WMF Vulnerability is an Intentional Backdoor?

An anonymous reader writes "Steve Gibson alleges that the WMF vulnerability in Windows was neither a bug, nor a feature designed without security in mind, but was actually an intentionally placed backdoor. In a more detailed explanation, Gibson explains that the way SetAbortProc works in metafiles does not bear even the slightest resemblance to the way it works when used by a program while printing. Based on the information presented, it really does look like an intentional backdoor." There's a transcript available of the 'Security Now!' podcast where Gibson discusses this.

Comments

Rootkit

[poeidon1]

Is it like a rootkit but placed by microsoft itself ..Grrr.

Re:Rootkit

[poeidon1]

So, Can I sue microsoft now for the damage?

Re:Rootkit

[m50d]

It's not really a rootkit as there's no immediate root access, you just get to execute code as the user who views the file. Though with windows there's not that much difference.

I would not be suprised at all.

[AltGrendel]

I could see someone deliberatly doing this, maybe a contractor or a disgruntled employee.

Its happened before and it will happen again. Whether this is the case remains to be seen.

Re:I would not be suprised at all.

[NtroP]

I could see someone deliberatly doing this, maybe a contractor or a disgruntled employee.

The problem with that argument is that in order to exploit this backdoor you'd have to get the target computer to load a WMF file. The main practical way to do this would be to embed it in a web page and have the target visit that page. The only sites that all windows machines access on a regular basis are Microsoft's. The employee would also have to have access to Microsoft's web site to exploit this reliably.

This seems to be only useful if MS itself wanted to use it. Use your imagination as to what they'd do with it. I can think of all kinds of things.

Re:I would not be suprised at all.

[Andrewkov]

It seems unlikely that an API programmer would have access to the main webservers to pull that off. Besides, the explotable feature has been there since Windows 3.1 (if I remember a comment from a previous Slashdot story correctly).

Re:I would not be suprised at all.

[dc29A]

I could see someone deliberatly doing this, maybe a contractor or a disgruntled employee.
- How about a totally stupid idea that MS thought was good?

I mean MS has a long history of ignoring security for usability, lock in and whatnot. WMF dates back to close to 10 years, back when MS really didn't give a damn about security. Even after a the big Gates propaganda email and Trusted Computing Initiative and all the hoopla, XP SP2 allows blank passwords for administrators, the user created during installation is an administrator, again if password is blank no one gives a shit. Remote registry is on by default. RPC on by default. Administrative shares are on by default. Not to mention a plethora of completely useless services.

MS just doesn't understand security. This WMF example is nothing different. It's some ancient code that never got looked at. Add to that the fact everyone and his mother is root, AND that the OS is a big bowl of spaghetti (hi2u IE deep in kernel), you get another attack vector vs Windows systems.

Did someone maliciously implement this WMF "feature"? I doubt it. It looks like another regular MS security hole that shows that MS has no clue about security.

Re:I would not be suprised at all.

[Stripe7]

Someone mentioned on Groklaw that the exploit also exists in wine which just implements the WMF spec.

Re:I would not be suprised at all.

[monkeydo]

Actually, Gibson is saying he doesn't know if previous versions are exploitable or not. In fact he's counting on not, since that's the only way to determine when the "backdoor" was inserted. Gibson is a bomb thrower. There's no evidence other than his opinion that this is a deliberate backdoor.

Re:I would not be suprised at all.

[QuietLagoon]

The only sites that all windows machines access on a regular basis are Microsoft's.

I presume you are willing to show the details of your extensive research that determined this factoid....

Re:I would not be suprised at all.

[towsonu2003]

Someone mentioned on Groklaw that the exploit also exists in wine which just implements the WMF spec.

http://ubuntuforums.org/showthread.php?t=113611

Re:I would not be suprised at all.

[Reziac]

Not only that, but my understanding is that the relevant WMF functions date back to the Win3.0 era (maybe Win2.0, not sure -- the earliest date I've seen was 1991) and in any event, long before M$ had much of a clue about the internet. And long before OS "back doors" became a common worry, too. M$ simply doesn't plan that well when it comes to how stuff is used/affected by an OS, and in fact tends to come late to the bandwagon.

Furthermore, if Gibson is so sure of himself, why isn't his own test utility available to everyone? (Apparently it was only available to Laporte's listeners... not likely to be the most unbiased audience.)

Net result: I knew Gibson's tinfoil hat was a trifle snug, but now I'm sure it needs a complete refitting.

Re:I would not be suprised at all.

[mohaine]

I thought this as well, but if you RTFA, you would see that Gibson doesn't think the SetAbortProc WMF exploit works the way it should.

According to the docs, SetAbortProc should provide a pointer to callback function that is called when a print is aborted. This in itself sounds like a security hole, but it could only be fired if the print is canceled, and then it can only run a preexisting callback method, not arbitary code.

According to Gibson, if you call SetAbortProc with a special key, it will instantly start running arbitary code from within the WMF. No cancelled print or preexisting method calls are requried.

If Gibson is correct, this bug is much different then how it looks on the surface.

Re:I would not be suprised at all.

[azuretek]

Most Windows computers at one point have connected to Windows Update, also IE defaults to MSN, isn't there a getting started page as well when you first open IE after install?

It's just simple observation to say that the only site that would be consistent on every Windows system is a Microsoft site, somewhat how on my mac I am connected to apple after a clean install when I open Safari. One could say the only site that would be consistent on every mac would be apple.com.

-PS I don't think it was an intentional backdoor.

Re:I would not be suprised at all.

[Reziac]

But that's true of anything. Just because it was designed for X doesn't mean someone can't modify it to do Y. So why the WMF function in particular? What ADVANTAGE does it have as a back door, that other more-convenient exploits can't offer?

And considering how old is the code in question, why hasn't any exploit for it ever been seen in the wild? Surely Gibson is not the only person poking into obscure corners of Windows.

I'm reminded of how malicious code can be embedded in the comment field of GIFs, and executed by an accomplice program... that exploit was never seen in the wild either, but has been known about for as long as GIFs have existed. Was it part of a grand conspiracy to force us all to subscribe to Compu$erve?? ;)

Re:I would not be suprised at all.

[jez9999]

Furthermore, if Gibson is so sure of himself, why isn't his own test utility available to everyone?

Eh? I just downloaded it, it's linked to from here.

Re:I would not be suprised at all.

[mrseigen]

I'm not quite sure why they'd want to use it. End-users already trust Microsoft implicitly because they made the operating system, so if they wanted to, for instance, install some software on all Windows machines that reports home if it detects a pirated copy, they could just do it through a service pack update. Most people would willingly install it (or click the little automatic button in Windows Update), and there'd be none of this Tom Clancy technothriller intrigue.

I can't personally think of any kind of official reason why Microsoft would want to shove code onto Windows machines just from visiting their website. They've got tons of other ways of doing this.

Re:I would not be suprised at all.

[Tim C]

The only sites that all windows machines access on a regular basis are Microsoft's.

I assume that you're thinking of Windows Update, but at a guess I'd imagine that most (recent) Windows machines get most of their updates via automatic updates, or not at all. I'd be very surprised if "all Windows machines" visit any given site on a regular basis.

(In fact it's trivially easy to disprove your assertion - I have access to 3 XP machines, and none of them visit any of MS's sites on anything approaching a regular basis, but that's beside the point)

This seems to be only useful if MS itself wanted to use it. Use your imagination as to what they'd do with it. I can think of all kinds of things.

I can't think of a single thing that would be worth it. An attack like that would be discovered and traced back to them, and they'd be crucified for it. Unless they could achieve their aim before that happened, there'd be no point, and short of taking over the world, I can't think of anything that would be worth it. Even if they could think of a way to make money using it, the courts would sieze it all anyway.

Re:I would not be suprised at all.

[rts008]

You obviously did not RTFA or you would know that he isn't sure of himself- he has only worked/looked at this a total of one day and happened to bring it up on the podcast, He has a;lso stated NUMEROUS times that it SEEMS to be a bacvkdoor, but until he has a chance to work at this longer to find out- it appears to him to have no toher function he can see AT THIS TIME. (no, I am not going to link to these statements- RTFA!). Second, you must not have put any effort into finding his tool- it took me about 30 seconds to find the link to it- since you are so web challenged, here is the tool:(http://www.grc.com/sn/notes-022.htm) How any of you calling Steve "bombthrower" (and similar) got modded anything other than flamebait or troll is beyond me- obvious from your comments you did not RTFA and the /. modders are not paying attention I guess.

Re:I would not be suprised at all.

[LinuxGeek]

I'll safely assume that you didn't RTFA since you don't already know what I going to tell you.

What Steve initally found was that he had a hard time getting the SETABORTPROC function to execute wmf embedded code as he had read the vulnerability was allowing. After looking at some of the exploit code that was available, he started experimenting with illegal wmf record header sizes and one ( and only one) illegal record size would actually prompt windows to spawn a new thread and then start executing the bytes within the wmf data stream directly. The SETABORTPROC supplied code entry point is completely ignored.

This behaviour will allow remote execution of arbitrary code on unpatched systems.

Re:I would not be suprised at all.

[LinuxGeek]

I'm a programmer. Got my start with BASIC in the TRS-80/Vic-20/Apple][ era. Progressed to writing device drivers in assembler for the new spangled IBM PCs and a UNIX clone named Coherent. Wrote my first Windows program for Win 3.0, progressing through Win2k and then jumping to Linux. For much of this time frame, ( late 80's through the present) I have been reading the writings of Mr. Gibson. I don't always agree with his opinions or approaches to communication, but I've never really been able to find fault with his research into specific security and operational flaws.

