Slashdot Mirror
New Windows Kernel Vulnerability Bypasses UAC
xsee writes "A new vulnerability in the Windows kernel was disclosed Wednesday that could allow malware to attain administrative privileges by bypassing User Account Control (UAC). Combined with the unpatched Internet Explorer vulnerability in the wild this could be a very bad omen for Windows users."
this could be a very bad omen for Windows users.
Only if Microsoft doesn't fix it. Of course, somebody sharp could submit a patch ... oh wait.
The higher the technology, the sharper that two-edged sword.
This virus can't scratch me, I run everything with Administrator privs... oh snap!
-Billco, Fnarg.com
what else is new?
UAC is such a hassle for us virus and trojan writers. I'm glad Microsoft helped us out once again.
They bypassed the UAC? We're DOOMED!
What do you bet this was the result of some government agency/powerful private entity saying they want easier access into remote machines?
This exploit still requires the code to be run (ie for the system to already be compromised). UAC is just an extra hurdle malware has to clear, it's not meant to be the be all and end all to stop malware.
The IE exploit mention is meaningless (other than for flamebaiting). You can quite easily catch a virus using a fully patched version of Firefox with up to date plugins through regular browsing (noscript is not regular browsing).
Microsoft has the capital to develop a new operating system from the ground up. This bolting on of security solutions like UAC isn't going to to cut it anymore. Heck keep the same user interface design for all I care, but change the underlying OS. I am a technology atheist, so I don't get religious about platforms, but what Apple did by porting OSX for Intel in parallel says volumes about their company.
I know it might be hard, but Microsoft needs a little vision and little less greed to do the same thing, but for security reasons.
Unfortunately I am doubtful.
that will brake to many apps so people will not buy it. Windows is too big to do a apple and just cut off that many people.
Virtualization would be a good solution for the transition period.
But the os in Virtualization will still have the bugs and holes so what do you gain?
Sure, it wouldn't be a perfect solution, but it would be a way forward in the long run.
But the os in Virtualization will still have the bugs and holes so what do you gain?
security by isolation, aka if you have a stupid vulnerable browser, you can save the rest of system just by isolating the stupid browser in a virtual machine
Why do Microsoft fanboys keep saying that these kinds of problems are only for Windows XP?
And just because Microsoft writes crap software doesn't mean such similar holes exists in Mac OS X, BSD, Linux, Solaris, etc. And no, trojans don't count. You can't protect a house if the owner keeps giving keys to everyone who asks for one.
Seriously, let's hear this brilliant idea that a number of geeks on Slashdot seem to have as to how to design an OS that is perfectly secure against Malware and so on, yet still gives the user full administrative control over their system. So show us a framework or example of some kind where users have the full control they must over personally owned systems, yet the system is 100% secure over bad code. Also then show the design methods that can be used to ensure that there are zero bugs, anywhere, ever, in the design or the implementation and that allow a product to be produced in the timescales demanded by the consumer world (as in it can't take 10 years of validation).
If you put any real thought in this, you'll realize it can't be done. There is no power without responsibility, there is no perfect system that is 100% bug free.
That being the case, stop whining.
For this particular thing, this is a local privilege exploit. It is a bug, a mistake, one that will be fixed. If you Google around you'll find that Linux has had plenty of these through out its history. Something is done wrong such that a program can elevate when it isn't supposed to. They are bugs to be patched, but not super critical since you still have to get malicious code on to the local system and get it to execute. They are more of a concern on multi-user systems but even then it is rarely a panic situation.
So seriously, enough with this "OMG MS just needs to make a 100% perfectly secure OS!" shit. It shows massive ignorance of how complex and OS is, and what all you have to balance. No problem with that, you needn't learn about it if you don't want, but then don't argue from a position of ignorance and assume that they could make a perfect OS if only they wanted to bad enough.
