Slashdot Mirror
MS Message Security Flaw Explained
Geoff Shively writes "Canadian security researcher Oliver Lavery published a fantastic paper on Win32 Message Vulnerabilities. The paper touches on a the Shatter problem that received much attention almost 1 year ago regarding the fundamental flaws in the Win32 API. Oliver's research demonstrates that the Shatter vulnerability is still very much in existence and quite a threat. Vendors need to wake up and work towards fixing this problem in their applications."
Why should venders fix this it an OS problem and Microsofts fault. Working around bugs only lead to more bugs and problems.
Reminds me of a CS class I once had, the lecture (admittedly a unix advocate) was explaining a problem with software deadlines. ie release now (for market reasons) and fix problem later:
-MS build next version of Windows and Office at same time, so that they can release together.
-Office is tested on beta versions of windows, which obviously has bugs, the Office peeps work around the bugs.
-mean while the windows peeps fix the bugs
-near release office found not to work right because it is trying to work around bugs which aren't there. (Why they let an Office app play voodoo with the OS is up to you to decide)
-need to release on time, so put bugs back in windows problem sorted.
It will be difficult for MS to fix the message system w/o breaking old apps.
Y'know, I've had the shatter attack paper on my bulletin board since the original slashdot article, and I've seen few references to it since.
Anyone know if this has been successfully used in the "wild"? Is Microsoft even taking this seriously?
Enquiring mind wants to know.
SB
It's old. The more humans I meet, the more I like my cats. At least they are honest.
Looks like the event model for Win32 was flawed from the beginning and should have changed long ago. Looking at the Mac event model (Carbon Events and even the WaitNextEvent/GetNextEvent), there is no passing of functions to the event handler at all so why did M$ design it that way back in 1993 I do not know.
Leave it to Slashdot to try and wring every last drop of blood from anything that even remotely smells like a "vulnerability", right up there with JavaScript that changes my wallpaper at the behest of evil Romanian hackers - I've always wondered why all those Unix/Linux exploits I see in Bugtraq and SecurityFocus and RedHat advisories don't get so much publicity.
How will "old" style WIN32 message passing be affected by .NET managed code respective to this security hole?
Why are we doing MS' work for them? Pointing out these flaws only helps MS to fix them.
If anything, we should be pointing out flaws in FS/OSS software so that we can make that better.
social sciences can never use experience to verify their statemen
I had a section on the shatter attack and the messaging vulnerabilities in my paper, Windows XP Shows the Direction Microsoft is Going, but I got so much hostile feedback on message boards from people who said it did not exist, or it was not the fault of Windows, that I took the section out.
The shatter attack is a local attack only, that allows a logged-on user to elevate to administrator. Microsoft has recently (July 9, 2003) documented one messaging exploit: Flaw in Windows Message Handling through Utility Manager Could Enable Privilege Elevation (822679). But what does Microsoft know, right?
Apparently only two or three exploits of Windows messaging have been published. However, it seems reasonable that there are others.
The whole question gets some people very upset. They say that it is the fault of whoever wrote a vulnerable application. But look at what's in Windows memory at any one time. There is a huge amount of stuff written by numerous people. It seems to me that it doesn't matter to the user how the vulnerability got there, a vulnerability is a vulnerability. If you use Windows, you are trusting numerous programmers to know how to pass messages because there is no authentication system.
Consider this post by Uller-RM. He says, "... he [the attacker] adjusts the size of a textbox using an outside program to 4GB. (Windows unfortunately allows this, since the message format doesn't include a "sender" field to check against the owner handle.)".
Yes, it is unfortunate. And fixing it requires a rewrite of Windows that breaks all present applications. Am I wrong about any of this?
I'm not saying I understand everything about this, but I don't have time to investigate it further. I have to go back to writing a letter to a customer.
You don't understand. Here on Slashdot we all understand those issues and we all know that we shouldn't use any software written by Microsoft. But that's not the point. Unfortunately Slashdot is not the whole world. There are people who use this software and they would have no idea about those flaws if we didn't talk about them. We cannot ignore people just because they are uneducated or incompetent, because they are the majority of our society. Do you think Microsoft would tell those poor people that there are flaws in their software if we didn't find and try to exploit them? I don't really think so.