Until I see strong reason to doubt his findings, I'll be reading his articles with great interest. To reiterate my previous post, what Mr. Gibson has described is exactly what a backdoor does. It is not a trivial programming task to spawn a new thread and then start that threads execution at the byte following a single invalid wmf record descriptor. Get one of your programmer friends to explain the steps necessary to perform this sequence. If you can't get a good example, then post back here and I'll give you some pseudo code to outline how non-trivial it is and also show how unlikely that this is just a bug.

NSA

[Anonymous Coward]

Well, how else is the NSA going to fight terrorism?

Government backdoor?

[Jerry_Duplicate]

There was talk about the NSA/CIA having a close relationship with Microsoft and being able to exploit backdoors in Windows. This could have all been conspiracy theories, but the fact that this vulnerability existed throughout the Windows line kinda seems odd..

If this isn't a glaring example on why you should support open source, I don't know what is....

Re:Government backdoor?

[Dystopian Rebel]

but the fact that this vulnerability existed throughout the Windows line kinda seems odd.

The function in question has existed for a long time. The exploit is in Windows 2000 and more recent. From the transcript:

But the only conclusion I can draw is that there has been code from at least Windows 2000 on, and in all current versions, and even, you know, future versions, until it was discovered, which was deliberately put in there by some group, we don't know at what level or how large in Microsoft, that gave them the ability that they who knew how to get their Windows systems to silently and secretly run code contained in an image, those people would be able to do that on remotely located Windows machines...

Re:Government backdoor?

[RexRhino]

Of course Windows is the dominant corporate operating system in the U.S., and there are far more intelligence agencies around the world who engage in corporate espionage than just the NSA/CIA (actually, the U.S. is probably behind in corporate espionage compared to say the Chinese or French - we are too worried about terrorist or whatnot). The idea that the NSA/CIA would encourage something that would be used against Americans by foriegn powers as much or more than against the "enemies" of the U.S. makes the story seem more like conspiracy theory / urban legend.

Re:Government backdoor?

[ZorbaTHut]

Yes, because it's impossible for an identical problem to exist in WINE, and therefore open source solves all problems.

Re:Government backdoor?

[einhverfr]

The first NSA-induced backdoor that was well documented was in Windows 95/98/ME and NT4 and later. A reasonably good writeup is found at http://www.heise.de/tp/r4/artikel/5/5263/1.html (english).

Needless to say, I am not at all surprised that there might be all sorts of backdoors in Windows that we may never know about. This is a really good reason *not* to use it in any environment requiring security.

Re:Government backdoor?

[Jurph]

He's not going to have his clearance for very long if he goes around bullshitting his buddies about the NSA's sources and methods. If you've got a real citation for this, serve it up. Otherwise, you're just one more uncleared idiot pretending you know what's going on at Ft. Meade.

Re:Government backdoor?

[monkeydo]

Paraniod speculation. Much like the current story.

Re:Government backdoor?

[evilviper]

If this is an intentional backdoor, it is the crappiest one, EVER!

You'd want something in the base system of ALL Windows version, which couldn't be disabled AT ALL, doesn't require a user to be logged-in as an admin, or stupid enough to open anything sent to them.

If I was making a backdoor, I'd put it in something basic... Have the IP stack open a port when recieving a specially-crafted packet. Have the filesystem driver silently execute a file if it find a special signature in it (eg. code embedded in a cookie/web-page), etc.

Re:Government backdoor?

[Dibblah]

However, the patch was out to WINE before it was out for Windows.

Re:Government backdoor?

[einhverfr]

First you have to understand what the ramifications of this are likely to be.

The NSA is (in theory at least) legally forbidden to spy on Americans. Their main mission involves cryptoanalysis (codebreaking) and signal intelligence. So they spend a lot of time in foreign countries evesdropping on cell phone calls and the like. They have also been very much involved in the development of computerized cryptography (witness their role in the creation of DES). In this latter case, they have probably attempted to balance their interests in codebreaking with the legitimate interests in algorythmically secure encryption (i.e. make DES algorythmically secure, but shorten the key so we can break it if we really have to).

The rise of independant professional cryptography organizations, like RSA, Inc. has created a very serious problem for the NSA in this regard. In general, most of these new systems use variable length keys and are highly peer reviewed for attack potential. So the NSA cannot count on being able to brute force decrypt a document within a reasonable timeframe in the event of a clear and present need to decrypt the information.

Therefore, I believe that most of these are there to allow the NSA to bypass the encryption algorythms in Windows and allow them to access the information without having to attack the encryption. This would make reasonable sense given the NSA history.

Now, I see *no* reason to suppose that the NSA has anything to do with the WMF exploit. Instead, I suggest that this is likely to be a backdoor either put in place by a developer, at the request of a partner (such as the RIAA), etc. This backdoor has *nothing* to do with anything the NSA typically gets involved in, so I think even the most paranoid analysis can rule them out. Instead, this is just a strange attempt to allow the Media Player to be subverted and used in what ever way an attacker decides.

Now, Microsoft's response to this has been inadequate (they only grudgingly developed a patch), which suggests that this backdoor had the blessing of the company, much like the response to the Sony DRM rootkit which was undetected by agreement with First4Internet. Lest I appear to be too hard on Microsoft, I found Symantec's response ("Oh, we will start removing it" when First4Internet claims they were working with Symantec to ensure that it would not be removed) to be far less trustworthy.

Anyway, there is enough doubt in my mind about Microsoft's goodwill on these areas that I would not suggest running Windows in any environment that absolutely requires security. The system has fundamental design flaws from a security point of view, and these problems continue to underscore either serious development issues at Microsoft or an attitude that the security of the customer is not really that important.

Re:Government backdoor?

[AnotherBlackHat]

You need plausable denyablity.
I.e. the back door has to look like enough like a bug that finding it won't cause people to immediately realize that you're installing back doors intentionally.

Something like a buffer overflow in the TCP stack that only happens with packets of an exact size (off by one in some checking routine.)

Re:Government backdoor?

[man_of_mr_e]

Actually, Bruce Schneier's analysis is somewhat different.

http://www.schneier.com/crypto-gram-9909.html#NSAK eyinMicrosoftCryptoAPI

The fact is, the majority of the people making claims about this don't even understand what it does. The majority of the speculation isn't possible. It doesn't give anyone (Not even Microsoft, much less the NSA) a backdoor into your computer.

Re:Government backdoor?

[ray-auch]

You have some wierd definition of "before".

Official, tested, binary patch for Windows released on 5th Jan. Unofficial & leaked-official patches were out even before that.

WINE was patched in CVS on the 6th.

Checking in a change to source is a long way off a tested patch release, as demonstrated by Crossover Office releasing the fix on the 10th.

My belief is that Open Source is usually patched quicker - but not this time. One suspects that at least some of the "many eyes" normally on the code were too busy laughing and pointing at MS to check if they too had been caught with trousers down.

Unparalleled BS from MS.

[TripMaster Monkey]

From TFA:

And their [Microsoft's] definition for what's critical is sort of amazing. I mean, and this is from a page on their website. They say a vulnerability in Windows is critical only if its exploitation could allow the propagation of an Internet worm without user action. In other words, anything else is not critical.

You mean user action like...say...opening a web browser?

Anyway, this is freaky interesting, because if this is actually true, it's pure, unvarnished evil. I't a lot like the Allied soldiers who were fighting in Germany, being told all these horror stories about how evil the Nazis actually were, and then coming upon a concentration camp and finding out that these stories were real after all.

Steve makes an excellent case with his diagnosis, but I'd love to see his findings verified by a few other agencies. This is too important to leave to one researcher.

I, for one, am going to be following this story avidly. Any bets on when M$ issues a statement that a 'rogue programmer' put this code in, and disaavow any knowledge or responsibility?

Length==1

[atfrase]

This does look awfully like a special-case trigger. The idea of a backdoor is to have it look for a specifically crafted but completely nonsensical and invalid input sequence -- this serves as the "key" to the backdoor, ensuring that no other designer or user accidentally stumbles onto it. Since we assume that legitimate users and developers will only provide valid input, we design our "key" to be definitely invalid. For me, that length==1 trigger is the most convincing evidence. It's not just that it's the wrong input, it's that it's the one specific value of wrong input that triggers the behavior. That seems like design.

Re:Length==1

[stevied]

Obviously SetAbortProc should not be implemented for WMF playback, but assuming somebody screwed up and just called the normal version of Escape(), could the behaviour we're seeing here not somehow be the result of not checking the validity of the length parameter properly, performing some arithmetic on it, and possibly falling through to some other code that happens to a jump or call?

Re:Length==1

[Procyon101]

Possibly, but I doubt it's a Microsoft sanctioned backdoor. Any "OFFICIAL" backdoor from MS would have a much more complex key to get in than "1".

I can see this being a programmer supplied backdoor, like a hook for easter eggs, but based on the other security work done in MS, anything that can be gotten into that is there on purpose is locked up pretty tight to any casual attempts.

Re:Length==1

[DaveCar]

That seems like design

Intelligent Design?

Re:Length==1

[atfrase]

Agreed, it doesn't seem like the kind of "feature" that was designed in top-secret MS design documents or developed in meetings.