No security is perfect. People who do security in the real world, physical security, have always known this. For some reason many people who do virtual security delude themselves in to thinking it is different. No it isn't, there is no perfect security. So have defense in depth. Be mindful of where you visit on the web, don't download random shit, run a quality virus scanner that checks data as it comes in from the web, use a deprivileged browser (somethign in protected mode, if your browser supports it), have a firewall, have UAC turned on, think before you execute a program. None of that is perfect, none of that is something that can't ever fail, but with layers of protection if one fails, you've others to fall back on.
This is a perfectly ordinary elevation-of-privilege vulnerability. Just like every other elevation of privilege vulnerability it also happens to be capable of bypassing UAC's split-token protection, but the vulnerability itself isn't related to UAC in any way.
In particular, if the workaround suggested in the article is correct, this vulnerability can't be used to escape from Internet Explorer Protected Mode (the other major function of UAC).
You gain that new versions of programs and future ones will be written for the new OS, meaning that after a while you'll be able to ditch the old OS with much less trouble and complaints from your users.
Yeawn... UAC is not, was not and will never be a security boundary. Nor was it ever intended to be.
Some of you, I fear, need to do some learning...
http://blogs.technet.com/b/markrussinovich/archive/2007/02/12/638372.aspx
http://blogs.msdn.com/b/e7/archive/2009/02/05/update-on-uac.aspx
This is a security flaw because it allows elevation of rights, breaching a security boundary.
It has nothing to do with UAC what-so-ever.
From the article: "The flaw is related to the way in which a certain registry key is interpreted..." Another argument for abolishing the Windows registry and storing setup information in plain text files. Not like that's going to happen...
Freedom is drinking a beer in the park when you're supposed to be at work.
Can't we just say "uncle" and start over with something else? I'd give anything to be rid of Exchange and Active Directory.
boycott slashdot February 10th - 17th check out: altSlashdot.org
UAC isn't really anything special, just an easy way for running as a deprivileged user. However many Slashdot types love to hate on it not only because it is from Microsoft, but because it messes with one of their talking points. For the longest time Linux (and OS-X) types hated on Windows because people ran as administrators. They talked about how amazingly insecure that was, how big a problem, how MS didn't care about security and so on. Many people tried to explain to them that it really doesn't matter, since people will just hand out the credentials to elevate without thinking, you can't protect people from themselves.
Well then along comes UAC, with a number of other security enhancements. Seems Ms WAS taking that seriously now. They made it easy for users to run deprivileged. Well shit, that isn't a good thing if you are an MS hater. So they find ways to hate on UAC and claim it is no good, insecure, worthless, a pain, whatever. Many of the criticisms apply just as well to other elevation modes in other OSes but this isn't a matter of true technical analysis, it is just fanboyism.
Same shit here. Windows has a bug in its privilege isolation, leading to a local escalation exploit. Something to be fixed for sure, but hardly super critical. Linux has had the same kind of thing many times and it is never a major crisis since it still requires code to get on the local system and be executed first. However since it is with Windows they'll spin it as an anti-UAC thing.
"I'm hard pressed to decide if Microsoft is unwilling, or just unable, to ever fix it."
Microsoft top managers achieve vulnerabilities by not allowing Microsoft programmers to finish their work, apparently. Since Microsoft has a virtual monopoly on operating systems installed on computers you can buy, the vulnerabilities make Microsoft more money because the average person cannot fix an infected computer and buys a new computer with another copy of Windows. See the New York Times article: Corrupted PC's Find New Home in the Dumpster.
The solution is to make computers with Linux already installed available. Unfortunately configuration of Linux is quirky and poorly documented, slowing adoption.
Another solution is to use anti-trust law to make Windows more fair for buyers. Should users of Windows Vista pay for an entirely new version of Windows, when Vista was troublesome and a court case showed that Vista was knowingly released before it was ready? There are only small differences between Windows Vista and Windows 7. Why should users pay for an entirely new copy of Windows?
It is my opinion that the present practices of selling something almost everyone with a computer must have are unfair and against the common welfare. Microsoft lost an anti-trust case, but there was never any penalty.
No, but the 'windows startup sound' is.
---- Booth was a patriot ----
No penalty!?
Are you mad? Just ask their lawyers! Those corporate wrists got SUCH a slapping!
