3 ms·

I'm kind of with Microsoft on this one: the administrator can do arbitrary things to the computer, film at 11. Is there a nuance that I'm missing that raises t

I'm kind of with Microsoft on this one: the administrator can do arbitrary things to the computer, film at 11. Is there a nuance that I'm missing that raises the severity of this? See also Raymond Chen's summary of this class of attack: https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283 https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...

kgeist 2y ago
My thought exactly. If someone is already able to replace arbitrary DLLs on the system (a precondition for this "exploit" to work), all bets are off, and their ability to bypass driver signatures is probably the least of your concerns.
- jeroenhd 2y ago
  In practice there's no good defence against this, but Windows is designed to protect itself against these kinds of attacks if all components work together. With secure boot + driver signature validation + DLL signature validation, you can't just run any code by putting it in a DLL file. You're not hacking any normal computer by replacing user32.dll with virus.dll. Downgrade protection is quite a hard problem to solve without at least breaking the automatic recovery tools. In theory Microsoft could register the versions of every system file somewhere, sign+hash that, and store it some place secure, but then they'd need to deal with reverts of system components after a failed update or restored system images becoming unbootable. In practice, I don't see the use case for this attack, though. You can just put a legitimate, signed driver with a known exploit inside your executable and load that. Microsoft chooses to keep unpatched, vulnerable drivers rather than break hardware support for millions of users.
  - unnouinceput 2y ago
    Which is the wrong path IMO. If users want to shoot themselves in the foot, let them do it. The only way to learn responsibility is to let get their systems pawnd. Maybe they will finally learn the Linux way - never login as admin, always as normal user. You want admin login? Cool, then the "su" equivalent in Windows is called "runas".

kgeist 2y ago

My thought exactly. If someone is already able to replace arbitrary DLLs on the system (a precondition for this "exploit" to work), all bets are off, and their ability to bypass driver signatures is probably the least of your concerns.

jeroenhd 2y ago
In practice there's no good defence against this, but Windows is designed to protect itself against these kinds of attacks if all components work together. With secure boot + driver signature validation + DLL signature validation, you can't just run any code by putting it in a DLL file. You're not hacking any normal computer by replacing user32.dll with virus.dll. Downgrade protection is quite a hard problem to solve without at least breaking the automatic recovery tools. In theory Microsoft could register the versions of every system file somewhere, sign+hash that, and store it some place secure, but then they'd need to deal with reverts of system components after a failed update or restored system images becoming unbootable. In practice, I don't see the use case for this attack, though. You can just put a legitimate, signed driver with a known exploit inside your executable and load that. Microsoft chooses to keep unpatched, vulnerable drivers rather than break hardware support for millions of users.
- unnouinceput 2y ago
  Which is the wrong path IMO. If users want to shoot themselves in the foot, let them do it. The only way to learn responsibility is to let get their systems pawnd. Maybe they will finally learn the Linux way - never login as admin, always as normal user. You want admin login? Cool, then the "su" equivalent in Windows is called "runas".