Slashdot Mirror
Last Year's CanSecWest Winner Repeats on Vista, Ubuntu Wins
DimitryGH followed up on the earlier news that the MacBook Air lost CanSecWest by noting that "Last year's winner of the CanSecWest hacking contest has won the Vista laptop in this year's competition. According to the sponsor TippingPoint's blog, Shane Macaulay used a new 0day exploit against Adobe Flash in order to secure his win. At the end of the day, the only laptop (of OS X, Vista, and Ubuntu) that remained unharmed was the one running Ubuntu. How's that for fueling religious platform wars?"
It comes with $20,000, $10,000, or $5,000, depending on what day you hacked it. The guy who cracked the Mac got $10,000 and the Vista machine came with $5,000 since it was cracked later. And you can always install *nix.
The laptop isn't insecure, the attacks are taking place against the operating system (and in all three cases, against specific applications - none of the three were hackable without the user taking certain actions).
If the person on the Vista laptop was running IE 7 with the default configuration (protected mode / UAC on), this should not have happened.
Flash, like all other plugins, run within the security context of the low-rights user used by protected mode. Even if the flash plugin had an obvious buffer overflow or other exploit, it would only be able to access the data accessible by that low rights user, NOT the user running IE. That's the point of protected mode.
For a flash plugin to allow for a hacker to access personal files of the user it would not only have to have a buffer overflow (or some other exploit) in flash itself, but also take advantage of a privledge elevation exploit in Windows simultaneously.
I didn't see them specify in the article what browser than were using. Since they said it was an issue with flash, and not Windows, they couldn't have been using IE. My guess is that it was Firefox, since they said they loaded "popular" 3rd party apps.
Futhermore, the file in question must have been accessible to the user running Firefox (or whatever non-IE browser) since that would also require a privledge elevation in Windows.
So I'm not really sure how you can blame this on Vista or even Microsoft. If they had been using IE, it wouldn't have happened, regardless of the flaws in Flash. This says absolutely nothing about Vista security. The exact same thing would happen on every other OS. If you have an app with an exploit, and that app is running as User A, the hacker using that exploit has the same rights as User A.
I suppose one could argue that various defensive techniques like ASLR should have stopped this, but without knowing the details, that's impossible to say. A buffer overflow can just as easily be used to call APIs exposed by the exploited application as it can to call OS APIs, and since ASLR only applies to Windows APIs (indeed, many of these techniques only apply at the OS level), this wouldn't be a fair characterization either.
Indeed, I find it strange that they didn't mention mitigating factors. I realize they're trying to be responsible as far as reporting, but telling people that users running IE on Vista aren't affected isn't exactly giving anything away... aside from the fact that Vista did its job as best it could.
So it was a Flash exploit.... which would mean that each of the machines would be vulnerable?
I don't know the details about the sploit so I don't know if it's OS specific even though it is Flash.
How on earth is this offtopic?
The Monty Python joke goes along the lines of, "This lager is like making love in a canoe - it's fucking close to water"
They created their own exploits.
First, this wasn't some script kiddie applying a known exploit. It was a new exploit that the winning team came up with. It isn't trivial to do.
Second, no, this "could have happened to any OS" is wrong. A well-crafted browser (in this case, the browser is part of the OS) can in theory prevent browser plugins from accessing anything of importance. However I don't think any existing browsers do that - but they should.
Second, and perhaps more important, the existence of 3rd party software on different OSes isn't the same. For example, most Windows users use Adobe Acrobat to view PDFs, whereas many Linux users use FOSS PDF viewers (Evince, KPDF). It might be the case - and I am guessing that it is - that Acrobat has far more exploits against it, both because it has far more code (what with all the functionality 99% of users don't need), and that it isn't open source. In general Windows users tend to have lots of 3rd party apps that are closed source and of dubious quality. That isn't the case on Linux.
Furthermore, even if two OSes run the same app - Flash, say - that doesn't mean they are equally vulnerable. Flash isn't identical between the platforms; if I am not mistaken on Linux Flash uses Alsa for sound (or some other Linux sound system). So if Alsa is more secure than Windows' sound system, that would be one difference.
I'm not saying this competition is a great test of OS security. It isn't; it's an anecdote. But it isn't worthless either. In fact the results are pretty much what I would have expected from the beginning: OS X is a great OS but security has never been a top priority (there wasn't as much of a need for it, so why bother). Windows has focused on security recently but is hobbled by having lots of closed-source 3rd party apps. Linux was always security-focused (starting as a server OS), and has the advantage of most of its software being FOSS and arriving from a repo under the control of the distro (in this case Ubuntu).
The question isn't "Is Flash vulnerable?", but rather does a vulnerability at the application layer allow you to hack into the OS. It is entirely besides the point if Flash is flawed in the same way, thought there is a reasonable likelihood that it is not in this case. There are significant differences in code compiled for the various platforms. We Software Engineers call that "conditional compilation."
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Ubuntu 8.04 will include AppArmor by default. I don't how much of a difference it will make in a pressure cooker like a hacking competition though.
Actually, IE on Vista runs with fewer permissions then a normal User account by default. It runs as a low-integrity process. This means that it loses access to most of the user's files (it has access to things like the temp directory for storing cookies, cache, etc.). See MSDN for details.
if you had rtfa, you would know that there are also a couple thousand dollars in the game.