It was so unfair! You really should send Microsoft some more money just to make sure you're up-to-date on everything and help their aching wrists.
This is why government regulation is bad, and we should abolish the government except for an extremely powerful military with few oversights or regulations.
The Windows registry is just a database that sits on the file system. Parts of the database are maintained in memory for extremely fast access. The database also handles locking when multiple applications need to have access, or write to the same piece of data at the same time. The registry was made to replace the need to keep the following from happening...
(My application needs and INT value that describes something.)
1. opening a file.
2. locking a byte range.
3. seeking to the byte range on the disk.
4. parsing the byte range.
5. performing ASCII/UNICODE to numeric INT/DWORD/LONG conversions where required.
6. re-writing the byte range (when required).
7. unlocking/closing.
Since there are no numeric conversions, this also takes care of keeping values small, and taking up less disk space and speeding things up as well. The registry also has ACLs for the data.
If you've ever watched access to the windows registry via applications through hooking programs like regmon, then you will note just how much you need that speed and accuracy.
There's nothing "special" or evil about the windows registry. It's just a miniature database "data" file system on top of a larger file system.
It's global, but your applications don't have to use it if you don't want to. For your applications to have Windows logo certs, you would need to apply certain registrations of software install information in the Windows registry, but that is about it. You don't need to store any of your applications' data in the registry. You can just store things in text files if you want. Slow poke.
This myth about what the Windows registry is just lame and probably comes from being absent minded about other technologies and ways of doing things.
One week old bug, for Windows 7, regarding scheduler bug that didn't received so much attention.
http://www.exploit-db.com/exploits/15589/
Tested with a limited account. Worked like a charm.
Creates a new user, test123/test123 with admin rights
Oh my, this latest windows vulnerability has me so worried.
No - wait. What am I thinking. I'm running windows 98 SE with KernelEx API enhancements.
Another NT-based vulnerability has me laughing at the OS with no clothes.
Most (not all, but most) of the recent remote exploits for Windows are through third-party code present on OS X and Linux as well (Adobe Reader, Flashplayer, and Java are the big three recently). Those programs are vulnerable on other platforms too, but weaponizing and deploying an exploit is expensive, and they're not worth the return on investment.
In situations where return on investment is equal for each platform, or where OS X or Linux are dominant, there have certainly been exploits. See the Pwn2Own contests for an example of how easily OS X can be compromised, even before Windows was. See the smartphone market, in particular iPhone jailbreaks (which are no more or less than remote root exploits), for what happens when people actually bother to find and exploit vulnerabilities in Apple's code.
As for the inevitability, that's dead easy. Malware is business, and has been for years. For each platform, there are two relevant numbers: cost to produce a useful exploit, and value (income) from releasing that exploit. Currently, the former number is relatively high for Windows - it's been picked over pretty hard, and a lot of security hardening has gone into it. Again, see things like Pwn2Own.
However, the latter number - the money you can make with a good Windows exploit - is far, FAR higher. Many millions of dollars higher. The difference between that value on Windows and that value on other desktop operating systems is such that it's not worth developing malware for them if you could do it for free (i.e. be compensated for your time). If you're going to spend the time writing malware for desktop operating systems, there just isn't any target that makes sense other than Windows.
To answer your question more directly, try a few hundred million. That's how many you need to come close to the number of Windows installations. Depending on the value-difficulty equation, it might not take a number equal to that of Windows - for example, the untapped market may be easier to monetize, increasing the income - but it will require that market shares become roughly equivalent.
There's no place I could be, since I've found Serenity...
why do I have to install a third-party firewall and run third-party anti-malware software, that is, if I want to use it on the Internet?
Probably because you're too retarded to know how to use a hardware firewall, the Windows built in software firewall, and MSE?
*Posted via Windows 7 Professional behind a hardware firewall with the software firewall turned off*
Why the fuck do I need a firewall at all? Seriously.
The solution is to make computers with Linux already installed available. Unfortunately configuration of Linux is quirky and poorly documented, slowing adoption.
