Skype Can't Fix a Nasty Security Bug Without a Massive Code Rewrite (zdnet.com)

ZDNet reports of a security flaw in Skype's updater process that "can allow an attacker to gain system-level privileges to a vulnerable computer." If the bug is exploited, it "can escalate a local unprivileged user to the full 'system' level rights -- granting them access to every corner of the operating system." What's worse is that Microsoft, which owns Skype, won't fix the flaw because it would require the updater to go through "a large code revision." Instead, Microsoft is putting all its resources on building an altogether new client. From the report: Security researcher Stefan Kanthak found that the Skype update installer could be exploited with a DLL hijacking technique, which allows an attacker to trick an application into drawing malicious code instead of the correct library. An attacker can download a malicious DLL into a user-accessible temporary folder and rename it to an existing DLL that can be modified by an unprivileged user, like UXTheme.dll. The bug works because the malicious DLL is found first when the app searches for the DLL it needs. Once installed, Skype uses its own built-in updater to keep the software up to date. When that updater runs, it uses another executable file to run the update, which is vulnerable to the hijacking. The attack reads on the clunky side, but Kanthak told ZDNet in an email that the attack could be easily weaponized. He explained, providing two command line examples, how a script or malware could remotely transfer a malicious DLL into that temporary folder.

Comments

Linux not vulnerable

[gavron]

The article indicates that the Updater is the problem, not Skype. The Updater runs in a privileged environment, and is susceptible to loading non-system DLLs. The article says the same can happen on Macs and on Linux except that neither platform uses DLLs nor allows sourcing libraries from local (no-system) directories.

E

Re:Linux not vulnerable

[Anonymous Coward]

Yeah, Linux doesn't have "DLLs"!! Because calling the same thing a .so makes it magically secure!

Spoken like somebody who doesn't really know what LD_PRELOAD actually does.

Re:Linux not vulnerable

[Xenx]

The article links to a bulletin on hijacking of dynamic libraries on OSX. So......

Re:Linux not vulnerable

[Anonymous Coward]

Duh, you can't auto-update Linux automatically when trying to do work and then have it randomly reboot without asking - it's a deliberate process you insensitive clod!

Re:Linux not vulnerable

[Anonymous Coward]

Quit being a DLLdo. Windows and Linux libraries are entirely different.

Re: Linux not vulnerable

[WarJolt]

LD_PRELOAD is not enough for privilege escalation. You need more, like a buggy Microsoft product. Maybe Skype for Linux....

Re:Linux not vulnerable

[Anonymous Coward]

Linux has shared libraries, just like Windows does. Also, nothing about Linux prevents binaries from using local shared libraries. In fact, I've accidentally run into library versions probems because I had a copy in my home directory along with an executable.

Re:Linux not vulnerable

[Z00L00K]

It's also interesting that after an installation there's actually a need to have system privileges for all updates. That should only be necessary for updates related to system interaction. Of course app updates should require higher privileges than user level, but not really touch the system level.

But given that it's Microsoft then you'd need a reboot too.

Re:Linux not vulnerable

[WaffleMonster]

Quit being a DLLdo. Windows and Linux libraries are entirely different.

Nonsense. It's all the same shit with uninteresting semantic differences.

Re:Linux not vulnerable

[Anubis IV]

Neither platform uses DLLs because they call their dynamically linked libraries something else. For instance, just as you’ll see .app instead of .exe on macOS, you’ll see .dylib instead of .dll. Same basic notion, different extension, same design that leaves it open to attack.

Re:Linux not vulnerable

[Anonymous Coward]

Linux [...] In fact, I've accidentally run into library versions probems because I had a copy in my home directory along with an executable.

There are two things you need to deliberately do to make that happen:

Set PATH to include your home directory.

Set LD_PRELOAD appropriately or LD_LIBRARY_PATH to your home directory.

So you've never accidentally run into that problem. You have to deliberately create that problem in two separate and independent steps.

Re:Linux not vulnerable

[Anonymous Coward]

The article says the same can happen on Macs and on Linux except that neither platform uses DLLs nor allows sourcing libraries from local (no-system) directories.

That's ridiculous. The two systems use different executable formats, yet both have an ld -rpath option that does exactly that. A binary can have a multiple search paths hard coded for each individual library.

For Linux, software that typically looks like, but not limited to... this - /opt/vendor/productname/(bin|lib) - need at least something in rpath, or the env vars others have already mentioned because linker options are hard? The environment variables suck because child processes can inherit them and, unintended consequences.

While we're on the subject, Linux and third party software, what's "system" anyway?
TOTALLY normal to see stuff like this instead of the above options - /etc/ld.so.conf.d/skype.conf
In those situations, Linux is highly susceptible to attacks like this. Or bugs more likely. For that matter, in most base configurations /bin/foo is fully capable of linking /usr/local/lib/bar in the right circumstances, say it tries to dlopen an optional plugin library to decode something. It's probably easier than that actually.

Any seasoned *nix admin will read "Skype ... Linux" or Linux + [anything outside the cult of floss] ... or Linux + floss not from your distro... and just expect something, somewhere will link the wrong damned library because an environment file was off, the right shell wrapper wasn't used, the system search path is jacked up, or god only know what else.

@executable_path/../Frameworks
$ORIGIN/../lib

I mean they can both do it, it's just more common on Macs I guess.

Re: Linux not vulnerable

[Anonymous Coward]

LD_PRELOAD is not enough for privilege escalation. You need more, like a buggy Microsoft product. Maybe Skype for Linux....

Here's one that was just as bad. Give it up, Linux is not magically more secure than anything else out there. It's less complex, but that's changing.

CVE-2010-3847
elf/dl-load.c in ld.so in the GNU C Library (aka glibc or libc6) through 2.11.2, and 2.12.x through 2.12.1, does not properly handle a value of $ORIGIN for the LD_AUDIT environment variable, which allows local users to gain privileges via a crafted dynamic shared object (DSO) located in an arbitrary directory.

Re:Linux not vulnerable

[toadlife]

It's also interesting that after an installation there's actually a need to have system privileges for all updates.

Why is that interesting? Every Linux package manager I've ever used uses root privileges to update app packages. Complex permission schemes are possible in both Windows and Linux. People don't use them in either because they are not worth the trouble.

Of course app updates should require higher privileges than user level

No, they shouldn't. Apps that are installed in the user's profile only need user's permissions to update.

But given that it's Microsoft then you'd need a reboot too.

The need for reboots has nothing to do with permissions.

Re:Linux not vulnerable

[Anonymous Coward]

uh huh.