But I still have a hard time seeing how code would *accidentally* behave like this. An invalid length should abort processing right off the bad, for one thing; "falling through" might be an explanation, but what possible code could be "fallen through" into that would set CPU execution *inside* the metafile -- moreover, would set CPU execution to the *next byte* after the erroneous header block. That's awfully convenient; if it were a mistake, I'd expect code execution to begin at some other random location, probably influenced by whatever happened to be in the register or some temporary pointer variable at the time. But the very next byte? That's too insanely convenient -- you get to provide your key *and* your payload in the *same* place.

You could argue that buffer overrun exploits do the same thing, but the idea of the buffer overflow is to specifically overwrite the function-return pointer to *make* it point at your code. In this case, the exploit doesn't have to specify the location of the code to execute, Windows does that for you. Too convenient.

Re:Length==1

[Shimmer]

You're right, of course. Everyone who's saying this is "obviously" intentional are jumping the gun in a big way. I've got $5 right here that says it's an accident.

"Never ascribe to malice that which is adequately explained by incompetence."

Re:Length==1

[atfrase]

Basically, in the header block for a unit of WMF script contains a "length" field which specifies how long the current unit is. This is standard for this sort of file, and is the primary way to avoid buffer overruns (if you force the data to tell you how big it's supposed to be, and then double check that while reading, you make sure you have enough buffer space to store it all -- otherwise you might read too much, overrun the end of the buffer and trash an important function pointer or something..)

In this case, the smallest possible "length" value is 6, because the header itself takes 6 bytes, so even if the unit had no actual data, the length field itself and the unit's command code is a minimum of 6 bytes.

To trigger the exploit, the length must be set to 1. Not 2, 3, 0, or some other equally invalid value, but only the value "1". Any other value has no effect at all.

Re:Length==1

[BandwidthHog]

To trigger the exploit, the length must be set to 1. Not 2, 3, 0, or some other equally invalid value, but only the value "1".

And the counting of the length shall be ONE!

Sorry, couldn’t resist.

Re:Length==1

[StarDrifter]

For me, that length==1 trigger is the most convincing evidence.

It might have been convincing if it were true. The vulnerability checker from Ilfak Guilfanov's site uses length==17 to trigger the exploit (Look in the wmfhdr.wmf file in the source zip. The length is a little-endian DWORD at offset 0x12.)

The Metasploit module uses a length of 4. Check out the following snippet:

    #
    # StandardMetaRecord - Escape()
    #
    pack('Vvv',

        # DWORD Size; /* Total size of the record in WORDs */
        4,

        # WORD Function; /* Function number (defined in WINDOWS.H) */
        int(rand(256) << 8) + 0x26,

        # WORD Parameters[]; /* Parameter values passed to function */
        9,
    ). $shellcode .

I think Steve Gibson is confused.

do you mean

[Anonymous Coward]

This Steve Gibson ?, yeah he is a real security expert, along with his podcast boy wonder we have much to be afraid of

Re:Another?

[dr_dank]

How about a link to information on the "other" intentional back doors that exist?

*looks at clipboard*

Ok Goatse linkers, thats your cue.

SetAbortProc

[jwegy]

Yeah, SetAbortProc is used for cancelling print jobs. Here is the MSDN documentation: SetAbortProc

Possible uses?

[Kitsune78]

The freakish thing about this, is that if it is indeed a backdoor, it an odd way to go about it. You can't force someone to try to view a WMF. What would its purpose be? You can't use it to get into the exact box you want to, just into a random box that perhaps picks up your WMF from a webpage, or displayed in an application.

Re:Possible uses?

[pahoran]

Looking for terrorists? You don't necessarily know where they are.

Looking for people who have bad things to say about the gov't on their computer? You don't necessarily know where they are.

And let your imagination continue the list ...

Re:Possible uses?

[RexRhino]

Digital Rights Management... If you can control a box using a WMF file, there is all sorts of digital rights management mischieve you can do to prevent a machine from copying a file, or decoding a file, or whatever.

Re:Possible uses?

[notreallynas]

It seems to me Microsoft could use it to get into every box using IE that contacts msn.com
That's got to be at least a few.
I imagine they could just turn this into a wmf file and run whatever code they want on millions of PCs.

Re:Possible uses?

[ZachPruckowski]

It's a ten year old or so vulnerability. It predates DRM, so I doubt it was built for that originally. Sure, it may have DRM uses, but it couldn't have been made for DRM.

Bugs don't have to be well-coded

[m50d]

That's why they're bugs. Seriously, I don't think the fact that it behaves differently from how it does in a printer is any indication it was deliberately written that way. More likely this was an attempt to disable the code that went wrong.

Re:Bugs don't have to be well-coded

[NtroP]

That's why they're bugs. Seriously, I don't think the fact that it behaves differently from how it does in a printer is any indication it was deliberately written that way. More likely this was an attempt to disable the code that went wrong.

You're talking out of your ass. RTFA.

This is (IMNSHO) not a bug. How would you accidentally introduce a bug that for one specific, non-valid, value the program would start executing code that has no place being there in the first place. This has nothing to do with printing. This has nothing to do with a callback to a function in the originating program to tell it the print job has been aborted. This is about executing code within the WMF file directly. It servers no purpose, especially since it only works if you give specific, non-random, invalid input to the WMF parser.

Lawsuit time

[Animats]

Someone involved in a WMA-related lawsuit needs to subpoena, from Microsoft, all the source code and all the change control information for this small part of Windows. Then the original programmers need to be found and deposed under oath. This is standard legal procedure for something like this.

It's possible to get to the bottom of this by legal means.

Based on that information

[Marxist Hacker 42]

I think it's a beneficial back door- in fact, I wouldn't be at all surprised to find that they'll need to update "Windows Update" after all the patches are in place.

Magic Lantern?

[Tackhead]

Sometimes even a blind squirrel gets a nut.

The notion of a backdoor in Windows isn't new. Perhaps the WMF vulnerability was one of the vectors used by Magic Lantern, which was the code word for at least one of the FBI's keylogger programs. Magic Lantern was notable in that antivirus providers participated with the Feebs in a gentleman's agreement to not look for it.

It's certainly a dumb enough solution that the IT-challenged FBI might go for it.

On relative dumbness and smartness, I'd expect smart spies, namely those who work for two other notable three-letter-agencies, to use somewhat more interesting techniques. If it were me, I'd take advantage of equipment I had in place at critical infrastructure points to conduct MITM attacks between a PC and Windows Update servers, in order to transparently install my spookware on only those machines that specifically identify themselves - by means of GUID or whatever other stuff I could glean from the Windows Genuine Advantage and other DRM-related bitstreams - as belonging to my target population.

Paranoid? If you're not paranoid, you're not thinking far enough ahead.

Re:And this door leads to...

[Tebriel]

A lawsuit is not the answer to everything.

Steve Gibson is a crackpot

[Sycraft-fu]

Please remember this is the same Steve Gibson who claims to have invented a new amazing "nanoprobe" technology for port scanning which he claims is a first to the world and can do just about everything. Of course turns out to just be specially crafted TCP packets with no payload, which nmap has done since forever.

The guy is a massive alarmist and I wouldn't take anything he says seriously. He loves to cry about the end of the digital world type scenarios, perhaps because he really believes it, or perhaps because it gets him more business.

Re:Steve Gibson is a crackpot

[Moby Cock]

Normally I'd agree with you. But in this case I think he may have found something very important. This WMF flap stinks to high heaven. The fact that there seems to be a specific and deliberate key (length == 1) is very disturbing. Gibson is a wacko and doomsayer, but today he may have found something valid.

Re:Steve Gibson is a crackpot

[Rashkae]

Overlooking that Wine has innadverdantly re-created this 'back door' by following the API spec. This is all by (poor) design, no code back doors involved. Not even a bug, per say, since it's working as designed.

Re:Steve Gibson is a crackpot

[RShearman]

The Wine bug was a different bug. The SetAbortProc record specifies a pointer to a function which will be executed at a later point, and which it would be difficult to set to arbitrary code in the WMF itself, whereas this bug appears to be creating a thread which immediately runs starts executing the instruction at the next byte in the meta file.

Interesting evidence

[joshtimmons]

I agree with the author that the length prefix is something of a smoking gun. It begs the question of "how do we know it was fixed..." For example, they could change it to execute the datastream when length is set to a new trigger value; or a stronger backdoor would ignore any unsigned code. Still there, but harder to test for.

It's a straightforward way to add a backdoor that will bypass firewalls, etc. It can be triggered by a browsed page, email, etc. It's better than gif/jpeg encoding because those are more "platform independent." and the payload would be more likely noticed by a 3rd party decoder.

On the other hand, isn't this flagged as an attempt to execute code on a data page?

Also, if it were official, doesn't MS have easier ways into a general box - say through security updates, or even the entire existing code base?

Please not Gibson again...

[Anonymous Coward]

Steve Gibson is not a security expert

http://www.grcsucks.com/

Re:Please not Gibson again...

[NtroP]

Steve Gibson is not a security expert

I'm not a security expert either. But if I came up with this evidence, how would that change the reality of the situation. The evidence stands on its own merit. His reputation has nothing to do with it. This is easily verifiable by anyone with at least his level of knowledge. It will be interesting to see what happens when other "real" experts start looking at this.

What about wine?

[Meltr]

I thought the same vulnerability exists in wine?

http://it.slashdot.org/article.pl?sid=06/01/06/204 3203

Re:What about wine?

