, practically, root equivalent. In Linux, we train people to type "sudo" in front of anything system relevant. On Windows, we train users to click through UAC prompts. When was the last time sudo said "no" to somebody for a reason other than a password typo? (UAC is marginally better than sudo: UAC is system managed UI, while sudo is just a program. An attacker can plug in a malicious shell alias for sudo and steal your password.) IMHO, it'd be more convenient for users and more reflective of actual security posture to get rid of both sudo and UAC (in the default setup of course) and stop pretending that there's a firm security boundary between root and the primary human local user account.

a2128 2y ago
On Linux, most modern user-facing applications are using polkit instead of sudo. You can actually just use pkexec instead of sudo in the terminal as well. Instead of just running arbitrary commands as root, applications can use specific pre-defined actions like "org.freedesktop.udisks2.filesystem-mount". This shows a nice localized message to the end user about what the app is trying to do, so they can decide whether to allow it or not. The system administrator can also configure certain actions to not even require authentication, useful for e.g. flatpak updates, or to block certain actions altogether.
adrian_b 2y ago
On Linux, I do not install sudo, because I do not need very often to become root, and when I need that I usually want to do multiple operations. I believe that "sudo" is useful only on multi-user computers (including company-owned and company-managed computers), where the administrator may want to give to some users the power to do only a restricted set of privileged operations. I always use a different user account than root, mainly not for security, but to avoid any accidental mistakes, when I could delete or overwrite other files than intended. I believe that this is a good enough reason to justify the need to type infrequently a password in order to change roles.
dwattttt 2y ago
I think an equivalent way to phrase this that feels very different is: "On both Windows and Linux the default installed users are, practically, root equivalent". I guess on the basis that the user performing the installation should be in control of the system (I mean, they are; they could've just not done the installation. Where are your access controls now, blank system!) > When was the last time sudo said "no" to somebody for a reason other than a password typo? Sudo doesn't say no to people, much like UAC doesn't say "no" to people. In both cases, people (admins) are meant to say "no" when they don't expect to be performing an administrative operation. People who are not admins and yet need to do such operations need an administrator to authorise it. In both cases, if it's not a single-person system, whoever is setting the machine up should be setting up limited accounts for regular use.

TheRealPomax 2y ago

it also allows tampering with Windows 11 to actually make it a better OS because it bypasses all the Microsoft lockdown bullshit, but let's focus on the rootkits instead.

Sakos 2y ago
I've noticed that a surprising number of people here on HN are in favour of locking down Windows and preventing any kernel access at all to Windows users. It reeks of the "think of the children" arguments.
- lock_it_down 2y ago
  No, as a user which has no need for kernel access I want it locked down so the real things I care about, my data, is more secure. It's called security in depth.
  - Sakos 2y ago
    As a user who does have need for kernel access, because it's my god damn system and not yours, Microsoft's or anybody else's, I don't want it locked down. It's called security in depth. That means you don't need to prevent all kernel access for users, because there are layers of defense.
    - ruthmarx 2y ago
      > As a user who does have need for kernel access, Why do you need it?
  - TheRealPomax 2y ago
    But you know what's even better? Having a choice. Want to lock down Windows? You should have that power. It would be absolutely idiotic if you couldn't secure a computer. But, do you want to fuck with the kernel, patch out something you think should never be called by anything because there is no legitimate use case? You should also have that power. Because one thing that stuff like this doesn't do is "make it easier for the bad guys": want to deliver a malicious payload by exploiting Windows, either because of its design or a recently found vector? I hope you die in a fire but you already have so many options that this one really doesn't give you more power than before. It's just another option in a litany of options. After all, Windows is only as safe as its users with admin powers, which is literally every home user thanks to elevated access being a single "ok" button, if they even have UAC still turned on "because it's so annoying".

de6u99er 2y ago

When I have to use Windows I always assume the computer has been compromised.

wslh 2y ago

Wow! I remember the hard time we all had at [1] (doing deep packet inspection drivers for [2]). when Microsoft first required driver signing in Windows. The workflow seemed, at first glance, even tougher than getting an app approved on the Apple Store, with documentation that was far from clear. Personally, this feels like a huge setback considering the resources companies have poured into complying with Microsoft’s requirements, only to see it exploited in this way. Of course, vulnerabilities are always out there, but it would have been reassuring if someone had uncovered this one earlier. Kudos to Alon Leviev and SafeBreach for discovering it. [1] https://www.nektra.com/ https://www.nektra.com/ [2] https://www.verizon.com/business/en-nl/products/security/managed-detection-response-services/network-detection-response/ https://www.verizon.com/business/en-nl/products/security/man...