Re:Linux not vulnerable

[Anonymous Coward]

Preloading library doesn't magically give them permissions to access things they are not supposed to access.
Coward...

Re:Linux not vulnerable

[TheRaven64]

I've never seen a Linux distribution where LD_LIBRARY_PATH was set by default to include locations in the user's home directory. You need to explicitly do that. I suppose that a malicious update script could set it in .profile, but if you use su or sudo then they sanitise your environment so you can't accidentally elevate privilege doing it. I believe that on most *NIX systems the run-time linker also checks that libraries linked by setuid root binaries are owned by root, so you can't exploit it by having the user run a setuid binary.

Re: Linux not vulnerable

[Zero__Kelvin]

Really? It's "just as bad"? Did it really require a "massive re-write" to fix? Because if it did Red Hat did so way back in release 5. Are you saying the bug was "just as bad" but the vendor response was far better, since it got fixed promptly rather than the Linux vendors saying "that is a difficult bug, so we are just going to say screw the customer"?

Re: Linux not vulnerable

[Zero__Kelvin]

First of all the Skype updater is part of Skype. Second, Linux has dynamically linked libraries. Not only should this not be marked informative in any way, your entire post is 100% "misinformative."

Re:Linux not vulnerable

[Anonymous Coward]

No the design is not the same. Under Unix you must also change LD_PRELOAD (and manage to change it for a privileged process as a mere user in this case) since shared libraries are not loaded from the same folder as the application as it's done in Windows.

Re:Linux not vulnerable

[Anonymous Coward]

Except that path have been patched in i.e glibc some time ago already.

Re:Linux not vulnerable

[Anonymous Coward]

I don’t think you’re in any position to be talking about the design of Linux’s linker system.

ld -rpath lib

Re:Linux not vulnerable

[angel'o'sphere]

Of course Macs and Linux use DLLs to: dynamic linked libraries do not need to end in *.dll ... e.g. on linux and macs and basically any unix system they end in *.so

Re:Linux not vulnerable

[angel'o'sphere]

If you need root privileges to run a package manager, then the installed packages are only root writeable.
If they would be owned by an ordinary user you would not need root privileges.

Reboots are completely unnecessary, if the system is done right. Unless you want to load a new kernel, or rare cases a new device driver, there is no reason at all.

Re:Linux not vulnerable

[Anonymous Coward]

I'm kind of dense so I can't figure out how to write a post without including a single capital letter at the bottom of my post. Can anyone help me solve this problem I have?

P

Re: Linux not vulnerable

[Gr8Apes]

The real problem here is that if Updater requires high level privs on windows, then it's going to be compromisable no matter what MS does. The entire DLL loading process is just one huge security hole. If you have access within your code to load a DLL under an admin privileged token no matter how masked (and possibly even without, I didn't bother going that far) the machine is yours. This is because Windows Security is upside down, and no sensible security system would ever has this design strategy.

Re:Linux not vulnerable

[toadlife]

If you need root privileges to run a package manager, then the installed packages are only root writeable.
If they would be owned by an ordinary user you would not need root privileges.

I understand that. The same principles apply in Windows. It's as if you weren't even reading what I wrote.

Reboots are completely unnecessary, if the system is done right. Unless you want to load a new kernel, or rare cases a new device driver, there is no reason at all.

I understand that you're a big Linux fan and you think Windows is the worst thing to ever grace humanity, but I was talking about the reason for needing reboots in Windows, since that's what the parent was talking about.

Re:Linux not vulnerable

[angel'o'sphere]

Then explain please, why did you write this:
Every Linux package manager I've ever used uses root privileges to update app packages. ?
And why this:
The need for reboots has nothing to do with permissions. ?
No one said reboots have anything to do with permissions. Reboots in windows are 99% of the time are unnecessary as well, but the stupid guy who programmed the installer added a "lets reboot after install for good measure".

Open Source Rules!

[Anonymous Coward]

Of course Linux is completely immune to such attacks because LD_PRELOAD is open source.

Phew. https://www.cs.rutgers.edu/~pxk/419/notes/content/04-injection-slides-6.pdf

Re:Open Source Rules!

[Anonymous Coward]

...so which suid binary permits LD_PRELOAD attacks?

Re:Open Source Rules!

[Hal_Porter]

Not everyone operates in the US tribal mindset where criticising Tribe A means you're automatically a member of Tribe B. Maybe both tribes have downsides.

Russians!

[Anonymous Coward]

Clearly Russian interference. Let's blame this on Trump and Kapersky.
 
=Beau=

Re:Russians!

[Anonymous Coward]

Trump himself said he did it. He said "no collusion", which in Trump-speak means "I colluded".
We are slowly realises that whatever Trump says, he means the opposite. "Largest ever inauguration crowd" means it wasn't. "Building a wall" means he won't.

The Trump fans took Trump seriously, but not literally. The general pubic took Trump retardedly, but not unretardedly.

Re:Russians!

[greenwow]

We don't have any evidence of it, but the media wouldn't be talking about it so much and for so long if it wasn't true.

Re:Russians!

[Anonymous Coward]

/s

Re: Russians!

[Zero__Kelvin]

How do you know we don't have any evidence of it. Do you have access to Mueller's files? We certainly have already seen numerous guilty pleas from members of his "inner circle" followed by orwellian "that man was never part of my inner circle" newspeek from the tiny fingered Don.

Re: Russians!

[Anonymous Coward]

Trump: Criticises Obama about the amount of time he plays golf, and says he won't have time to play golf because he loves work so much. Then he spends double the amount of time playing golf than Obama did. Classic. Merica!

why does skype have "massive code" anyway?

[gTsiros]

it's a IM client with audio/video capabilities, wth

Re:why does skype have "massive code" anyway?

[Anonymous Coward]

Because they bloated it so much that it's barely an IM client by now. Heck, I'd argue it barely ever was an actual IM client. Doesn't even support extremely basic features that any other actual IM client has.

Re:why does skype have "massive code" anyway?

[Anonymous Coward]

that's the part the government "requested".

Re:why does skype have "massive code" anyway?

[AHuxley]

PRISM

Re:why does skype have "massive code" anyway?

[Narcocide]

How are you supposed to hide massive security vulnerabilities under the vague guise of plausible deniability if you don't have a giant entrenched pile of garbage as a code base? You thought they kept rotating experienced, ethical developers off the project because of simple managerial incompetence, didn't you? The incompetence story is just more plausible deniability.

Re:why does skype have "massive code" anyway?

[swilver]

It's a huge mess. I can't even get voice/video calls to work through a firewall as it requires like 20 different rules for all sorts of ports -- it's ancient code, written in an ancient time when every new feature required its own port and protocol.