[Deanalator]

The only thing that I can think of would be blind reverse engineering or something. No offense to whoever submitted the code, as Im sure that can be taken as a massive insult (I know I would be annoyed if someone made accusations like that about my code). Maybe the wine developer was just very anal about the specs and didn't realize what could be done with it, but it is a good defensive point for microsoft.

Yeah...

[TheAwfulTruth]

Isn't this the same Steve Gibson that was freaking out about how Raw Sockets in XP were going to destroy the world a couple of years ago?

S.G. is a flaming idiot, he looks for (and imagines) ghosts and spooks in every corner. Then flogs his conspiracy theories to promote himself and his buisness. This probably holds about as much water as the "discovery" of cold fusion and Korean human cloning.

Why aren't we reporting on REAL bugs like the 4 security vulnerabilities found in iTunes this week which opens both Windows and Mac users to external attack? Was the Microsoft bashing quota too low this week?

What is becoming of /.?

Re:Yeah...

[NtroP]

Isn't this the same Steve Gibson that was freaking out about how Raw Sockets in XP were going to destroy the world a couple of years ago?

Didn't that get quietly fixed in a subsequent update and therefore NOT become an issue? He may be an alarmist, but he's normally a Pro-MS guy. In this case, I think he's on to something.

Re:Yeah...

[lachlan76]

It wasn't for security though. The reason they disabled raw sockets was to stop people from using them to get around the limits on network connectivity between XP Home/XP Pro/Server 2003.

You're on

[Benanov]

Actually, I think Microsoft will go after Gibson's reputation.

Re:You're on

[rbochan]

Like that'd be a tough thing to do...

As Eddie Deezen would say...

[east coast]

I can't believe it, Jim. That girl's standing over there listening and you're telling him about our back doors?

You guys are so dumb, I'd go straight through Falken's Maze.

I just hope David Lightman isn't reading this... we'd only have a few days until it was all over for us...

Re:Unparalleled BS from MS.

[Soporific]

I't a lot like the Allied soldiers who were fighting in Germany, being told all these horror stories about how evil the Nazis actually were, and then coming upon a concentration camp and finding out that these stories were real after all.

It's nothing like that actually, you are comparing apples to supernovas.

~S

Re:Another?

[gbobeck]

How about a link to information on the "other" intentional back doors that exist?

Sure fine... Behold the Power of Google!

Have Fun.

Thread Creation

[Lagged2Death]

For me, that length==1 trigger is the most convincing evidence.

I don't think it's surprising that a piece of code might behave in an odd way if it's given invalid input, i.e., if a buffer length is wrong.

I think the real giveaway here is that Windows creates a new thread when presented with this magic length. That's like rolling out the red carpet for the attacking Huns. I don't think the average buffer overflow type exploit gets it's own thread or process.

And of course it's still possible that it was all a mistake. The C language can be used to write some extremely tangled code, if one is so inclined. Something like an incorrectly used setjmp/longjmp could have effects like this.

Re:Thread Creation

[atfrase]

I don't think it's surprising that a piece of code might behave in an odd way if it's given invalid input, i.e., if a buffer length is wrong.

Again, agreed. But again, the catch is in the particular kind of odd behavior. If I were writing that code and it hit an invalid length, I'd probably abort processing of the whole file, presuming data corruption. Failing that I'd just skip over the flawed block and proceed with processing the next one. In that case, I could imagine not checking the length very carefully and just going to " + " to process the next block -- this would produce the observed "next byte" pointer.

The problem is in the semantics: I said *process* the next block, not *execute* it. If anything this would just cascade into more error cases, since the data that was expected to be the "next block" would almost definitely also have a malformed header (since it wasn't intended to be a header at all), etc.

So, I guess you're right - the tipoff is still that actual code is executed without having to be specifically pointed to (i.e. buffer overrun), and that it's executed in its own thread, rather than taking over the processing thread that was interpreting the metafile in the first place.

Re:Thread Creation

[bdcrazy]

Could this possibly be an indirection by laziness or something more sophisticated?

I know i've modified some already working code to use inputs that would have been 'invalid' for before the modifications to add new functionality to small programs to do other things that are similiar without having to start them from scratch.

I could see this as being a way to allow unknown image formats encapsulated in WMF files to create processes to decode and display images that weren't of the type the original WMF knew about? I know this is just speculation, but it could be a neat way of doing things, a la, including the decoder along with the actual thing to be decoded, but also bad for security purposes.

Re:Thread Creation

[0123456]

"it's executed in its own thread, rather than taking over the processing thread that was interpreting the metafile in the first place."

But that's only an issue if the WMF-processing code doesn't create a new thread in order to call the subroutine in the valid case. In reality you'd almost certainly want the callback to happen in its own thread, rather than to allow anyone to run abitrary code in the same thread as the print server.

Re:Thread Creation

[Ancil]

I think the real giveaway here is that Windows creates a new thread when presented with this magic length. That's like rolling out the red carpet for the attacking Huns. I don't think the average buffer overflow type exploit gets it's own thread or process.

I don't find this (or the originial article) convincing. He makes a wildly unsubstantiated claim about the WMF vulnerability being intentional.

The whole Escape/SetAbortProc vulnerability is built around some (admittedly stupid) functionality in WMF files. WMF files have the ability to set an application callback function for an abort condition.

If the code which prcoesses this WMF file is going to call a user-supplied abort procedure, it's very reasonable for it to create a separate thread for that to happen in, rather than blocking. After all, it has no way of knowing what the application's response will be, or how long it will take.

That seems to be the one

[Anonymous Coward]

PJ posted this story over at Groklaw. Many posts replied that, based on this guy's previous record, his accusations are not trustworthy.

Before I believe this story, I want to see independent confirmation by someone I trust.

Patch

[Paradise Pete]

If it were intentional you'd think they would have been able to patch it a little more quickly.

Who DOCUMENTS their evil backdoor?

[nweaver]

Who writes an evil backdoor, which dates back to Win3.1 days (when you didn't NEED an evil back door, and Windows had no clue what this Internet thing was about), and then DOCUMENTS it?

Lest we forget that Wine also proved vulnerable, and it was a clean-reimplementation of the specs!

Re:Who DOCUMENTS their evil backdoor?

[RShearman]

Wine has a different bug related to the SETABORTPROC record, but with a valid length field, not the special behaviour with a length of 1 described in the transcript.

Ah, nice Ad-Hominem attack in there...

[Spy der Mann]

The name means nothing. It's the facts that matter. Whether he is a one-day hacker or some looney, he discovered that for Length==1, (a completely invalid value that makes no sense for WMF's), Windows creates a new thread and starts executing the code.

IMHO your "debunking steve gibson" site is nothing but a smokescreen to divert the attention from Microsoft's vulnerabilities and backdoors.

Re:Ah, nice Ad-Hominem attack in there...

[undeadly]

IMHO your "debunking steve gibson" site is nothing but a smokescreen to divert the attention from Microsoft's vulnerabilities and backdoors.

In my not so humble opinion, you don't know what you are talking about. Go read some of the links in that site, and you'll see that Steve Gibson is one of the many "security experts" that have no clue but gives dangerous and very wrong "solutions".

Re:Ah, nice Ad-Hominem attack in there...

[TheNumberless]

In my not so humble opinion, you don't know what you are talking about. Go read some of the links in that site, and you'll see that Steve Gibson is one of the many "security experts" that have no clue but gives dangerous and very wrong "solutions".

In my ever-so-humble opinion you completely missed the point of the parent. The reputation, sanity, motives, and anything else dealing with the person making the claim has nothing to do with the validity of the claim itself.

In this particular instance, there is at least some apparent merit to the idea that this was an intentional backdoor, and that merit would be there regardless of who points it out.

If you want to discredit the idea that this is an intentional backdoor (of which I am far from convinced), then you should attack the argument directly, not the man making it.

Re:Ah, nice Ad-Hominem attack in there...

[toadlife]

"The reputation, sanity, motives, and anything else dealing with the person making the claim has nothing to do with the validity of the claim itself."

Technically what you just said is absolutely correct, but, regardless of whether it's correct to do so or not, the fact that people are taking Gibson's claim with a grain of salt is hardly suprising.

Recommended Reading

Re:And this door leads to...

[Anonymous Custard]

"A lawsuit is not the answer to everything."

Since profit is all a corporation cares about, suing away those profits is the only way to punish it.

This guy is a moron.

[gregarican]

I browsed over several posts on his website and come away with the conclusion that he is a few fries short of a Happy Meal. Here's one posting that I found really amusing:

"Thank you Microsoft for blessing us with a patch to fix the products
you currently sell. The products that compete with Linux and Macintosh.
Excellent job at diverting the our attention away from the fact that
Windows 95, Windows 98, Windows 98SE, Windows Millennium Edition, and
Windows NT4 remain vulnerable. Neat trick convincing people that "the
vulnerability is not critical because an exploitable attack vector has
not been identified that would yield a Critical severity rating for
these versions."

Lemme see here. Windows 95 is 11 years old. Windows 98 is 8 years old. Windows ME is 6 years old. And Windows NT4 is 9 years old. How many other operating systems offer patches and support product versions for software that is that old?

Ridiculous.

I'm going to post my hierarchy of vulnerabilities.

[khasim]

I've posted this once today.