Dell tried that and sales were so bad, that they stopped doing it for the consumer level computers. You can still get a no-OS option servers.
The underlying problem here is that win32k.sys fails to do a sanity check on an untrusted registry value. I'm not sure if it's a buffer overflow attack or something different. In this case, a user registry key that specifies fonts for End-User-Defined-Character. I'm sure there are lots of other user registry keys that could be exploited in this manner. Used to be the screensaver ran as the system and you could simply set the registry key to point to a file of your choosing and it would run under the system context.
Of course, it's not like Linux has ever had issues with daemons getting hacked by incorrectly trusting input from user-land config files.
It is my opinion that the present practices of selling something almost everyone with a computer must have are unfair and against the common welfare. Microsoft lost an anti-trust case, but there was never any penalty.
794 million dollar fine in a media player anti trust case is hardly no penalty
http://en.wikipedia.org/wiki/European_Union_Microsoft_competition_case#Judgment
I agree with what you said about linux though. Its an operating system I have on dual boot that I cant make very much work in. I've tried 4 different media players but all are silent with mp3's (sound works in other things) and endless other little problems a new user like me had no idea to fix that finally drove me away from linux.
Since '98 seems just a bunch of Mosaic scripts that they stole from NSC Champaig-Urbana.
OOOOPPPPPPSSSSS!!!!!
I should have not typed that thingy. :)
Oliy Olily Oxenfree
Dell tried that
pics or it didn't happen. I could never find the option when building machines, so I went with beige box builders that preinstalled Linux (I still reinstalled, just like I reinstall windows).
Since Microsoft has a virtual monopoly on operating systems installed on computers you can buy, the vulnerabilities make Microsoft more money because the average person cannot fix an infected computer and buys a new computer with another copy of Windows. See the New York Times article: Corrupted PC's Find New Home in the Dumpster. [nytimes.com]
The average person being unable to fix an infected computer has absolutely nothing to do with Microsoft's "monopoly".
Another solution is to use anti-trust law to make Windows more fair for buyers. Should users of Windows Vista pay for an entirely new version of Windows, when Vista was troublesome and a court case showed that Vista was knowingly released before it was ready? There are only small differences between Windows Vista and Windows 7. Why should users pay for an entirely new copy of Windows?
The differences between Vista and Windows 7 are *at least* as significant as the differences between any two OS X releases, and certainly as big as those between previous Windows releases like 2000 and XP, or XP and 2003.
It is my opinion that the present practices of selling something almost everyone with a computer must have are unfair and against the common welfare.
It is trivially simple to buy a computer without Windows.
Dell did offer Redhat on consumer level machines for a very short while. They were limited in options and generally within $50 of buying the version with Windows XP installed.
Dell still offers Linux or no-OS on their high-end servers. I just went to Dell and configured a R810 server. OS options are no-os, SUSe, RedHat, Citrix Xen Server, or various flavors of MS Server 2008
http://configure.us.dell.com/dellstore/config.aspx?c=us&cs=555&l=en&oc=MLB1284&s=biz
Also, a press release stating this same thing I just told you.
http://news.cnet.com/Dell-offers-new-Red-Hat-Linux/2110-1016_3-276048.html
I thought that Microsoft employed good engineers and tested their code, but apparently not so well as they would have us believe.
Sure, privilege escalations have been found in other OSs (like Linux), but their code is open to examination; Windows code is not. and is obviously no more secure than any other OS.
I would expect more from Microsoft, however. They certainly have the money and manpower to examine their code for security, but don't seem to care nut so much.
'The average person being unable to fix an infected computer has absolutely nothing to do with Microsoft's "monopoly".'
If the average person had Linux, which has fewer and less serious vulnerabilities, there would be less problem with infected computers.
"It is trivially simple to buy a computer without Windows."
Yes, but if you buy an Apple computer you pay 3 times as much. That doesn't make sense for most people.
Hear Hear for the no-OS option. I don't think ~any~ computer should ship with a pre-installed OS (unless - IMHO - the maker of both the OS and the hardware are one and the same). All my dell servers are running Debian (an OS 'not supported' by dell, btw), but I have to get it online instead of using all the (windows-oriented) CD's shipped with them.