Compare that with Hangouts or Slack (the client), which just works out of the box without any changes to my firewall.

Besides, I'm sure 90% of the code is the bolted on library for serving you ads in the middle of your face.

Re:why does skype have "massive code" anyway?

[Anonymous Coward]

That's 80% of the memory usage. When I downgraded Skype to prevent ads the memory was slashed to a FIFTH.

Re:why does skype have "massive code" anyway?

[ceoyoyo]

Who knows about Skype. This is the updater app that has massive code.

Download the offline installer?

[fustakrakich]

That way you can be kinda sorta sure the entire thing came from Microsoft, maybe...

Re:Download the offline installer?

[Rockoon]

The issue as I understand it is that a bit of nefarious code running in user scope can take these steps:

1) drop a properly named nefarious dll in a tmp directory
2) alter the userspace path environment variable that will cause skypes updater to search this folder first for that properly named nefarious dll
3) launch the skype installer which will then load the nefarious dll into a super user scope

Re:Download the offline installer?

[ancientt]

Parent should have been the description in the /. story.

Re:Download the offline installer?

[MobyDisk]

agreed! Why are 95% of Slashdot submissions simple cut-and-pastes? Instead, we should be tailoring the summary to the geek audience.

Re:Download the offline installer?

[Anonymous Coward]

I've done some work in hardening an application vs. DLL hijacking.
The steps you outline above are almost correct, but modifying the system path isn't necessary, the default DLL search order in Windows already checks the current directory prior to the windows system folder.
So , what attackers look for is an app that runs from an insecure folder, so that they can drop a specially crafted DLL with the same name as a vulnerable Microsoft DLL into that folder and have it load preferentially. The DLL is generally a copy of a real Microsoft DLL but with extra code in its DLLMain() , this way the function that the loader expects is in its export table. Microsoft loads DLLs that it expects to use prior to executing any code in the app in question, and it does not verify their digital signatures prior to doing so.
One defense against this type of attack, absent fixes from Microsoft, is making sure your executable has no dependencies on Microsoft APIs not contained in DLLS in the 'Known DLLs' list (google it).. DLLs in this list are guaranteed to be loaded from %WINSYSDIR%.

Re:Download the offline installer?

[gustygolf]

Didn't Word etc have the same bug, about five years ago?

DLL preloading attack was what it was called. You could drop a Word document into the same directory with a malicious DLL file, and if you double-clicked that document, Word would load the DLL instead of the system one.

If your program doesn't pass a fully qualified path to LoadLibrary/LoadLibraryEx... well, it uses the system path to search for it.

So...

[Archfeld]

If you can't fix the issue then let us have the option to remove the POS. Ever since they jammed the crappy product down my throat wished I could remove it, now would be a good time.

Re:So...

[Anonymous Coward]

So...why are you still running Windows 10 / (not 9) / 8 / 7 / etc?

Re:So...

[Anonymous Coward]

Better question, who the hell in their right mind knowing what we all know about software and the industry would use windows anything?

Honestly, just use linux.

It's like finding a kid who keeps jamming a screwdriver into their ear full force and complaining about headaches and bleeding ears and everyone keeps giving them advice about how they are gripping the screwdriver

Jesus christ people, this is not hard, you all make me weep for the goddamned species

I'm just going to cross my fingers and hope that somehow microsoft manages to kill its core users evolving the world towards those who have common sense

Re:So...

[Xenx]

Because application choice for Windows is superior to Linux. This goes doubly so for anyone that also plays games on their computer. It also comes with virtually every computer (Apple aside) sold. Why spend time and effort switching over to another operating system? It doesn't take a genius to figure out.

Re:So...

[Anonymous Coward]

If you can't fix the issue then let us have the option to remove the POS. Ever since they jammed the crappy product down my throat...

Last I checked, Skype was entirely optional to install, something you have to go out of your way to infect your system with, not something Microsoft jams down anyone's throat. If you don't want it on your system, uninstall it. There's got to be something better out there. Why not ask somewhere like /. for recommendations?

Re:So...

[Anonymous Coward]

Application? You mean those things you actually install on your hard drive instead of just loading up in a web page? There are honestly very few of those left that you cannot load up in a web page. So since most applications are web sites now and that means platform agnostic, applications aren't really the driving force. Fear of the unknown is the driving force. People will cling to a shit stain of an OS, even if it spies on them, even if it doesn't work very well, even if it actually purposely slows them down, even if it is unstable...just because they know it.

That doesn't mean it is any good, I reiterate my previous point, it just means you people are stupid beyond all logic reason and sanity. I know saying it that way, all aggressive like is going to get a negative response and your just going to dig in further like a tic sensing danger trying to burrow into a hosts flesh for protection....WAKE UP, I speak the truth and you know it, stop trying to pretend you are doing anything but childishly defending the indefensible. You are collectively making a shitty stupid decision and at some point you all must bear responsibility and stop trying to say 'oh its just to hard to swich' or 'oh what about the games' for fucks sakes it's all bullshit and lies your telling yourself so you don't have to branch out a little and grow.

What I tell you, and the harshness I say it with, is because I want us, as a collective to be BETTER. We can be, I just know it, I have some shred of faith left that people are going to wake up and realize that yes, windows is shit, and they need to be part of the solution and stop being part of the lazy problem.

Also you have perhaps failed to hear about steam OS for linux for gaming, its great quite frankly.

Re:So...

[Anonymous Coward]

Windows NEIN!

Re:So...

[Tyger-ZA]

Last I checked, Skype was entirely optional to install, something you have to go out of your way to infect your system with, not something Microsoft jams down anyone's throat.

When WIndows 8 came out, Skype was there by default. It also happened to be extra retarded by default. I remember it because some friends asked me to help them log in to the Skype app on a new Windows 8 machine. After some swearing and Googling, I discovered that the app bundled with Windows will only work with a Windows Live account, Skype logins that existed before the MS infection required that I uninstall the bundled version and get the less retarded version from Skype.com

Re:So...

[Anonymous Coward]

If you can't fix the issue then let us have the option to remove the POS. Ever since they jammed the crappy product down my throat...

Last I checked, Skype was entirely optional to install, something you have to go out of your way to infect your system with, not something Microsoft jams down anyone's throat. If you don't want it on your system, uninstall it. There's got to be something better out there. Why not ask somewhere like /. for recommendations?