1. Remote--root access that does NOT require human intervention or other app running.

2. Remote non-root access that does NOT require human intervention or other app running.

3. Local root access that does NOT require human intervention or other app running.

4. Local non-root access that does NOT require human intervention or other app running.

5. Remote root access that requires some human interaction or some combination of apps.

6. Remote non-root access that requires some human interaction or some combination of apps.

7. Local root access that requires some human interaction or some combination of apps.

8. Local non-root access that requires some human interaction or some combination of apps.

9. Remote OS crash.

10. Remote app crash.

11. Local OS crash.

12. Local app crash.

So, Microsoft's criteria would be equivalent to #1 here. And I agree that it is "critical". It is the WORST possible vulnerability. Which is why I listed it as #1.

But #2 is only slightly less devastating. And if you combine #2 with #3, you'll have the equivalent of #1.

Therefore, ANY remote attack that gives you ANY user level or above access should be "critical".

But who really cares what name you assign them? "Critical", "Red", "Emergency", "Category 1", whatever.

What matters is what avenue is open for attack and what the results of that attack will be.

1,000 level 12 vulnerabilities aren't anything compared to one single level 1 vulnerability.

Back door flaw?

[digitaldc]

If it is intentional, I don't see how it possibly got past the Microsoft Security Engineers.

Why hasn't he stepped into the WMF interpreter?

[criznach]

My question is this... If the guy is smart enough to know that windows has kicked off a thread and executed his code, and he's smart enough to experiment with buffer-overflow exploits, why hasn't he stepped through the WMF interpreter code? Could it be that he doesn't want to admit that he has for legal reasons? I know that if I had discovered this problem, that's just what I would do. Call DebugBreak() and you have a call stack. You'd think that the handler for this SetAbortProc function would be pretty identifiable. So... Who's got the balls (or the time, in my case) to do it? That's our answer. Chris.

Backdoor Holes

[RequiemX]

Most backdoor hole problems can be patched with the application (of) Preperation H.

Would be a Crappy Backdoor

[ErMaC]

While the guy makes some good points, there's one point I think he's overlooking. He claims motive for this would be to allow Microsoft or someone else to get into older/current Windows systems as an intentional backdoor...

If that's the case, they chose a dumb place to put it, because the exploit doesn't even work on Windows 2000 and below without some program installed to handle WMF files. From Larry Seltzer's blog (linked from F-Secure):

http://blog.ziffdavis.com/seltzer/archive/2006/01/ 03/39684.aspx

Except for Windows XP and Windows Server 2003, no Windows versions, in their default configuration, have a default association for WMF files, and none of their Paint programs or any other standard programs installed with them can read WMF files. One ironic point to conclude is that not until their most recent operating system versions did Microsoft include a default handler - the Windows Picture and Fax Viewer - for what has been, for years, an obsolete file format. And now it comes back to bite them.

That means that unless Microsoft used some OTHER backdoor to install a handler for it, this backdoor is useless. I suspect this is merely an oversight on their part, and that it just ends up looking bad when you view it from the outside. The only way to know is to see the source code and well, we know how likely that is.

A real backdoor would be something remotely exploitable via the network, as opposed to hiding inside a file or something like that.

Slash used to be a much better place

[Kylere]

There was a time in the history of slashdot when this would have been dissected in terms of a technological perspective. Now we just have anyone who is offended with Gibson attacking him. I have to wonder how many script kiddies are the base of the anti-Gibson press, because regardless of his state of mind, he has contributed more to system security than anyone who is flaming him.

Win98 is 8 years old -- so?

[talexb]

I still have two systems in my house that run Win98 -- because of the applications I need to use. They'll probably disappear in the next two years, but if you look at web logs on a public site, you'll probably see 10% of the browsers are still coming from Win98.

It's not dead yet. You just wish it were. ;)

Re:And this door leads to...

[avalys]

Uh, no, how about not buying its products?

If you buy a cell phone and decide the interface is sucky, you don't punish the company by suing them. You punish the company by buying another brand next time.

Re:And this door leads to...

[mysticgoat]

A lawsuit is not the answer to everything.

Too true.

This is a case for criminal prosecution. Gibson has uncovered evidence that at face value demonstrates that there has been a conspiracy to defraud Windows users, and possibly to defraud Microsoft Corporation itself. Microsoft's internal documents would identify the coder(s) involved in this deceit, and possibly other conspirators.

I think it is time for the Washington State Attorney General to give this to a Grand Jury. (IANAL, but I think it is the business of a Grand Jury to determine if a crime has been committed in this kind of circumstance).

Let a Grand Jury hear this evidence and decide whether it appears that some person(s) deliberately set out to violate the privacy of Windows users.

Not sure...

[BRSQUIRRL]

This looks weird but it still needs more research, especially given Gibson's somewhat dodgy reputation.

1 as an input value is one of those classic boundary conditions that developers should always specifically test against (but sometimes don't...along with 0, negative numbers, MAX_whatever, etc)...so I'm not convinced that it was just a coding error. If the "magic key" length was something completely random like 6385492, then I would be more suspicious.

C'mon MS...let's see the code!

Re:Not sure...

[Dachannien]

Your supposition would require that no record in a WMF file could be 6385492 words long - or, more specifically, that there is a known maximum less than the maximum storeable value. As Gibson mentioned, the minimum record size is 6 words, which frees up the values 0 through 5 to be chosen as your magic key (or perhaps negative numbers if you use signed values for the record size). Picking one of those values would have been a lot quicker than trying to construct a maximum sized record and determining its length so you could pick something bigger.

Gibson's findings are interesting, and as you say, certainly merit more study. As someone else said somewhere around here, stepping into and/or disassembling the relevant Microsoft code would give greater insight, as would finding out what old versions of Windows carry this problem - including old old versions like Win3.1 or whichever version introduced WMF in the first place.

It's his assertions based upon those findings that may be a bit suspect, but that's what future research would hopefully clear up. Considering that we can't rely upon Microsoft for full disclosure, we need someone in a country that's a bit more, um, liberated than the U.S. in terms of reverse engineering to take a look at it. Gibson's rantings may seem over the top sometimes, but his strategy is to get someone with the expertise/legal protections/authority/etc. to get involved. (For that matter, it's not unlike the kickback rumors that CmdrTaco responded to the other day. Few people believed that they were actually taking kickbacks, even among the people who posted those rumors in the first place, but the rumors were enough to get CmdrTaco to take action concerning the actual problem of people abusing Slashdot for PageRank.)

Think about it like a programmer

[RingDev]

Code encounters escape character

exit standard processing

encounter SetAbortProc

open thread to communicate with windows print manager

thread attempts to read [length] bytes for sub value, encounters overrun

this is where I'm guessing the real horrendous problem lies. I'm guessing that the original code ignores exceptions while pulling in the sub value, so in this case where code hits an overrun, instead of that sub value getting a few bytes of data, it just graps until . In this case that sub value winds up being the payload.

So there you go, key and payload on an independent thread because of a bad exception handler in a 12 year old block of code.

-Rick

Re:Unparalleled BS from MS.

[mattbot 5000]

It's nothing like that actually, you are comparing apples to supernovas.

It's worse, actually. He's comparing security holes to concentration camps.

Re:Unparalleled BS from MS.

[jcr]

Germany, being told all these horror stories about how evil the Nazis actually were, and then coming upon a concentration camp and finding out that these stories were real after all.

The stories Allied soldiers were told about the nazis paled in comparison to what they saw in the camps. Allied propagandists didn't have the imagination to come up with anything like the holocaust.

-jcr

When does Microsoft fix the exploit where...

[blair1q]

posting a URL on /. causes the server to crash?

Re:Another?

[Pneuma ROCKS]

http://www.imdb.com/name/nm0385296/

Easy one to test.

[jd]

There are many ways in which 1 could purely coincidentally be tested for - using multiple bitwise operations that don't completely cover the word, for example.

However, there are a few very specific ways in which you would write code to deliberately look for that specific value in a specific portion of an operation. These ways can be checked by inspecting a disassembled version of the code. (But do this outside of the US, or the DMCA droids will Use The Force.)

Since WINE shows the same hole and the coders are not the same, it would be my guess that the problem is specifically in a DLL that is used/usable by both. It should also be possible to massage WINE to fire up a disassembler with the correct entry point into the DLL that has the hole, when passing the exploit payload. It might take a while (I suggest getting a few month's supplies in advance), but it should be possible to determine exactly where the exploit is, whether it looks "natural" or not*, and whether that specific section of code is likely called by other graphics routines.

*A "natural" bug could include a series of conditionals and jumps, where the 1 is simply the untested case that falls into random code. An "unnatural" case would be to test specifically for 1 and to jump in a different way than for other cases. (eg: If other cases jump to subroutine, and 1 does a one-way jump OR on return is the sole case that jumps over all error conditions.) If that one case has an abnormal test and an abnormal jump, it would be next to impossible for it to be accidental.

Actually, it might be useful against Microsoft in their appeal over the EU ruling. The EU ruling demands greater transparency of protocols and code, and demands code be uninstallable by someone. The politicians might not care much about the exploit, even if it were deliberate, but I'd be willing to bet the EU's lawyers would. Even if Microsoft as a corporation were innocent (yeah, right), it demonstrates a valid legal concern that cannot be resolved using totally closed, airtight methods.

still in use

[Anonymous Coward]

The 98 series and NT4 are still in widespread (millions and millions) use. This is called a "problem" then. The auto industry in the US tried to pull this stunt of obsoleting and stopping support for their products in short time frames (sometimes within the SAME model year!) and got legally smacked down for it. Now they are required to provide replacement parts for ten years. Just because normal business productlaws and warranties aren't applied to software-yet, and they certainly should be-doesn't mean it wouldn't be a good idea. Planned obsolesence and forced upgrades might be a spiffy way for some corps to extract a lot more dineros from your wallet, but it doesn't mean it's a good idea for you the consumer/end user...unless you are a pure "caveat emptor" anything-goes styled capitalist. Thankfully, most people see the illogic in that sort of system and that is why we have evolved some consumer protection laws. It is not a perfect solution, but it is light years ahead of legalised snakeoil like it was before. Eventually these sorts of laws will be applied to software,because even the dullest clicker is starting to bingo to the fact that most of this forced upgrade stuff is a cash cow dodge.

blank admin password

[Mr 44]

Get a clue, troll- if you have a blank admin password, XP prevents ANY remote network access using that account. You are actually more secure with a blank password.