Actually, AppArmor was included by default in 7.10.
8.04 will include SELinux, I think... AppArmor is already available afaict.
sigfault. core dumped.
Well on Windows, sandboxing of permissions is different. There might still be the exploit but the level of vulnerability would most likely be higher on a Windows system as a result of IE running at a SYSTEM level permission rather than a USER level like in Mac or Linux. Change to a different browser like Firefox on Windows and you will be safer.
IE does not, and never has, run as SYSTEM. Prior to Vista it runs as the user who starts it. In Vista it runs with privileges lower than a regular user.
I realise Slashdot is as anti-Microsoft as they come, but it's still surprising to see the same FUD about IE still being spewed 10+ years after it was shown to be false.
If you RTFA you'd realize that the Sony machine running Ubuntu was the most expensive and wasn't cracked.
Flash does more than just paint - it (unfortunately) can upload files, attach to USB devices (webcams), etc.
I realize this is slashdot, so for those who didn't read TFA the contest was to in a 30 minute attack slot, read the contents of a specific file, in a specific folder. each day different exploits could be tested, but only popular software that is normally installed counted.
day one were pure network attacks nobody got in on day one. day 2 was email and url based attacks. only the mac got won on day 2. on day 3 you could add non default but popular software from a list (couldn't find the list anywhere on the net, sigh) and adobe flash was vulnerable, so the vista machine got taken.
Ubuntu held up for all 3 days, but because only popular and default software could be added, this could bring a false sense of security. there are many ways to 'design' a supposedly open source software package on say, sourceforge.net but to have a compromised binary that was made with slightly altered source code... to get a trojan on a linux system. repositories tend to be fairly well monitored, but there have been times where applications that are trojans have gotten into widely used repositories. as far as i can tell, sourceforge has no real method for testing if software contains trojans or not, so it's purely up to the community that uses sourceforge to report bad software, etc. i imagine that freshmeat is the same, and many many linux users use sourceforge or freshmeat to find specific linux applications they need or want...
maybe there aren't enough linux users yet to make this a huge issue, but with Microsoft's brand image going south (kinda the way IBMs did in the 90s) linux is sure to be finding more and more people who would rather deal with OSS than with bill gates.
https://www.gnu.org/philosophy/free-sw.html
It's a reference to Lord of the Rings.
Man blir trött av att gå och göra ingenting.
So, prior to Vista, when it ran as the user who starts it, given that over 90% of the cases the default user has complete and unlimited access to the system files, how is running as user different from running as SYSTEM? (And, yes, I pull that "90%" figure out of my arse---but I'll bet it's higher.)
Firstly, because SYSTEM and Administrator have different privilege levels.
Secondly, because there is a vast gulf of difference between the statements "IE runs as SYSTEM" and "IE runs as the user, which is sometimes Administrator, and I think that Administrator and SYSTEM are the same". One is a (serious) architectural problem, the other is an end-user configuration problem. Trying to say they are equivalent is at best ignorance and at worst lying.
Finally, while most home systems would certainly be running users as Administrator, most managed corporate systems would not. 90% is a ridiculous over-estimate of how many XP systems only have "Administrator" users.
And this only works if the server in question is in your Trusted Sites or Intranet Sites in IE.
Non-admin users installing printer drivers is something that is controllable via AD and Group Policy. If you set it, it loosens up acls and privs in a very specific and limited part of the system that lets non-admin users install printers.
This isnt rocket science or magic. One could exploit that to create a faux driver and do malicious activity with it. Only if several things line up together:
1. The server who hosts this printer driver is in your IE's Trusted Locations or Intranet Locations.
2. The configuration to let non-admin users install printer drivers is set on your machine.
3. There is a hole big enough within the security loosening from #2 to do anything interesting with to own the OS.
A couple things to note of interest:
1. The contest did not require someone to 'own' the box to win. They just had to read the contents of some specific file somewhere in the OS. Unfortunately, they didnt publish where that file was, or what the file-system ACLs on it were.
2. The guy who took down the Vista box claimed in the article that it would only take them a few more hours of work to make the Flash vuln effective on OSX and Linux as well.
Well how about instead of making silly statements like this, you go read the documentation on IE7 protected mode. It quite thoroughly answers your question.
.... protected mode primarily restricts the browser process from WRITING to almost everywhere. I dont believe it restricts reading any more than the regular user account that its run under has rights to.
I'll even be nice and give you some of the information.
There are special cache locations in the registry and user profile called 'Low' that are the only places readable/writeable by IE7 in protected mode.
I did mis-speak in one sense in my post
That leapfrog trades a lot of features to gain that security. Since Firefox doesn't sacrifice features... well, yeah, it really IS better.
Permitting a program to connect to the X server is a pretty big statement of trust, since it has to have at least the same level of permissions the window manager does. So it's fairly carefully controlled. There are ways of making su work, which hail from back when you used telnet to do remote login and your GUI apps connected directly back to a public TCP/IP port on your terminal to get at the X server, but they're obsolete. These days, the fastest way to do what you want is to substitute ssh for su.
There are reasons why democracy does not work nearly as well as capitalism.
-- David D. Friedman