I deal with Microsoft 'Partners' daily where I work. One of the requirements, I believe, of being able to use the 'Microsoft Partner' logo is pushing Microsoft products such as Skype for presentations, screen sharing, etc.,... Skype is the only kind of invite we get from our certified partners. This means we get invites for Skype all the time and even though installing it is technically voluntary, if you work with partners, the easiest route is to just install it.... and then troubleshoot camera/mic issues and username/password problems due to yet another account that don't happen with, say, GotoMeeting or TeamViewer. Usually, this troubleshooting is an emergency because the meeting is going to start in 5 minutes or has already started. If you argue against installing it, citing what I just mentioned, you just get flack from management and end up being told to install it anyway. If your leadership wants it on THEIR systems, you're installing and supporting it.

The reality is that Skype, in many business situations, is a De Facto program. For instance, when a member of the Bored of Directors suggests Skype because they know the brand but have never used the program, well, after all is said and done, you're using Skype. The fact that it isn't De Jure doesn't matter.

The kicker - 'closing' Skype doesn't really close it. You have to kill the process in Task Manager to actually turn it off.

No, Bored was not a typo.

Re:So...

[omnichad]

I just installed Windows 10 fresh and there was a Skype icon already present. Worse, OneDrive runs at startup by default.

Re:So...

[Anonymous Coward]

Yeah, applications real applications. So when I am in a place (out in the field, in a foreign country, on a corporate campus that does not allow non-company devices to access the internet - I could go on) where there is either no connectivity or hostile connectivity, I can work.
I can imagine that the photographers in Syria really don't want to be using a "web based" editor to prepare their images. OOhh Look Ivan there is another Adobe Lightroom web user broadcasting over the cell infrastructure in hostile territory. Let's send a anti radiation missile into the hospital. That should teach them to edit images there.
Boom!

Millennial prick.

Re:So...

[Anonymous Coward]

*cough* GIMP/Inkscape *cough*

Your still just clinging to crap and making up excuses

Pretending your going to get blown up by a missile is beyond the pale of bullshit

Re:So...

[thegarbz]

If you can't fix the issue then let us have the option to remove the POS.

Ever considered uninstalling it?

Re: So...

[Zero__Kelvin]

Last time I checked feet were entirely optional. Nothing stops you from removing them and using a wheelchair! What's that? You actually need to talk to others that use Skype? Oh, never mind then, it's a closed system and it has absolutey been forced down your throat ... known vulnerability they decided not to fix included.

Re:So...

[ZosX]

Except linux lags behind Windows on the desktop in terms of usability badly. Not to mention that all the real world applications I need are only on Windows. And games. Wine is great and all but the last time I tried it, I was seeing my nvidia card perform about half as well as it should have. Pass. I do like linux, but lets be honest, its a broken fragmented mess with few quality commercial applications for it.

Re:So...

[ZosX]

Wake me up when darktable is better than lightroom and the gimp is on the level of photoshop. Not holding my breath here......

And inkscape? Its nice but nowhere near as powerful and industry supported as Illustrator.

Re:So...

[Anonymous Coward]

Application? You mean those things you actually install on your hard drive instead of just loading up in a web page? There are honestly very few of those left that you cannot load up in a web page.

Haha wtf do you not do any real work on a computer or are you trolling.

Re:So...

[Anonymous Coward]

Hah seriously, anyone advocating GIMP/Inkspace as Creative Suite replacements was never using Create Suite for more than I-can-pirate-it curiosity. They're not not comparable.

Re:So...

[Anonymous Coward]

Application? You mean those things you actually install on your hard drive instead of just loading up in a web page? There are honestly very few of those left that you cannot load up in a web page. So since most applications are web sites now and that means platform agnostic, applications aren't really the driving force.

I hate to use the M word, and I notice that someone else already did but... this is some millennial bullshit. Most of us are doing things on our computers (both at home and at work) that are more complex than some HTML5 webapps. This is slashdot, not everyone here is using.a PC for general office tasks. And honestly, even for those G Suite and Office 365 are just not as good as the native Office suite. That will change with time, but if you're a heavy Office user native Office is still a much more powerful tool. If all you use a PC for is surfing the web and very light office work, your statement may stand.

Also you have perhaps failed to hear about steam OS for linux for gaming, its great quite frankly.

And it's cool, and there are games on it. But it's not a replacement for a Windows PC. Trust me, I use and advocate Linux where applicable. But any moderate to serious gamer is not going to drop Windows for Linux Steam. If all you want to play is Valve titles and indie titles, more power to you though.

I can't tell if your post is trolling or you're serious bubbled away from what people actually do with PCs. If your lifestyle really does just exist in a browser, you're better off with a ChromeBook or an iPad.

Re:So...

[Anonymous Coward]

Except linux lags behind Windows on the desktop in terms of usability badly.

HAHAHAHAHAHAHAHA!!! Thanks dude, for giving "Stockholm syndrome" its own post this thread. Windows usability is a complete joke, it's barely worse than the POS called GNOME, and it's light years behind everyone else.

Seriously, you're calling an interface where you can consistently click "forward" and end up where you started "good"? It literally leads you in circles! You don't have the first clue about usability, you're mentally damaged.

Extra bonus laughter for Nvidias shitty drivers somehow being the fault of "Linux". Of course Nvidia being non-coperative and generally obnoxious isn't relevant at all.

Jebus, you fail at life hard.

Re:So...

[Anonymous Coward]

When WIndows 8 came out, Skype was there by default.

Oh, FFS, Microsoft. I haven't infected my computer with anything newer than Win7 so haven't had to contend with the extra malware yet.

Re: So...

[Archfeld]

Please check again, Skype is part of Internet Exploiter 11 and installed on Windows 10 by default. It cannot be uninstalled nor disabled, you can just never activate it or connect a Microsoft account to it to prevent it from initializing. I generally use Linux but I am required to keep a Windows system around for HR software and use a Hotmail account to access M$ websites for enterprise support.

Re:So...

[Archfeld]

More than considered it, spent several hours researching and attempting it but much like cancer it grows back and is deeply rooted in the both the system and the browser.... I'd gladly do away with windows but the employer uses HR software that only runs on Windows 10 and Hotmail for required MS support purposes.

Re:So...

[Archfeld]

"Better question, who the hell in their right mind knowing what we all know about software and the industry would use windows anything?"

Anyone who works for someone else who requires it. I'd love to have the choice but my current contract and previous one for that matter required Windows 10 and a Hotmail account. The HR software of their choosing was windows only and to get into MSDN and the enterprise support sites you have to use a Hotmail account...

Re:So...

[thegarbz]

Interesting. Just right clicking Skype on the start menu and clicking Uninstall seems to do the trick just fine too. There's nothing deep about it. It's a standard UWP app.

Re:So...