Re:blank admin password

[tpgp]

Get a clue, troll-

If you're going to accuse someone of trolling, you want to be pretty sure about your facts.

if you have a blank admin password, XP prevents ANY remote network access using that account.

Hmmmn, thats an interesting band-aid.

You are actually more secure with a blank password.

Really? More secure with a blank password? I doubt it.

Would make privilige escalation pretty damn easy after you'd hacked a user account.

And it makes all that least priviliged user stuff that MS goes on about a little irrelevant too.

Re:blank admin password

[John Newman]

Hmmmn, thats an interesting band-aid.

Must be a pretty recent band-aid, too, since I deloused an XP computer exactly one year ago that had a blank admin account password, and which had been pwned by a worm that spread precisely by trying to log into everything it could see using administrator/[blank].

Probably more to be found, may work together?

[Jtheletter]

The freakish thing about this, is that if it is indeed a backdoor, it an odd way to go about it. You can't force someone to try to view a WMF

That we know of that is. This has been lurking about in every version of windows since 95, right? And it's taken until now to be brought to light. How many other similar seemingly innocent bits of code in those millions of lines of legacy windows code do similar things? The question is not what can this exploit do on its own, but what can it do in concert with others that may exist? OK, so maybe I'm giving MS or the rogue programmer, or whoever did this (length==1 check and seperate thread would imply it's not a mistake) too much credit, but if whoever did this was very clever they might have implemented a waterfall backdoor of sorts. In other words there's two or three exploits that when used in concert spell pwnage for almost any windows box. I'm willing to bet there's more here that hasn't been found yet. I'm also betting, along with others, that MS will not accpet responsiblity, nor even point the finger at a programmer or contractor/company to take the fall because that would also make them look completely unsecure. How many programmers have contributed to windows code over the years? And MS would be admitting they don't have knowledge of any backdoors those programmers may have introduced? No, more likely as Benanov (583592) suggested, MS will simply try to smear Gibson as someone with a vendetta and/or crackpot/idiot and try to downplay the whole thing as it has been.

This is exactly why closed source is dangerous. Even security through obscurity is useless when the code holders don't know what's in their code. Open source may have similar problems, but at least there's plenty of people looking, and plenty who will be motivated to correct an issue when it's found instead of trying to pretend like it never happened. Which includes the issue of whodunnit and how to stop that from happening again.

Re:Another?

[monkeydo]

Actually, it's pretty well known that that isn't what happened at all.

Right...

[WiseWeasel]

Yeah, right... trust the Chinese government to uphold our privacy rights. Anyone who runs Red Flag Linux voluntarily should have their head examined. I think Gentoo might be a safe bet...

Re:Another?

[lgw]

You mean the urban legend about an NSA backdoor? There was *never* any evidence of a backdoor, only a registry key named "NSAKEY" and a bunch of paranoid fantasy. Because, you know, if the NSA did have a secret backdoor, they'd make sure is was called NSAKEY, in case they forgot where it was, or something.

Reflections on Trusting Trust

[Mr Z]

I'm surprised nobody's trotted out Reflections on Trusting Trust, by Ken Thompson. Not only does this discuss a backdoor, but also a backdoor that can't be found by examining the source code.

Re:Reflections on Trusting Trust

[2names]

Instead of tearing me a new one with accusations, why don't you educate me with your knowledge of crypto by putting forth some examples?

But wait, there's more...

[IPFreely]

It that is all it was, then the the same thread would jump into the user code. But wait...

I found was that, when I deliberately lied about the size of this record and set the size to one and no other value, and I gave this particular byte sequence that makes no sense for a metafile, then Windows created a thread and jumped into my code, began executing my code.

So, it accidently created a new thread, and directed the new thread to start executing code at the specific position? That's a whole different level of accident.

Oh, and Shimmer, I'll take that 5$.

Re:But wait, there's more...

[ROBOKATZ]

Part of the setup of the AbortProc packet is the callback address. But in this case, the place where the callback address would be is instead the first byte of the newly executed code. So the callback address cannot even be put into the packet properly. That is where the code has to be.

Keep in mind there is an interpreting layer separating the WMF from the actual GDI call. It's entirely plausible that in some confusion the real Escape call is being passed the address of the argument in the script rather than interpreting the data in the script as the pointer value. Not only is this plausible, but it makes perfect sense -- any function interpreted in this context would have to work this way, for example, TextOut usually accepts a pointer to a string, but I bet in a WMF you would simply supply the string literal, and the WMF interpreter would pass a pointer to that data to the real TextOut.

The escape for AbortProc is the way to set the callback in the first place. But since the packet is messed up (the length is one rather than the proper length) then effectively the whole "ESC/AbortProc" packet should never even be properly processed.

It's likely that the length record is merely used to determine what to increment the pointer into the script by once the current packet finishes execution -- if this is the case, an invalid length would not effect the current packet, but then would cause problems after the current packet is processed.

Finally, someone has pointed out that the length does not have to be one.

There is nothing outrageous about this in the least.

Re:But wait, there's more...

[IPFreely]

Hmmm. Interesting. With all that (esp length != 1) it starts to form a picture.

Programmer initially writing this thing needs to debug along the way. He puts in AbortProc with imbedded code rather than callback pointer (after all, where could it point to?) to make a popup or something. If set properly, it mearly keeps the address of the code and continues. Later somewhere it hits an error and aborts. When the interpreter Aborts, he gets his popup in the right place. Maybe he did it for himself, or maybe he did it for someone else who's writing a WMF author. He's not thinking about potential misuse.

So... What happens if you make an AbortProc packet, with embedded code instead of pointer. Then you set the length properly to point to after the code. Then there's another error later. Will it abort? Will it run the code? It's worth a test to someone with a test harness.

It's looking more like design. But maybe not malicious design, just "too clever for it's own good" design.

Sun and HP for two

[Secrity]

"Windows 95 is 11 years old. Windows 98 is 8 years old. Windows ME is 6 years old. And Windows NT4 is 9 years old. How many other operating systems offer patches and support product versions for software that is that old?"

I know of at least two. Both Sun and HP still provide support or patches for versions of UNIX System V that are older than Windows 98.

Jumping to conclusions.

[matman]

Having read the whole thing, I do think that Steve may be jumping to conclusions a bit too quickly.

I think that we ARE talking about the SETABORTPROC vuln that everyone has been talking about; Steve just finds that the vuln doesn't work quite the same way that he was expecting. It seems that Steve is basing his accusation on the fact that he had to set the length field of the code containing WMF record to 1 (an illegal value) in order to get his code to execute. While this seems odd (and sounds like a "magic value"), there is likely a better explanation. Here's one possibility... The advisory from Secunia at http://secunia.com/advisories/18255/ says that the embedded code executes when any error is detected in parsing the WMF file (not only [or ever?] when canceling printing). Maybe the SETABORTPROC function was originally intended for printing but was overloaded to handle parse error callbacks? Depending on how the parsing code was written, it may treat the invalid length value as such a parsing error, but may have already indexed the the beginning of the code block (since it knows the length of the record header) - it just doesn't know when the code block ends. It can then start executing the code block, even though it is an error in the code block's record that caused the error. I wonder if the code block would execute if the correct length was specified but the NEXT record in the WMF contained a similar error (like an invalid length field).

He may very well be correct that someone has intentionally included this mechanism as a backdoor, but he is being premature in making such claims without first consulting the people who have a lot more experience with this vuln than he does. By the way, MS gives access to their source code to a LOT of outside parties - I'm sure that Steve could have found someone to take a look for him.

I don't mean to make an ad hominem attack (this podcast is actually fairly accurate - just jumps to conclusions), but Steve isn't exactly known for being a respected researcher in the security industry - he's a bit of a poser and sensationalist/alarmist. My gut feel is that Steve is continuing on his sensationalist streak, jumping to conclusions and trying to drum up more excitement. He frequently hypes issues to crazy levels and tries to make himself look like a hero/expert. In fact, he usually offers little insight and often tries to pass off regurgitation (often inaccurate) as original research. Just listen to him in this recording talking about "rolling up his sleeves" and "wrote all my own code", etc. Look up his stuff on nano-probes (http://grc.com/np/np.htm) for some funny stuff. I am a security professional and can tell you that much of his writing is BS and/or hyped/obfuscated wording for technologies and techniques that have been in common usage for years and years before he writes about them. I just can't help but take Steve's claims with a grain of salt.

Old coding practises, not conspiracy

[g2devi]

> but what possible code could be "fallen through" into
> that would set CPU execution *inside* the metafile

Actually, I think it was done for performance releases (remember, existed back in the Win 3.0 days).

Back in ye olden days, there was a common software practise called self modifying code. It was used in some implementations of FORTH, but it was far more popular on systems that had few registers like C64. It was generally used as a way to dramatically speed up code on those slow processors.

