Slashdot Mirror
Abusing Symbolic Links Like It's 1999
An anonymous reader writes with this snippet from James Forshaw's recent post at Google's Project Zero, which begins For the past couple of years I've been researching Windows elevation of privilege attacks. This might be escaping sandboxing or gaining system privileges. One of the techniques I've used multiple times is abusing the symbolic link facilities of the Windows operating system to redirect privileged code to create files or registry keys to escape the restrictive execution context. Symbolic links in themselves are not vulnerabilities, instead they're useful primitives for exploiting different classes of vulnerabilities such as resource planting or time-of-check time-of-use. Click through that link to see examples of this abuse in action, but also information about how the underlying risks have been (or can be) mitigated.
it seems to me that we can stop shit commercial software from being published if governments set up a mandatory bug bounty systems. it's simple, you demo the exploit and get money based on the severity and the company making the software must pay it and has X days to fix it before paying the fine again. this would result in either better education on how to find exploits, better Q/A mechanism or companies going under. frankly, i don't care which happens as long as commercial software is held accountable for bad code.
Anons need not reply. Questions end with a question mark.
And under John Thompson, they're getting even farther behind. The man just doesn't get why good QA is important. After what he did to Symmantec, I can't believe any one would give him a job, much less make him head of Microsoft.
Why have paid QA when your customers have proven over and over again that they'll still buy your software no matter how buggy it is? Thompson isn't that bright, and got his job just because of his race, but he isn't stupid.
you evidently didn't read that the blog post is supporting what microsoft has done.
"Therefore I feel this is a good example of a vendor developing mitigations in response to increased attacks using certain techniques which wouldn’t have traditionally been considered before for mitigations."
More like it's 1979
[This person is an expert at hacking systems using links!]
"Click through that link to see examples of this abuse in action"
o_O
(And yes, i'm aware that URL links are not the same as symbolic links, but the phrasing is still amusing.)
.
This Space Intentionally Left Blank
I never realized that Windows uses a unix-like file hierarchy.
According to the article, drive C: is actually a symbolic link to \Device\HarddiskVolume4, COM3 is \Device\Serial0 and so on.
I'm surprised, frankly. My exposure to Windows is pretty much nil (and I like it that way) but I always assumed that the the C: drive and COM: stuff was a completely different way of accessing the devices and whatnot than what Unix uses. Apparently, it's actually quite similar once you get under the hood.
Learn something new every day....
If you're a zombie and you know it, bite your friend!
It's a symlink into a systemd managed ntwork configuration repository, until the user breaks the link deliberately or accidentally with a text editor or configuration tool like puppet, cfengine, Chef, BladeLogic, Tuttle, or anyone else's homebrew server configuration tools, and then it *stays* broken permanently. See https://wiki.archlinux.org/ind...
Once gain, Mr. Pottering fails to understand the File System Hierarchy and why you don't dink with other people's stable tools.
Can we all agree that windows is an operating system that is fail?
Thank you.
On proper time Windows has added symlinks, a (somehow) worthwhile command line, non-graphic environment, the ability to remotely manage, declarative-based configuration management...
It's only they are reinventing all these things on their own, forgetting about how did they came to be and, of course, not caring about the way those facilities have been used and abused in the past.
I think it was Henry Spencer the one that said "Those who do not understand Unix are condemned to reinvent it, poorly."
If a symbolic link can get around your security, your security model is broken.
Was that a major problem in 1999, or are you just being a "trendy" asshole by adding "like it's 1999" to the end of your phrase?
Applying implied warranties to all computer programs distributed for a fee makes it impractical to recover the cost of distributing free software on physical media.
Since when has Windows had symbolic links? Shortcuts, sure, but they're not the same. And neither is as good as hard links if you're on the same filesystem.
-- Alastair
Then make it lawful to copy but not to use. The legal structure needed to enable this has been in place since October 1998, when the U.S. Congress made it unlawful to decrypt a program's installer without permission from the program's copyright owner. So someone would have the encrypted bits but not the license code to use them.