[Archfeld]

Perhaps skype imbedded in Internet exploiter is different from the installed version. I do not have an installed version but rather the imbedded version in the outlook mail client I am required to keep for work. But just go on assuming you know everything about everything. It seems to have served you well to this point...

Just revert back to

[Anonymous Coward]

the original Peer-to-Peer version before MS bought it

since microsoft bought skype, it is broken...

[Anonymous Coward]

and it can't be fixed because they broke it on purpose...

Skype == Turd

[Anonymous Coward]

Skype turned into a huge turd when Microsoft touched it.

It took 6 attempts to get a call through without having either side sound like either donald duck, or mickey mouse. Then of course, you need to make sure your 100/100 internet connection is fast enough, or you get the dreaded "poor quality connection"...

I fixed skype by uninstalling it and using google hangouts.

Won't help

[The MAZZTer]

You seem to misunderstand. The entire thing from Microsoft is the part with the flaw. The way this works is something else would get you infected with malware, which would then leverage Skype's update process to gain administrative access to your system silently.

Re:Won't help

[fustakrakich]

which allows an attacker to trick an application into drawing malicious code instead of the correct library.

That doesn't sound like it comes from Microsoft. It seems to me that the regular installer takes bits and pieces from here and there to assemble the app on your computer. I don't see that risk if you download the whole chunk from MS. And I don't let it update automatically. I definitely could be wrong, but I still feel better doing my installs from a local file/folder that I know (or think I know) has the correct library.

Re:Won't help

[whoever57]

I have thought for years that Windows would be more secure if Microsoft provided a mechanism by which ISVs could hook into the Windows Update process and use that for program updates. The system could required code signatures to ensure that fakes are not being installed. Microsoft could make some money out of it by selling code signing certificates.

Obviously, they would have to take care that the ISV hooks could not overwrite any core Microsoft items and perhaps not overwrite any prior ISV hook.

Re:Won't help

[Bert64]

And they've finally implemented exactly that, it's called "windows store" and they were the last major os vendor to do so.
You can't just hook in tho, you have to publish through the store, and that comes with all kinds of strings attached.

I find it amusing how the app store model is taking off, a few years ago this was one of the most common arguments against linux - the claim was that users want to buy software from a store or download from a random website and they won't like the repository model. Turns out the linux proponents were right, users do like being able to search and choose software from one place, but they were very bad at marketing this advantage linux had.

Re:Won't help

[AmiMoJo]

It's not really the app store they care about, that's just a way of making getting what they really want more convenient. And what they want is Microsoft Word and Excel, YouTube, Facebook and Maps.

Geeks like us hate all that. We see it as bloatware, crap we don't want rammed in our faces. But for ordinary users it's exactly what they want. They don't care about your repo with 57 different IRC clients and 9 versions of Firefox with slightly different licence terms. They want Skype and WhatsApp, because that's what their friends use.

Static Link?

[ChodaBoyUSA]

Could they just static link the libraries to avoid the use of DLLs until the replacement is ready?

Re:Static Link?

[Cassini2]

While officially Microsoft supports static linking, in practice, it is necessary to use DLLs in many situations. The Microsoft official answer is at: Extension DLLs

The practical reasons that I have been forced to use DLLs are:

• 1. If you want your application to upgrade smoothly over the years, you have to use either the DLL calls or the windows system calls and avoid the statically linked C libraries. For instance, when the times and dates for daylight savings time change, only the windows calls get updated automatically. The statically linked libraries don't get updated. DLL libraries get updated when the DLL gets updated (which can lead to DLL Hell, but that is another story.)
• 2. If you have an application that allocates memory in one DLL and frees it in another, then it is vital that the library that does the memory management be a DLL. Otherwise, each DLL has it's own statically linked memory mapping library, and they don't know about each other's allocations.
• 3. (2) applies to applications that use new and delete. It also applies to applications that are ActiveX controls and using IMalloc.
• 4. Some of the cool Microsoft libraries link to DLLs, so it doesn't matter if you want to use static libraries. You are getting DLLs.
• 5. Only the really old languages like C++ and QuickBasic supports static linking. I'm pretty sure Visual Basic, C# and .NET all require DLLs.

Re:Static Link?

[toadlife]

Probably. Or you could sign the libraries and executables. This is a common type of vulnerability that shouldn't happen, but does, due to laziness, but it is also relatively easy to fix. The summary's claim of a "massive code rewrite" being needed is sensationalist BS.

Re:Static Link?

[Anonymous Coward]

Your idea only works if the OS enforces the code-signing requirement, or if you manually load the DLL with LoadLibrary() and look up the function pointers with GetProcAddress().

For symbols automatically linked from DLLs, you can't check the signature yourself because it's too late at that point: the OS has already loaded the DLL into your process and executed its DLLMain() entry point, so the damage is already done before you ever entered main().

Re:Static Link?

[Anonymous Coward]

why not have a standard updater instead of having each program come with its own updater that needs to be run as root?

Re:Static Link?

[v1]

The summary's claim of a "massive code rewrite" being needed is sensationalist BS.

It certainly does look that way. Apparently the problem is in the updater. If your UPDATER even needs to be "completely rewritten", I don't see how that could be described as a "massive rewrite".

MS never wanted skype, they wanted its userbase. Most users don't like the "new look" they gave it anyway. MS is just going to leverage this into a handy excuse to get the current skype users to move over to their own home-grown IM/Chat client.

Re:Static Link?

[Anonymous Coward]

It may be that they forgot to give the updater the ability to update itself... I guess Skype could update the updater, but I guess that's impossible because the Skype process runs unprivileged.

Hmm, if only there were some sort of privilege escalation technique that could be used to alter the Updater's code and patch the problem...

Nah, let's rewrite the whole client.

Re:Static Link?

[WaffleMonster]

1. If you want your application to upgrade smoothly over the years, you have to use either the DLL calls or the windows system calls and avoid the statically linked C libraries. For instance, when the times and dates for daylight savings time change, only the windows calls get updated automatically. The statically linked libraries don't get updated. DLL libraries get updated when the DLL gets updated (which can lead to DLL Hell, but that is another story.)

Normally Microsoft C library hands off to windows to process time. When daylight savings time changes statically linked C libraries do not have to be updated or applications recompiled to take advantage of these changes.

They have internal logic that can get out of sync however as a practical matter it's a fallback that is never used.

If you have an application that allocates memory in one DLL and frees it in another

Then the application is BROKEN.

then it is vital that the library that does the memory management be a DLL. Otherwise, each DLL has it's own statically linked memory mapping library, and they don't know about each other's allocations.

GIGO

Re:Static Link?