Have a look at the popular C64/Atari program SpeedScript (see http://www.atarimagazines.com/compute/gazette/1987 05-speedscript.html or http://www.atariarchives.org/speedscript/ch3.php ).

The source code it gives an example:
"This module is chiefly concerned with the word processor editing functions.It contains many common subroutines, such as TOPCLR and PRMSG to clear the command line and print messages. It contains the initialization routines and takes care of memory moves (inserts and deletes). A second module, SPEED.2, is responsible for most input/output, including the printer routines. SPEED.1 is the largest file in the linked chain. UMOVE is a high-speed memory move routine. It gets its speed from self-modifying code (the $FFFFs at MOVLOOP are replaced by actual addresses when UMOVE is called). UMOVE is used to move an overlapping range of memory upward (toward location 0), so it is used to delete. Set FROML/FROMH to point to the source area of memory, DESTL/DESTH to point to the destination, and LLEN/HLEN to hold the length of the area being moved."

Re:Old coding practises, not conspiracy

[Procyon101]

This is *SEVERELY* doubtful.

1) NT Win32 is a fresh implementation of the Win32. This doesn't share Win16 code.
2) NT, and especially Win32 is written almost entirely in C++. Ever try to do self modifying code in C++?
3) The security push from 2 years ago would have never let self modifying code pass.
4) Intel Procs aren't particularly suited to self modifying assembly.
5) Nobody on the Windows team would seriously consider using it, ever, even if it is joked about on beer Friday. Any attempt to use it in reality would start with a flogging and end with a firing.

Re:Old coding practises, not conspiracy

[shadow169]

2) NT, and especially Win32 is written almost entirely in C++. Ever try to do self modifying code in C++?

I get the feeling you don't spend your days mired in Win32 application coding. The Win32 libraries are all written in C, not C++. This is why different languages such as C, C++, VB, and even the new .NET runtime can all link to the same libraries, they all support C exports. There are no separate versions of libraries like user32.dll and gdi32.dll for VB, C, C++, etc . .

And oh yes, don't think that MS is re-implementing CreateWindowEx() (in user32.dll) in the .NET world. Any application, no matter where it was written, or in what language, if it runs on Windows it will at sometime end up in CreateWindowEx() (actually CreateWindowExA or CreateWindowExW) in user32.dll.

Take a look at the actual Win32 API

http://msdn.microsoft.com/library/default.asp?url= /library/en-us/winprog/winprog/functions_in_alphab etical_order.asp

See any classes in there?

Re:Old coding practises, not conspiracy

[Procyon101]

Hehe. I didn't say it was *GOOD* C++ :)

Most MS coding from this era (and even nowdays) is a bit of a mix. It is compiled as C++, but written in a mostly C style and given external C linkage. It's a weird mix. It did allow some C++ constructs that were disallowed prior to C99, like relaxing the location of variable declarations and such, and tightens up the type saftey a bit. It also allows some other nicities like structs used internally to occassionally have private members, although these more C++ aspects are rarely used. But yes, you are correct that it is primarily C stylistically (and for linkage purposes) but in reality it is C++ written in a way that makes C++ advocates cry.

Re:Wine proves TFA wrong

[spitzak]

Apprently WINE does not have this length==1 bug. It has the documented bug, which is "the next 4 bytes of this file are interpreted as a pointer to jump to if you abort printing", which is bad, but not exactly this.

I'm not really buying this guys explanation, however. Software errors can have very strange side effects. Probably the short length causes it to reuse (rather than overwrite) the contents of some buffer as the code pointer, and that buffer just happens to contain a pointer to the next record of the metafile, and the length is also considered an error by some other code and thus triggers an "abort". A length of zero is detected and skipped correctly, while lengths of 3 or 4 overwrite enough of the pointer so that it does not work, making this 1 case the only one.

Cue the following scenario

[SmallFurryCreature]

A black van pulls up to your ISP, several men in black suits emerge and enter the office.

Agent A: We would like to access your network routers.

ISP clerk: Why? Who are you, can I see some papers?

Agent B: [Pulls out a black gun] You don't need to see our papers geek boy.

Agent A: Mr. Smith please, not yet. Our papers are in the mail, do you want to wait for them to arrive? Mr. Smith here hates waiting but if you want to force him to wait I am sure that is fine.

ISP clerk: [looks at Agent B playing with a blackened knife] In the mail you say? Oh that is fine, absolutly let me buzz you in.

Agent A: Thank you for your cooperation citizen. I will just be a minute, Mr Smith here will keep your company so you won't get lonely and feel the need to call anyone. [enters the machine room while Agent B plays with his knife]

Agent A: [returns after a few minutes] We will be leaving now. The goverment thanks you for your cooperation, please refrain from speaking with this about anyone.

The two agents leave and the ISP clerk decides that he needs another job.

Question: How to force a people to retrieve an infect WMF file? Answer: Control the network.

Any computer connected to the network does so because an ISP somewhere routes the calls to the proper adress. Rerouting it is trivial for the right people.

This could be done by the goverment in exactly the same way they redirect phone calls (You never seen a movie where people call phone X only to find themselves talking to phone Y without their knowledge?) OR another reason?

This "bug" is claimed to be new to windows 2000. Roughly the time of all those worms when it became impossible to patch a new windows online BEFORE it was infected. Now imagine the solution if this had gotten really out of control were a worm so nasty was out that EVERY windows machine connected to the net would instantly be infected. How would you patch all those machines? Especially considering how impossible it is to get users to actually PATCH their bloody machines? You could make the argument that what would be needed is somekind of solution were every windows machine connecting to the net would immidiatly be patched.

Cue every ISP being told to redirect their users to a WMF file (every isp is capable of this) and voila, instant enforced patching no matter how much you disabled MS update.

The only problem with exploiting this is for complete outsiders. The goverment has absolutly no problem exploiting this exploit to root your machine.

Is this the explenation? I don't know. I am just guessing and not accepting the easy answer.

malfeature

[HTH NE1]

Similarily, they are both features. Features can't be bad, right?

feature : n.

2. [common] An intended property or behavior (as of a program). Whether it is good or not is immaterial (but if bad, it is also a misfeature).

So yes, it's a feature, but it isn't a good feature. It would be a misfeature, but I suggest that good and bad aren't sufficient to fully describe this. You need good, bad, and evil. Thus I suggest a new term for evil features like this: malfeature.

And that one can have "mismalfeatures", though I'd rather make that into "dismalfeatures".

Wine bug compared to MS

[codemachine]

It should be noted that although Wine does suffer from a WMF vulnerability as well, the behaviour is not the same one as described here. There is no special case for length==1 in Wine, and no way to have your exploit code right after the length field in the WMF. Wine simply implements the same abort routine that MS's API specifies (and can be argued to be a bad idea in itself, but that is MS's fault not Wine's). The way it can be exploited is completely different, and does not resemble a backdoor in any way.

In fact, the differences between the behaviour of Wine and Windows implies that there is indeed something very unusual about the way Windows handles this special case. Whether it is an intentional problem or just horribly bad coding, that is harder to say.

Re:Wasn't it actually DES?

[Ashinberry]

Actually the changes suggested by the NSA increased the strength of DES rather than decreasing it.

http://www.schneier.com/blog/archives/2004/10/the_ legacy_of_d.html

(OT) Re:Unparalleled BS from MS.

[Tired_Blood]

The problem encountered by those reporting on the concentration camps was that in the FIRST world war, everybody got exposed to extreme propaganda depicting all germans as vile creatures. When the exaggerations and lies were brought to light, the public had then learned to seriously doubt such extreme accusations. It could be argued that when the reports from Jan Karski (an eyewitness to the ghetto and concentration camp conditions) were dismissed, it was due to that legacy of doubt in 1943.

The reporting during WWI damaged the credibility of all reporting during WWII.

jcr (53032): Allied propagandists didn't have the imagination to come up with anything like the holocaust.

They most certainly did have the imagination, but they realized that they did not have a willing audience for such accusations. Successful PR cannot be had with seemingly wild claims, especially if the organization has been shown to greatly overexaggerate in the past.

Re:Another?

[Nynaeve]

Did you not even read your own article? It's not a registry key -- it's a signing key. Furthermore, the key exists and can be replaced with a known key-pair. You can't know it's "paranoid fantasy" or "urban legend" any more than a tinfoil hat can prove it isn't.

Therefore, any objective judgement must be based on the fact it exists, regardless of how it got there. Arguing about whether it was specifically for clandestine NSA activity is pointless, but I don't like the fact these sorts of things exist.

From this page linked from another comment:

The NSA key inside CAPI can be replaced by your own key, and used to sign cryptographic security modules from overseas or unauthorised third parties, unapproved by Microsoft or the NSA. This is exactly what the US government has been trying to prevent. A demonstration "how to do it" program that replaces the NSA key can be found on Cryptonym's [extern] website.

Other Explanations

[logicnazi]

As far as I could tell the only evidence present that the vulnerability really was a backdoor was the fact that the message length needed to be set to *exactly* one in order for the vulnerability to work. Presumably the argument then runs that poor coding wouldn't generate such a specific effect so it must be a delibrately coded back door.

This, however, overlooks many other possibilities and, unless there is other evidence I am unaware of, suggests an ignorance of security vulnerabilities by those making the suggestion. Frequently security vulnerabilities result from data being interpreted in an incorrect fashion as a result of pointer munging or memory collisions. Often some perfectly innocent piece of data (like message length) will get used as an index into some table or mistakenly used in stead of the correct variable in some test and cause incorrect execution or privelege escalation of the user's code.

