4 ms·
Mentions use of an obscure(?) Windows IPC mechanism: Windows mailslots (circa Windows 2000). http://msdn.microsoft.com/en-us/library/windows/desktop/aa365130%2
by j_s 14y ago
Mentions use of an obscure(?) Windows IPC mechanism: Windows mailslots (circa Windows 2000).
http://msdn.microsoft.com/en-us/library/windows/desktop/aa365130%28v=vs.85%29.aspx http://msdn.microsoft.com/en-us/library/windows/desktop/aa36...
* a pseudofile that resides in memory
* use standard file functions
* cannot be larger than 424 bytes when sent between computers
* can broadcast messages within a domain
- drivingmenuts 14y agoI don't know the ins and outs of Windows to a great degree, but that reads like an exploit waiting to happen. Is this sort of functionality still present in Windows? If so, are they idiots or what?
- jbigelow76 14y agoI'm wondering if government agencies like the CIA, NSA and their counterparts in other countries look for vulnerabilities in programs but never report them to the vendors for fixing but instead catalog them for possible use in future exploits. (actually, I'm not really wondering, it's probably naive to assume they wouldn't)
- Spooky23 14y agoIt's beyond that -- they actually have created a market for the trading of 0-days, and bid against each other using various proxies.
- contingencies 14y agoMy own experience, meeting some of these people, suggests this is certainly correct.
- EvanAnderson 14y agoThere have been vulnerabilities found in the code handling mailslots, but the protocol itself is just a mechanism to do broadcast-based communication. It's old and crufty, dating back to the DOS LanManager days, but I'm sure there are applications out there that still rely on the functionality and, as is typical for Microsoft, the API still exists in modern Windows versions. (The NetBIOS "Browse List" functionality that powered "Network Neighborhood" uses this protocol, for example.)
- EvanAnderson 14y agoMailslots are an SMB-based IPC mechanism that dates back to Microsoft LanManager (LANMAN). I could see using mailslots as a mechanism to disguise traffic and potentially thwart NIDS. SMB broadcast traffic is considered "noise" by a lot of admins and might well be excluded from traffic monitoring to prevent "chatty" traffic from filling the logs. Using mailslots, as opposed to rolling a custom broadcast-based protocol, makes the traffic sink into the normal SMB noise floor.