Slashdot Mirror
Hot Potato Exploit Gives Attackers the Upper Hand On Multiple Windows Versions
An anonymous reader writes: By chaining together a series of known Windows security flaws, researchers from Foxglove Security have discovered a way to break into almost all of Microsoft's recent versions of Windows. The exploit, named Hot Potato, relies on three different types of attacks, some of which were discovered back at the start of the new millennium, in 2000. Going through these exploits one by one may take attackers from minutes to days, but if successful, the attacker can elevate an application's permissions from the lowest rank to system-level privileges. All of these security flaws have been left unpatched by Microsoft, with the explanation that by patching them, the company would effectively break compatibility between the different versions of their operating system.
Mr. Potato Head has gone to dark side, becoming Hot Potato and joining forces with Evil Bernie and Evil Ernie to rule the world. One Windows machine at a time.
I released a major exploit called Sweet Potato
That is probably the best way to describe it.
Thousands of slashdotters have a simultaneous joygasm.
>by patching them, the company would effectively break compatibility between the different versions of their operating system.
because in windows broken security is a feature
I really feel sorry for those locked in to that OS, every day it seems there is a new problem with their security, and maybe MS should break backwards compatibility and fix that shit. While they are at it they can scrap the other crap added too, no one in their right mind will willingly use an OS that spies on them regardless if it helps MS see why things break. Anyway, it's not my problem I've been MS free for years
http://chimpbox.us
Everyone (should) know by now, especially on Slashdot, that the start of the new millennium was in 2001.
Is there a hack yet to take control of a keyboard and remotely send 28 backspaces to root that shit (Linux)?
The last millennium ended Dec 31, 2000 - in my time zone.
...that Windows needs to be compatible with software that relies on security holes.
At least that's what I take from this statement.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Spinal Tap forever!
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
Whatever you do, for the love of god, don't give us a broad outline of attack vectors, who might be vulnerable, or attack mitigation practices.
with sour cream and onions?
DOS ain't done 'till Lotus won't run.
If you're just using a small LAN w/o domain management you can turn Netbios and Auto-proxy stuff off completely and will never miss it.
These exploits work because M$ leaves services on by default that most users will not turn off until it breaks something critical. True since forever.
So, in summary, Windows is vulnerable if:
1) A malicious actor is already on your Windows server
2) You don't have a predefined and locked down via GPO's etc....proxy setting
3) An unpriviledged user can start up a http server on your systems
You got bigger problems if 1,2, and 3 are true, or I totally mis-read the article
Micrisoft wants to force you to buy new software so they don't even try wrt backwards incompatibility.
Had to go back 20 years to find an example so the point stands.
I would rather a few things break, than to never have to re-write software that may never be looked at ever again... *cough OpenSSL*
A BAND-AID made out of rancid hell spawned festering pus. No matter how much you patch it, it leaks like a submarine with a screen door.
I've never seen that comparability option fix a single problem the hundreds of times I've tried it b
I've had several applications work by setting a compatibility mode. Ha! My anecdote beats your anecdote! Take that!
Hot Potato Exploit
Name me one potato exploit that isn't hot.
systemd is Roko's Basilisk.
And the "Run compatibility troubleshooter" never fixes anything. I work for a large law firm so we have dozens of different DOS programs we have to run. Most work fine with Vista, Microsoft fired all of their older programmers and not backwards compatibility is almost completely broken.
And using that metric, Windows 10 is great.
But seriously, Microsoft doesn't even try when it comes to backwards compatibility. Vista is OK, 7 trashed most software. Only the newest programs will run.
"All of these security flaws have been left unpatched by Microsoft, with the explanation that by patching them, the company would effectively break compatibility between the different versions of their operating system".
Because that is far more important than security.
"Windows, The Compatible Family: All Members Are Equally Vulnerable - And In The Same Way!!!"
I am sure that there are many other solipsists out there.
When I quit Microsoft in 1995, we had already mostly quit trying at backwards compatibility. I find it amusing there's still people like suutar that still believe that Microsoft tries.
I've had several applications work by setting a compatibility mode. Ha! My anecdote beats your anecdote! Take that!
So you think it works because it worked a few times while it didn't work hundreds of times for someone else? Do you work QA for Microsoft?
If you think sixteen years old is legacy, you must be very young.
He is very naive. I work on the build team for Windows, and I hear about only a tiny bit of backwards compatibility work being done.
Naïve is correct. We stopped trying about the time Bill Gates left. He cared about backwards compatibility, but I have never once heard John Tompson mention it.
Had to go back 20 years to find an example so the point stands.
And yet the only actual counter-example that has been given by anybody so far is Lotus 1-2-3 version 2.3, which predates Windows 95 by four years.
I still run a 32-bit Windows 7 system as a games PC so I can run old games. I have been amazed to find games from Windows 95 era work, and been blown away when I found some old Windows 3.1 programs and tried them for a laugh only to find that they too worked.
Of course, these wouldn't work on a 64-bit version of Windows, since they lost the ability to run 16-bit applications. But I don't think that you can say that they are not serious about backwards compatibility simply because they no longer run programs from 2 decades ago.
You can still easily find lots of programs that no longer work, but who is to say that this is just sloppy work from Microsoft instead of the programs themselves doing something that was outside the official documentation, or just stupid things like self-modifying code or programs that assume they have administrator-level access to resources.