Even if there is reason to believe this isn't a simple code error like this there are many other explanations other than microsoft or an employees malevolence. For instance imagine this situation:

Initially Metafile execution is designed to execute code in the fashion of the vulnerability with no requirement on the header length. This is perfectly plausible if it was programmed by some new hire without much awareness of security. Hell, it could be a bug introduced to do some sort of debug or get something up and working fast which just got left in the codebase. I'm sure all of us have made a change to our code that screws over security just to do some testing and sometimes people forget about it or get fired.

In any case this security issue in the code base is there and some other parts of windows start relying on it. The security experts eventually notice the issue but by now other parts of windows will break if it gets fixed. Perhaps then the deciscion is made to partially patch the vulnerability but leave a special value for some fields which triggers the old behavior so as not to break the other parts of windows. If this is the case it would explain microsoft's recluctance to patch 95 and other old systems, because a patch would require rewriting some significant part of the system.

Perhaps microsoft even intended to fix the vulnerability but the blah-blah group asks the metafile group to leave in a workaround (the special values) so they can continue to work on the rest of their component. Maybe then the groups are late to the deadline and forget about that issue in their rush. Or perhaps by this time the group members who knew about the workaround have left and no one knows to go back and remove it. Or maybe this is fixed as part of some larger patch applied to the source tree and when it breaks the build late at night and someone calls the metafile team whoever answers doesn't realize its a security issue and backs out the change but forgets to tell the people who made it.

Whether or not I have the details right the point is clear. There are a hundred innocent ways for this sort of vulnerability to arise. It is silly to jump to the conclusion it is an intentional backdoor.

ENOUGH. Gibson was right about raw sockets.

[Catbeller]

ENOUGH. Gibson was right about raw sockets.

After the relentless pounding and smearing of Gibson, Microsoft quietly disabled the raw sockets code, whatever the hell it was.

Gibson was right. They fixed the problem. He was right, The Reg was wrong.

Jesus, it's like arguing with 20,000 Bill O'Reilly's. Truthiness! Gibson is a maaaaadddmaaaannn!

And since people rarely followup to what they think is truthy, they missed the fact that the only reason the Raw Sockets disaster didn't happen is because MICROSOFT QUIETLY FIXED THE PROBLEM, JUST. LIKE. GIBSON. SAID. THEY. SHOULD.

And as for being a top security professional, something he never claimed to be - he's a developer - what makes you all think that the very best security people at the NSA and Microsoft don't already know all about the exploit, because it's one of the many that they placed there in the first place?

Listen, everyperson, Microsoft has cooperated with Justice, the FBI, the NSA and all the other alphabet boys since the beginning. Windows and Office are monitored at will, you can bet your last god damned dollar. Can you imagine MS refusing to cooperate, especially during a ten year monopoly trial??

(originally posted as AC because I'd moderated; however, even posting as an AC, the code retroactively undid my moderation. Didn't know that would happen. A little warning, Slashcode?)

Waif

[djdavetrouble]

where you waif that right.

I really think kate moss doesn't have anything to do with this, despite the recent press tizzy.

Re:Another?

[JourneyExpertApe]

Because, you know, if the NSA did have a secret backdoor, they'd make sure is was called NSAKEY, in case they forgot where it was, or something.

Stranger things have happened. When a German law enforcement agency forced the developers of JAP (Java Anon Proxy) to put a backdoor in it, they put in code like:

if(crimeDetected) {
object->logCrime(...);
}

And it was an open-source project. Someone later admitted that they were kind of hoping that somebody would notice it, because they didn't think they could legally expose it themselves. Maybe someone at Microsoft didn't think it was right for the NSA to install a back door, and they had a conscience. Wait, what am I saying? This is Microsoft!

Malice

[uncle mole]

Never ascribe to malice that which is adequately explained by incompetence. Napoleon Bonaparte

I'm asking "Why?"

[gone.fishing]

I don't want this to sound like I am too "Pro-Microsoft" (I'm not). If Microsoft intentionally put the vunerability into their product then there must be a reason why. That is the question that I would like someone to answer because it does make all the difference. The question goes straight to motive.

If the vunerability was an accident it was stupid and it needs to be fixed. I don't necessarily buy Gibson's reasoning but, I can see how he got there and that is enough to be troubling to me.

Did some rouge programmer think "This is a cool idea? and against the rules just stuck it in there? I can't believe that Microsoft gives anyone that kind of autonomy. They have to have far better code review policies than that. That is harder for me to believe than anything else!

Did some group think that this backdoor coupled with some other software could be used for some acceptable purpose in the future? Did someone say "Hey, with some code off of the Genuine Advantage web site we can use this to disable some features on computers that are running pirated software. This is only an example but I hope you get my point. I can see how something like this may be considered and discussed. I'm not so sure it would make it past the lawyers though. Maybe it was started, aborted, and this was a trace that was forgotten about and slipped bye? This sounds a little far-fetched but I have seen useless bits of code left behind in other coding projects. I'd buy something like this even though it sounds like something out of a bad movie.

Did the NSA or some other agency approach Microsoft and ask to have something like this put in their code? We know that they have asked for encryption code before so that they could examine it so maybe this kind of idea isn't so strange? An exploit that the government knows about could give them a significant advantage in cyber-war. Frankly, this sounds like a Tom Clancy wannabe's plot for a novel. But it could happen.

Honestly though all of this stuff sounds like conspiracy-theory stuff to me. My guess is that it is more innocent than all of that. I'd guess the exploit is a leaving. Something that got left behind from some piece of code that simply didn't make the final cut.

I'd just like Microsoft to explain themselves this one time. Completely, thouroughly, honestly. Then they can tell us what they will do to ensure it won't happen again.

Plenty evidence....like the backdoor CODE!

[kupci]

here's no evidence other than his opinion

(Defending Microsoft - only on Slashdot. Ok, so some monkees tapping on a keyboard while the programmer wasn't looking snuck this code in ;)

First of all, Gibson is no bomb thrower, he's uncovered some pretty serious security issues with Microsoft. I'd suggest reading his web site - he's a very thorough person, and doesn't make any wild unsubstantiated, naive, biased claims, like, say, Slashdotters. He's a long time Windows user, not a Mac fan, nor an open-sourcer (at least until recently, for reasons like this)Now, to quote the transcript, curious where you would even be able to make the claim that that this *isn't* a backdoor:

what I found was that, when I deliberately lied about the size of this record and set the size to one and no other value, and I gave this particular byte sequence that makes no sense for a metafile, then Windows created a thread and jumped into my code, began executing my code. Okay, Leo? This was not a mistake. This is not buggy code. This was put into Windows by someone. We are never going to know who.

Yeah, he's saying this is a deliberate backdoor. Listen to the article or read the transcript, then think about it a little. Now, he's not saying *what* Microsoft put this in for. Did someone put this in for testing -that's my take, from a programmer perspedctive but .. who the heck knows. That's sorta the problem with proprietary software, we might never know. Buyer beware.

Steve: Well, I mean, as you've mentioned a couple times here, I mean, one of the advantages of an open source system is, you know, and I'm finding myself gravitating more and more toward open source solutions because of their transparency. And so, you know, but an advantage of that is that all kinds of people are looking at the code, and there's just no opportunity, especially when you build the system yourself from source, there's no opportunity for anything evil to get stuck in. And also, about this what appears to be a Windows MetaFile backdoor that's always been in Windows from 2000 on, you know, they've done recently serious security reviews of all their code. You know, they took that whole timeout from all the work they were going to be doing and said they were rereading all their code. And this is not the first time metafiles have had a problem. There have been what are probably real bugs in metafile processing in the past, I think two of them. So the whole metafile system would have come under the scrutiny of someone, you know, very deliberately. Now, you know, if Microsoft had said last week, whoops, this was an undocumented backdoor or means for us to run code in a metafile, we never documented it, our security sweeps didn't find it, blah blah blah - but nothing was said. They allowed the industry to believe that this was just like all their other code mistakes, but this wasn't like all their other code mistakes.

MSRC responds: Intentional Back door? um no.

[Stepto]

We've blogged about this already providing the background of the bug:

http://blogs.technet.com/msrc/archive/2006/01/13/4 17431.aspx

I emailed Zonk about it but I don't think he's had a chance to update the posting.

Long story short the idea that this is intentional rests on the premise that only an incorrect value produces the vuln. That is totally wrong, both correct and incorrect values trip the vulnerability. Besides doesn't it seem odd to create a backdoor that would require the user to first visit a website? What, were we going to take out a superbowl ad suggesting people visit www.microsoft.com so we could...uh...what exactly?

S.

Re:ENOUGH. Gibson was right about raw sockets.

[Russellkhan]

"(originally posted as AC because I'd moderated; however, even posting as an AC, the code retroactively undid my moderation. Didn't know that would happen. A little warning, Slashcode?)"

I believe that's intentional. I think some people get around it by either logging out and posting AC logged out or by using a whole 'nother browser, again, not logged in. Can't really say for sure, I haven't tried it.

I probably should post this AC, since it's pretty far from on-topic for the story, but I prefer to be able to know if someone replies to my posts, even if they're OT.

Gibson wrong yet again.

[mkraft]

His conclusions once again are completely incorrect.

See the following post for why this occured.

http://blogs.technet.com/msrc/archive/2006/01/13/4 17431.aspx