MS Message Security Flaw Explained

Geoff Shively writes "Canadian security researcher Oliver Lavery published a fantastic paper on Win32 Message Vulnerabilities. The paper touches on a the Shatter problem that received much attention almost 1 year ago regarding the fundamental flaws in the Win32 API. Oliver's research demonstrates that the Shatter vulnerability is still very much in existence and quite a threat. Vendors need to wake up and work towards fixing this problem in their applications."

Comments

Re:Venders problem?

[David Leppik]

It's not an OS "problem" -- it's a design issue. The "desktop" is designed to be a security boundary within which programs can send each other I/O. If you insist on running a privileged program within the desktop, you deserve what's coming.

The original author even indicated that Unix/X11 probably suffers from the same issue, except there's no exploit code yet. Anyway, it's like running "pine" as root, and then blaming Unix when the user shells out somehow.

This is a well-known and very old problem with the design of X. I heard about it in college, back in the early '90s. If you were to design a windowing system these days, you might be smart enough not to use function pointer addresses in shared memory for interprocess communications. But back when X (and windows) were first desgined, they had neither CPU cycles nor the memory to do it right. Arguably X had less excuse for poor security, since it was designed as a multi-user system for running GUIs across the Internet.

Is it really that simple?

[Futurepower(R)]

Is it really that simple? Windows has numerous system windows that are hidden, that, according to the developer of the shatter attack, could also be used to implement the attack. My understanding is that Linux and BSD have nothing like that. In Windows, system windows are used for other purposes than GUI display.