[toadlife]

Thanks for the info.

In this particular case it's one executable using another, not a DLL being called.

Re:Static Link?

[swb]

I think at this point application vendors could solve a multitude of problems by providing statically linked applications. Issues like memory and disk space aren't as big of an impact as they once were.

But I think the reason we won't see a renaissance in statically linked applications is that vendors LIKE the fact that installers get run as privileged users because it lets them snoop the system and install telemetry they couldn't do with a static executable.

To be sure, there are good arguments against statically linked executables -- it's not a one-size, fits-all solution, but given the popularity and availability of so many portable versions of free apps, I think there's more demand for them.

Re:Static Link?

[angel'o'sphere]

2. If you have an application that allocates memory in one DLL and frees it in another, then it is vital that the library that does the memory management be a DLL. Otherwise, each DLL has it's own statically linked memory mapping library, and they don't know about each other's allocations.
Then don't link memory management code into those DLLs ... problem solved, facepalm.

5. Only the really old languages like C++ and QuickBasic supports static linking. I'm pretty sure Visual Basic, C# and .NET all require DLLs
Depends probably which VisualBasic version you are talking about. Modern VB is running on .NET. Everything on .NET is byte code. Similar to Java Byte Code. So be definition it is a DLL. if you want to access native code, that would be in a dll, obviously, as you have to load it somehow dynamically ... however everything that DLL needs, could be static linked into hat DLL.

Re:Static Link?

[kenmtraveller]

I think I know why they claim a need to rewrite their downloader, it's because of the way the loader does implicit loading of DLLs at process initialization.
This implicit loading is vulnerable to DLL hijacking , and mitigations like SetDLLDirectory() and such don't help because it happens before any code in their updater gets to run -- even if they use a custom entry point. You can see this yourself by using WinDbg with Loader Snaps enabled , you will see DLL loads occurring before any of your own code gets to run.
So, one good way to defend against DLL hijacking, given this, is to make sure your downloader has no dependencies on Microsoft APIs except for those in kernel32.dll (and I suppose user32.dll). These DLLs are 'special case' DLLs that can't be hijacked due to their presence in the KnownDLLs list.
But, taking an updater with heavy dependence on Microsoft APIs and reducing this dependency across the board might easily require a big rewrite.

Linux is MORE vulnerable

[Anonymous Coward]

Just look at the stats. Failing Linux has had hundreds of CVE's in just the last year with a lot more and worse severities than all the current versions of amazing Windows *combined*. If you want to trust your computer to be secure, you are better off with Windows than littul linux. It's a simple fact, easily proven, but completely politically incorrect to say here which is everyone knows it is true.

Re: Linux is MORE vulnerable

[mSparks43]

I miss the days when every hacker under the sun would regularily release 0days for free that let you infect windows machines just by sending a skype message. Now you got to pay :( - or understand russian :)

Re:Linux is MORE vulnerable

[Anonymous Coward]

The question isn't a matter of "who has more CVEs". That only tells you the vulnerabilities that were disclosed, categorized, and dealt with. Given that libre software is community-centered rather than profit-centered, it's in the community's interest to reveal and fix bugs. A corporation has little incentive to disclose their own vulnerabilities, even after they've fixed them.

tldr CVEs are a poor measure of system security when comparing apples and oranges.

Re:Linux is MORE vulnerable

[Anonymous Coward]

Don't feed the trolls.

Re:Linux is MORE vulnerable

[Anonymous Coward]

tldr CVEs are a poor measure of system security when comparing apples and oranges.

Well too bad? That metric was happily used by many against Windows, it will cheerfully be used by many more against Linux.

Re: Linux is MORE vulnerable

[Anonymous Coward]

all the "hackers" are working now for big corporations... start employing Russians

Re: Hey excuse me psst cunts..

[mSparks43]

20.......16, doh.

Re: Hey excuse me psst cunts..

[Anonymous Coward]

Dude .you SERIOUSLY need to worry about something different in the real world. Holy shit....RELAX!

Re: Hey excuse me psst cunts..

[Anonymous Coward]

WOW! Are you the racist PIG. Go due ya loser. You seriously need to quit sitting at home behind the keyboard trying to learn how to suck your own dick and get outside and see the real world and quit trying to be some self glorified keyboard Warrior. You need a life, or a major attitude adjustment I should say you racist scumbag

They replaced MSN Live with Skype!

[Anonymous Coward]

LOL

Well....

[Anonymous Coward]

I think with the amount of money Skype has it's probably high time that they give it a huge overhaul anyway and they can certainly afford it so I hire a great coder and get your asses in gear LOL.

Did I end up in the bizarro universe somehow?

[Anonymous Coward]

This exact same "attack" has been the root cause of dozens of Windows vulnerabilities reported on Slashdot over the past decade.
EVERYONE should already know about this flaw, so Microsoft has no right to act like it didn't know about the flaw when they purchased Skype.

If any program allows downloads to its %PATH%, then it's 100% vulnerable to this exploit.

p.s. This is also the reason you should never launch an installer from the download directory for your web browser. (Yes, that was also a story on /., but I'm too lazy to look it up.)

getting access rights

[Anonymous Coward]

Can I use this to get access rights to my android phone that I paid good money for but have no access rights?

app store censorship

[Joe_Dragon]

app store censorship needs to go.

Skype for Linux is terrible

[Anonymous Coward]

The old standalone client was bad. Rather than fixing it, they tried to push everyone into WebRTC.

The UI of Skype even on Mac is now awful. Microsoft took a piece of crap and piled on a layer of fresher crap.

The time has come for Skype to get tossed in the trash.

Re: Skype for Linux is terrible

[ArmoredDragon]

Microsoft simply felt that it's UI wasn't modern enough, so they needed to modernize it. Modern meaning 50s era Scandinavian magazines, of course... Kind of like windows 1.x/2.x, only with a smaller color palette and no divider lines, this way it has to be really bright and contrasty colors, like a Fisher-Price toy.

Re: Skype for Linux is terrible

[Gr8Apes]

Microsoft simply felt that it's UI wasn't modern enough, ... it has to be really bright and contrasty colors, like a Fisher-Price toy.

So, back to XP?

Comment removed

[account_deleted]

Comment removed based on user account deletion

I have seen this before

[Anonymous Coward]

Isn't this quite similar to IBM's (Lotus) Notes updater problem?

Security Bulletin: IBM Notes Privilege escalation in IBM Notes Smart Update Service
IBM iNotes SUService can be misguided into running malicious code from a DLL masquerading as a windows DLL in the temp directory. IBM Plans to address this vulnerability by providing a fix.
https://www-01.ibm.com/support/docview.wss?uid=swg22010775

A rewrite, really?