O course we do. Free software has just much less flaws than the proprietary counterpart and that is why you can see much more Slashdot articles about fatal flaws in Microsoft Office than any flaws in TeX. The same is true with ISS and thttpd, et cetera.
Karma: Positive (probably because of superiour intellect)
How hard and how crippling would it be to disallow non-privileged apps from sending to priviliged apps. That shoud fix the problem. And if for some reason two apps accross the boundary need to talk to each other, it could be designed to let the administrator link their message queues.
One problem is that an old application would not be prepared to deal sensibly with the denial of access. Maybe Windows could put a message on the screen.
it's that we want to see the flaws in MS because we dislike their software for practical and ethical reasons.
However, pointing out flaws in MS software only helps MS. Very few people will change from MS to anything else, no matter how many flaws there are on it. It came with their computer, and they are of course too stupid (or so they think) to do anything else without borking their computer. So, by act of god, they're stuck with MS.
And, of course, MS can take any criticism of its software and use that to better its software. When confronting an opponent, you don't tell him of all the weaknesses you see, do you?
social sciences can never use experience to verify their statemen
This seems very sensible. I was thinking in broader, and maybe not completely technically accurate, terms. I was thinking of message space filtering as a kind of automatic authentication. This would not break existing applications.
It has been claimed that it is possible to use the shatter attack against a clean install of Windows XP. It has been claimed that system processes are vulnerable to this attack. What do you think?
An "opponent"? Well, I don't actually know you, you are apparently a CEO of Apple, I don't know, if Microsoft is your "opponent." This, or you are one of those "leat" Linux cheerleaders I've been hearing so much about. No, Microsoft is not an "opponent" for free software movement. In fact, look at where Microsoft was back in 1971-1983. It is not "coolness" (or "leatness" if you will) competition. I want to make it clear: If Microsoft suddenly patches every flaw, including the EULA, and releases a great free software project, I will tell everyone to use it. Period
Karma: Positive (probably because of superiour intellect)
Allowing "ad hoc" messaging between programs is one of the best methods for allowing users to customize interactions between seperate applications. This was applied with great success using ARexx on the Amiga, and some using OSA/Applescript on Mac OS.
So I do not believe it would be a good general solution to limit messaging to those paths pre-envisioned by the vendors themselves. Letting the reciever know what authority context the sender was operating in would be a better approach.
Sure, if MS released everything under the EULA, it would not longer be the enemy. The superiority of software for GNU/Linux is another issue, entirely separate.
But that's not -- ever -- going to happen. So, since MS will never release FS/OSS, they are the enemy, and always will be.
social sciences can never use experience to verify their statemen
That seems right to me. However, in the real world can I expect all programmers to realize this and comply? If I could get it, I would like some security inside the OS.
How do Linux and BSD deal with this issue? Is there any way to achieve privilege escalation by interfering with other processes? I don't understand it well, but the answer seems to be no.
An additional point: I would like the cross-privilege interprocess communication system to be opt-in rather than op-out. There should be a special call for programs that expect to communicate across privilege levels. That would make it easy to write a report that would find all such programs. That way I could decide if I trusted those programs, and if they were corrupted by a hacker or not.
It seems sensible that the API for communicating across privilege levels would have special checking, and a system of reporting that could be started to resolve questions about the operation of any one system.
table seems like a fairly simple solution, maybve too simple I am sure I am overlooking somthing
errr....umm...*whooosh* *whoosh* Is this thing on ?
Is it really that simple? Windows has numerous system windows that are hidden, that, according to the developer of the shatter attack, could also be used to implement the attack. My understanding is that Linux and BSD have nothing like that. In Windows, system windows are used for other purposes than GUI display.
I have read your extensive flame and I object. I am not"secretive". (Anonymous Coward is my real name.)
the damn thing and get it over with.
M$ is such a broken peice of crap that there is no repairing it.
Everything M$ puts out is virusware.