For more modern examples of backwards compatibility features in Windows, how about Vista's *File and Registry Virtualization*, which, for example, redirects file writes under Program Files to the users "AppData\Local\VirtualStore\Program Files" folder so old programs that blindly write config and log files alongside their programs will still work. Then there is the ever-growing WinSxS folder full of old versions of DLLs to maintain backwards compatibility. Windows 7 did away with some of the old cruft by making single DLLs that responded to multiple versions.
With all that going on in different versions, it makes me wonder about the truthfulness of the Anonymous Cowards who supposedly worked at Microsoft and who have been claiming that they had never heard backwards compatibility being mentioned there.
The main use I've found for it are for games that came out in that time between Direct3D and Windows 2000 that assume that Windows NT == No Direct3D and pop up a "This program doesn't support Windows NT" error. Setting them to Win95/98 compatibility mode make them work just fine. I can think of Viper Racing for one, and it helps Grand Prix Legends' graphics work better. On the other hand, Homeworld works better in NT 4.0 mode because it disables the slightly buggy-on-new-Windows DirectX and forces it into OpenGL mode, which works great.
In more recent times I've had it help with a couple utilities and tweaks like Mute on Lock that break with Windows 7's (and Vista's?) updated audio engine.
I can't think of too many things I've tried it on that haven't worked, really. Most of the complaints I've seen about it are people trying to run DOS or 16-bit Windows apps on 64-bit Windows, which isn't going to work no matter how many compatibility modes you try.
With all that going on in different versions, it makes me wonder about the truthfulness of the Anonymous Cowards who supposedly worked at Microsoft and who have been claiming that they had never heard backwards compatibility being mentioned there.
There's an AC who's been posting here for a while who somehow seems to be an expert on every subject. If it's a story about medicine, he says "I'm a doctor and...." If it's a story about law, he says, "I'm a lawyer and....." If it's a story about child abuse, he says, "I was abused as a child and....." But if you read the post carefully, there are frequently mistakes that draw the claims into question.....
"First they came for the slanderers and i said nothing."
@anonymous Coward: "Linus Torvalds has repeatedly said he doesn't give a SHIT about security. Say what you want about Windows, but at least Microsoft cares about the security of their products. What kind of a loser still uses Linux given their lax attitude to their own customers? ref
Dear Mr. Anonymous Troll, do you have any verifiable citation to support your typings?
Obviously the situation is "works some times". For instance Win 8.1 Compatibility mode tweaks enable me to run Scrabble written for Windows 3.1 with the main requirements being 256-color mode, along with the bundled win32g.dll copied to \windows\system32 - and nowhere else, not even in the scrabble.exe directory, although that fails for 64-bit Win 8.1 on another PC with claims by scrabble that it cannot find win32g.dll despite my copying that works with 32-bit Windows 8.1 PC's. Note that I am not claiming any other "super powers" for Compatibility mode, just a "data point".
Copy it to c:/windows/syswow64 instead of system32. That is the 32 bit compat folder.
Bill didn't care about backwards compatibility, or rather, he cared that things weren't backwards compatible at all. See Office95's release and complete lack of interoperation between previous versions across all platforms, including windows. Yep, backwards compatibility indeed.
The cesspool just got a check and balance.
> how about Vista's *File and Registry Virtualization*, which, for example, redirects file writes under Program Files to the users "AppData\Local\VirtualStore\Program Files" folder so old programs that blindly write config and log files alongside their programs will still work
Had a fun run-in with that once, I had an old game on the one hand, and on the other, a utility for editing that game's save files. Since the old game used Program Files to store its saves in (like you do) they were redirected to VirtualStore. However, the utility wasn't redirected (since I was running it from another directory) and kept claiming it couldn't see any savegames to edit, even though it was clearly configured to look for saves in the right place!
I spent HOURS trying to work out why I could see the saves in Explorer, the game could see them, but the utility magically couldn't...
Yeah, the compatibility option is BS. The only setting I've seen make some older programs work is disabling desktop compositing.
Maybe you were shit and fired. I'm eating and too lazy to Google for it, but examples of what OP is referring to is documented and was recently referred to from Slashdot in the last month or two.
You must be busy in meetings 24/7 to hear about what the other tens of thousands of workers are working on.
Linus did say that security is not the end-all be-all of Linux.
"Security in itself is useless. The upside is always somewhere else. The security is never the thing that you really care about."
Which is not to say that it's insecure; given that it runs on more devices than any other OS, any exploits would be huge. I'm not really sure how Windows security measures up these days, but I get the impression that the typical Windows install has a greater amount of exposed moving parts.
Those who advocate genocide deserve every protection afforded by law, and none afforded by common human decency.
If you're trying to run DOS programs you'll be better off using DOSBox or Bochs. 64-bit versions of Windows cannot run 16-bit programs.
I remember DEC's error messages. You knew exactly how to proceed. Windows' crappy error messages are just another example of lowest-common-denominator products being released to the American consumer. God forbid we actually tell them what's wrong.
...still runs on Win10 (32bits), I tested an application from 1993, it works fine, I must say this is impressive ;)
"Science will win because it works." - Stephen Hawking
The only programs I've not been able to run in 7 compared with older versions are a result of architecture - 16-bit programs will not run on a 64-bit OS. Not on Windows, not on Linux, not on nuttin.