[Artem S. Tashkinov]

Last time I checked a complete rewrite is not necessary at all. Sometimes a one liner, e.g. SetDllDirectory(""), is more than enough.

Re:A rewrite, really?

[Hal_Porter]

Yup. Secure DLL search paths isn't that hard to implement.

Circle jerk

[duke_cheetah2003]

What's worse is that Microsoft, which owns Skype, won't fix the flaw because it would require the updater to go through "a large code revision." Instead, Microsoft is putting all its resources on building an altogether new client.

Man I gotta hand it to whomever at Microsoft actually convinced their boss to go this route. There was a MSN messenger once, you know, Microsoft's IM client, they dumped it and bought Skype. Now they're dumping Skype for inhouse MSN messenger 2.0? Hahahahaha nice job.

Re:Circle jerk

[Anonymous Coward]

What's worse is that Microsoft, which owns Skype, won't fix the flaw because it would require the updater to go through "a large code revision." Instead, Microsoft is putting all its resources on building an altogether new client.

Man I gotta hand it to whomever at Microsoft actually convinced their boss to go this route. There was a MSN messenger once, you know, Microsoft's IM client, they dumped it and bought Skype. Now they're dumping Skype for inhouse MSN messenger 2.0? Hahahahaha nice job.

visit http://www.mypictures247.com/corporate-photography/

Re:Circle jerk

[thegarbz]

Hahahahaha nice job

Yes it is. Think about this for a second. Some of the biggest improvements to OSes have come from major re-writes. This isn't a big deal for a software company as much as it is business as usual.
Likewise some of the biggest purchases and acquisitions have had zero to do with software. Software is just some code anyone can write. You think a couple of guys in Estonia could do something Microsoft couldn't? The reason Skype was purchased was IP + userbase. This IP+userbase was merged with the existing IP+userbase of the MSN world. Now they have the audience captive including an automatic updater it is trivial to move them onto whatever they want to do next.

If you can't convince your boss that these are solid business decisions (get IP > get users > get platform lock-in > dominate users) then you may want to give your future suggestions to someone else to present to management.

Re:Circle jerk

[Anonymous Coward]

woosh...

Re:Worst racists are "Talmudic YooTz"

[Anonymous Coward]

"Perrone"?

Which Skype

[Anonymous Coward]

Which Skype is affected, the real Skype that MS purchased, or the fake MS Lynx or whatever it was they renamed to Skype after they bought it?

Alternative to Skype?

[Anonymous Coward]

Skype has become progressively more difficult to use, with ads, spurious CPU usage and no lately the 8.X line with a complete makeover of the user interface. Sound and so on doesn't seem to be improving either. So, the question, what are the commercial or open source alternatives that are ad-free, but being paid for services is totally fine if it works well.

Re:Alternative to Skype?

[Shikaku]

Discord

Always makes me chuckle and irked

[oldgraybeard]

Adobe, Java, Skype runs 24/7 update processes that I keep just killing and they keep coming back. I do all my normal work on a normal user account, which means these programs fail trying to auto install updates because on my Windows 7 Pro box they do not have permissions.

These programs are a plague that expects their users to run their computers (as admin) on a day to day basis. They encourage poor security habits.

When I get irked about the constant pop ups and threats I will log out of my user account and in to my admin account and install the most needed ones.

And no I do not need resident programs running 24 7 to monitor my ink cartridge status and offer easy on line ordering.

Oh another category, all the worthless loaded process trying to add to your customer experience (Yea I am taking about you NVidia and others).

Note from me, just install the needed drivers and applications, and have an unchecked box saying yes I want to install all your worthless add on crap ;) Not

Just my 2 cents ;)

"Improving a finished product"

[Anonymous Coward]

Does anyone else think that Skype has been on a steady downward spiral? I used to love it because it worked both on my phone and my laptop, it worked on Windows and Mac, and it was a non-intrusive, convenient client which allowed file sharing and video chat.

Then came the endless string of "imrpoving a finished product". First, we got this situation where sending image files triggered some special code path and suddenly you couldn't view photos anymore until both parties upgraded to the latest version (which wasn't finished for all platforms at the same time); then we got the phonification of the interface even on desktops, and the focus on funny animated smileys and color themes, and we recently lost the ability to scroll back in the conversation (not only on the phone versions but also on the desktop).

Are we, consumers, at fault for this? For equating "this product has not seen major rework lately" with "this product has been abandoned and you shouldn't use it anymore"? Or are we, software developers, at fault for this? By taking a product which is "fine" and think we need to keep "improving" it?

While they're rewriting it...

[6Yankee]

...they can damned well reinstate the API used by the Netgear Skype DECT phone I paid a shitload for. The one that says "Skype certified" on it. >:(

Problem as old as the hills

[Anonymous Coward]

Anti-Virus add-ons had near identical issues, which I believe have been solved, and most have robust payload checksumming to ensure other files are not substituted. You would assume windows defender is doing similar checks, as well as fingerprint readers, and the logon screen.

What is interesting is that rather than ask their AV dudes, and port tested hijack free loaders, they would rather re-write, because reading somebody else's code is too hard for the brain dead skype team.

If it is this sloppy, then it should be possible to insert stubs that secretly record all, and maybe attack bu-ray media players, as they are obviously clueless. IF they do re-write, I hope AV1 will be included.

"Can't fix"? .. Eh?

[Anonymous Coward]

Can someone please explain to me was this can't be fixed?

I'm a software developer myself, mostly web the last couple of years, but wrote Win-programs a while back.

This seems VERY fixable to me. What am I missing?
I understand that the current updater loads and inits a couple of DLL:s it depends on, which happens during program start, and that bad versions can be put in "unsafe" directories to override the safe ones. But what I fail to understand is why they can't push a new updater, which first scans the folders involved in the Windows DLL-chain, and checks DLL:s found with normal checksum/fingerprint, before loading the big updater (which loads the actual DLL:s). The small "pre-updater" should of course not be dependent on any external code.

Why is this a problem?
I would fix it before going out for lunch.

Re:"Can't fix"? .. Eh?

[Anonymous Coward]

True. Another option would be to disable loading of any DLL, since most systems these days have very huge memory. Not like 4MB RAM in the past years that's used by minicomputers with 12 users cimultaneously logged in and doing real scientific work. These days 4GB up to 16GB or 32GB is normal, I have seen 64GB and 128GB for high end laptops too. DLL was designed during those days where RAM was expensive, but not today. Maybe M$ is still coding in VB and doesn't know how to do some stuff in C or assembler where an updated can be done in just 1,500 bytes up to 3KB without DLL dependencies.