If all hardware was to ship with no OS, or have a selection of 'OS options' available at the time of the sale, this would put Mac (even more) in a league of its own, as its OS won't work in 'mainstream' hardware (without 'geek tweaking'), and won't install on a mac (without tweaking or an emulator). Yet since Apple is one of the only hardware ~and~ software makers out there, and its OS is made for its own computers, I wouldn't think it really fair to ~make~ them modify their OS (or their hardware) so that it will work on all computers. Yet were they to do this, there would be a radical change in the computer market.
No, no sig. Really.
ThePromenader
I too have numerous stories about how I've had to fix end user machines where they've been riddled with viruses and malware and this is really why I can't wait for Chrome OS to come out. The ability for someone to be able to buy a machine from a shop at (hopefully) less cost than the Windows equivelant and not have to worry about any of these issues would be amazing.
Most people I know that are non techincal pretty much use their PC for the web and the occasional (but few and far between) spreadsheet or letter. If google docs (or some other web based office replacement) would be good enough for them to do their fairly simple work, which I think it would, then they can put all of this worry behind them.
And don't get me wrong, I'd love to be able to recommend Ubuntu to them! I use it at home on multiple machines but it's far from perfect from and end user perspective. You can bet that Google will make ChromeOS just work, no worries!
Please hurry up Google! :)
Oh, and do something to be able to sync it with the iPod so my girlfriend will want one as well! ;)
What sells MS software? The high quality (I just vomited in my mouth) or the lock-in? If it was the high quality of MS software (ugh, what did I eat yesterday) then there would be no reason for a rewrite.
So it must be the lock-in. People buy MS because that is what all their software runs on. Why do you think IE6 is still around? Because people WANT to use an hopelessly obsolete browser? No, because they have developer intranet applications that only run on IE6 and with that only on windows. Businesses put all their logic into Excel coupled with Access and Exchange until they are so tied into MS software that when the MS rep comes along they shout "Yes, sir. Thank you sir. Can we have another SIR!" when he cracks the wip and has the CEO lick his boots.
If MS were to pull a OSX, then this lock-in would disappear. Bye bye IE6/ActiveX, companies would have to either stick with the old MS software, which is why IE6 and XP and NT are still around, or rewrite it completely. Any competent manager (but what competent manager would choose MS) would have to ask, do I again design my new software with MS lockin considering their habit of abandoning their customers? Apple received plenty of flack itself for the OSX move, MS has far more customers locked to its old software.
When people start rewriting software, they might just decide to make it platform independent. And that is LETHAL to MS, because then every time the MS rep comes along, he will have the SELL his offering on both quality and price and why should I pay 260 for Windows 7 when Ubuntu 10.10 is free? Will the Ubunutu rep rent better hookers to get the support contract?
No, MS needs the lock-in its old software offers and by that it is itself locked-in. The snake eating its own tail. The US outsourcing all its manufacturing so it can sell goods cheap to unemployed Americans. Business 101: We ain't here to be nice.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Would having Linux actually help though? Windows 7 already has limited user accounts by default with scary prompts demanding the root password when a program tries to make certain changes. Therefore vulnerabilities boil down to two basic types:
1. Flaws in software
2. Users ignoring warnings and blindly entering the root password
(1) is arguably less of a problem in Linux at the momemnt but ultimately there is nothing about Linux itself that makes developers write safer code than they would on Windows. (2) would be the same no matter what OS is in use.
What I don't get about these people throwing their PCs away when they are infected is that they could just restore it to factory to fix it. It's a bit like abandoning your car because it stalled instead of just re-starting the engine.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
So why was the key misapplied? If it's just as simple and clear as the text config files in UNIX then the people who left this vulnerability open were idiots.
So, if changing the registry to plaint text files wouldn't have magically fixed the problem, then the employees at Microsoft are idots.
"Shop for Ubuntu" http://www.dell.com/content/topics/segtopic.aspx/ubuntu?c=us&l=en&cs=19