Re:Worst racists are "Talmudic YooTz"

[Anonymous Coward]

They are a religion, not a race (so he's not racist).

Yeah yeah, semantics.

Either way, both of you are dicks.

What Else ?

[spinitch]

What Else ? Whatsapp, Line, WeChat, Zoom, Hermit, other?

What Else ?

[spinitch]

What Else ? Whatsapp, Line, WeChat, Zoom, Hangouts, Hermit, other?

Linux Skype is Web Skype

[DrYak]

Modern Skype is mostly Web Skype.

Modern "Skype for Linux" version 8.x is just Web Skype, packaged together with Chromium, thanks to Electron framework.
(Unlike older versions 4.y which were a Qt port of an older Windows native application).
The most recent version has moved away from binary plugins for the Audio/Video and/or from Microsoft's own NIH syndrom.
And transitioned to WebRTC + HTML5 Video.

But you don't even actually need to install this piece of crap.
  - You can browse to http://webskype.com/ with Chromium and mostly get the same result. (But without installed binary plugin, only relying on Chromium's WebRTC)
  - You can also browse it with Firefox (last time I checked, Audio/Video wasn't supported, saddly)
  - You can even install the SkypeWeb Purple plugin and use it from within Pidgin/Adium

You can basically use Skype without executing a single binary opcode written by Microsoft
(well directly, anway. Depending on your Javascript enginge, it's going to JIT the Javascript on Skype's website if you use Chromium/Firefox. Pidgin isn't affected).

Do you really insist in shooting your own foot?

[Opportunist]

Skype was unique when it was new. A simple to use, easy tool for voice and text chat. And one that can even do phone calls if you so please. People jumped onto it because, well, it was the only one.

Fast forward to today when this monopoly situation ain't so true anymore. Considering how Skype refuses to play nice with any of the other kids in the communication and messenger pool, insisting on being a special little snowflake that nobody may touch with their grubby paws, Skype is pretty much the tool you use when you need to get in touch with those that don't move away from Skype because, well, they don't like to change and they don't want to use a new tool.

If they now have to, they, too will move away from the one-trick pony with some prodding from their friends now that they have to install something new anyway, so why not something that more people use?

I'm sure APK is on this

[Anonymous Coward]

I'm sure APK is on this trying to find some way he can claim hosts can block an attack that uses this vector.

Re:I'm sure APK is on this

[bioteq]

Hosts fix -everything- though!

Comment removed

[account_deleted]

Comment removed based on user account deletion

Requires local access

[Luthair]

Should be noted that the bug requires that the attacker can write a DLL to your file system. So the user already needs to be downloading random DLLs, be a multi-user system or some other software needs to be exploited to write a DLL.

For a typical home PC this bug doesn't seem like a particularly problematic issue.

Re:So...and this Onedrive crap too

[ficuscr]

My hatred of Skype is second only to that of One Drive. Though I've somehow maintained a $10 account balance on Skype by logging in once every couple of years.

Re:Worst racists are "Talmudic YooTz"

[Anonymous Coward]

OP Here. Are my spidey senses now detecting a real-time public-thought-shaping effort by Slashcunt editors?

The thread I first referenced here is no longer archived but it was yesterday.
https://tech.slashdot.org/story/18/02/12/165259/a-facebook-employee-asked-a-reporter-to-turn-off-his-phone-so-facebook-couldnt-track-its-location

Damage control get rekt much dicks?

Good thinking to put it back to Post-able today.

Is this story intended to make the public think something special?
https://tech.slashdot.org/story/18/02/13/1729254/bill-gates-tech-companies-inviting-government-intervention

Old news there's feds all over Slashbutt. Ain't that right BeauHD? Bureau HeaD.

Y'all can still suck a bag of dicks. Straight. Get the Jews out of USA or you will wish you did later. Oh and about the currency hahaha... you already wish you did huh. usdebtclock.org

Look up fiat money and fractional reserve banking on investopedia.com

Everybody already knows the YouTube videos about it. Research it. There's no money ladies and gentlemen. It's fiat. Look up bank runs.

rekt.

God is smashing all you cunts playing house for life.

Re: Hey excuse me psst cunts..

[Anonymous Coward]

you know this. 007 wants 6.

dough.

Pay me mother fuckers. I did tell you.

--OP

It was a PLEASURE today... apk

[Anonymous Coward]

See subject: Knocking your ILLITERATE DYSLEXIC RETARD block off https://it.slashdot.org/comments.pl?sid=11736289&cid=56117171/ & if hosts could fix it I would post how.

I could fix this.

Pack RIGHT .dll into .exe as a resource (always proper model) & extract prior to functions used extracting proper one out into app's folder (1st search DLL order) & THEN do version check (or CRC/sizecheck etc.) LoadLibrary instance it & use it.

* EVERY UPDATE ALWAYS has correct lib build WITH CHECKING!

(I've done screensavers that pack .avi files into a .scr & extracts to playin RAM - you can pack ANYTHING YOU LIKE in an .exe as a resource).

APK

P.S.=> A variation of it makes APK Hosts File Engine 10++ SR-1 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ uninfectable!

(UPMODDED ON /. CODING FOR DEFCON http://it.slashdot.org/comments.pl?sid=158231&cid=13257227/ )

"Bioteq" FAKE NAME failure crying, lol!

[Anonymous Coward]

"Bioteq" FAKE NAME failure crying & FAILING for almost 3 yrs. now https://slashdot.org/submission/5378473/slashdot-coalition-to-stop-apk/ & you're useless in THIS conversation too (webboy) but I'm not https://it.slashdot.org/comments.pl?sid=11736521&cid=56117377/ & that'd actually WORK to fix this issue (permanently).

* What's it LIKE being constantly defeated & DESTROYED by "yours truly" you FAKE NAME for a FAKE LIE OF A LIFE wannabe?

(LOL, it's gotta SUCK for you & provides MASSIVE AMUSEMENT OPPORTUNITIES for me to shit ALL OVER "your kind" (losers), lol!).

APK

P.S.=> This one goes into my bookmarks/favs for YOU & I never EVER said "hosts cure all" but what they DO work for kicks "your kind's" (do-nothing chatterers online that *THINK* they know things in computing & you're SO LIMITED it's not even funny) asses - every SINGLE time (you make ME look GOOD & yourselves what I just said you are - nobody do nothing "ne'er-do-wells" - not men)... apk

How about a full solution?

[Anonymous Coward]

By switching from C++ to another language in which bugs do not lead to privilege escalation?