Slashdot Mirror
Microsoft Modifies Open-Source Code, Blows Hole In Windows Defender (theregister.co.uk)
An anonymous reader quotes a report from The Register: A remote-code execution vulnerability in Windows Defender -- a flaw that can be exploited by malicious .rar files to run malware on PCs -- has been traced back to an open-source archiving tool Microsoft adopted for its own use. The bug, CVE-2018-0986, was patched on Tuesday in the latest version of the Microsoft Malware Protection Engine (1.1.14700.5) in Windows Defender, Security Essentials, Exchange Server, Forefront Endpoint Protection, and Intune Endpoint Protection. This update should be installed, or may have been automatically installed already on your device. The vulnerability can be leveraged by an attacker to achieve remote code execution on a victim's machine simply by getting the mark to download -- via a webpage or email or similar -- a specially crafted .rar file while the anti-malware engine's scanning feature is on. In many cases, this analysis set to happen automatically.
When the malware engine scans the malicious archive, it triggers a memory corruption bug that leads to the execution of evil code smuggled within the file with powerful LocalSystem rights, granting total control over the computer. The screwup was discovered and reported to Microsoft by legendary security researcher Halvar Flake, now working for Google. Flake was able to trace the vulnerability back to an older version of unrar, an open-source archiving utility used to unpack .rar archives. Apparently, Microsoft forked that version of unrar and incorporated the component into its operating system's antivirus engine. That forked code was then modified so that all signed integer variables were converted to unsigned variables, causing knock-on problems with mathematical comparisons. This in turn left the software vulnerable to memory corruption errors, which can crash the antivirus package or allow malicious code to potentially execute.
When the malware engine scans the malicious archive, it triggers a memory corruption bug that leads to the execution of evil code smuggled within the file with powerful LocalSystem rights, granting total control over the computer. The screwup was discovered and reported to Microsoft by legendary security researcher Halvar Flake, now working for Google. Flake was able to trace the vulnerability back to an older version of unrar, an open-source archiving utility used to unpack .rar archives. Apparently, Microsoft forked that version of unrar and incorporated the component into its operating system's antivirus engine. That forked code was then modified so that all signed integer variables were converted to unsigned variables, causing knock-on problems with mathematical comparisons. This in turn left the software vulnerable to memory corruption errors, which can crash the antivirus package or allow malicious code to potentially execute.
I think they were holding off so that all of the idiots who actually use Window Defender could get exploited.
Sounds exactly like standard operating procedure at Microsoft.
Microsoft: bringing the Blue Screen of Death to Open Source Software since 2015.
Why is Snark Required?
That's why I'm listening to the current news right now on 4840 KHz.
Nothing to see here.
Someone at MS modified code without understanding all the implications, and/or they modified code and someone else at MS called the code without being aware of the modification.
"Forking open source code" could just as easily been "bought closed-source project from third party them modified it," "hired contractor to write a library then modified it," or "forked code from another MS project then modified it."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
This is a Microsoft product. So it is no surprise. Benn a very insecure week for them. But they are getting better at simply inviting the bad guy in. Black Hats are thankin' ya Mister Nutella.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Why this condonation in the article?
It seems like the bigger story here is that Microsoft has included code from the GPL-licensed unrar in their Windows Defender product, without releasing the full source code as required by the license agreement. Am I missing anything? The FSF needs to go after them for this!
Maybe they used a version with a license similar to this one.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Just in case anyone on slashdot cares, the goatse link from GP does not go to the infamous goatse.cx site, but points to goatse.info which is the cryptocurrency site for Goatse Coin.
Another internet tradition fades away...
No, that's not the bigger story. Get some perspective. This is a severe vulnerability that is going to cause very serious problems for god-knows-how-many people. The impact of this being exploited is far more important than whether or not MS violated the licence for unrar.
One of the lowest comments I've witnessed here. Even considering the worthless racist AC ones.
And with a 2 score.
just disable the option to scan compressed archives.
However if they didn't disclose in the Windows Defender documentation somewhere prominent that it is a violation of the license to use said code to reverse engineer the RAR file format, then they may have voided their license rights under the otherwise permissive license and Alexander Roshal may have standing to sue them.
While I don't much appreciate the RAR format for making my life difficult, I would appreciate seeing him get a punitive payday over Microsoft from it :)
You haven't been here long, have you?
If MS put something out that wasn't a massive security hole, that would be news.
MS hires nothing but numb-nuts and this is the predictable result.
There aren't many programmers who enjoy programming anymore. They are tough to find....Ever since the job became so lucrative. Besides, why do you think Americans are better programmers? It's not true.
"First they came for the slanderers and i said nothing."
I'm from a third world country (not India), and even if it's shameful for me, it's true. I like to think this doesn't apply to me, but mostly our standard for excellence is very low and people's motivation to do a good job reach only to the point where their get their wages, with absolutely no desire to go beyond, learn more, or do better. Most of our programmers, with some exceptions, don't even speak passable English, and come from a diploma mill. When we hire, our average candidate's grade in a standardized international Java exam is 20/100, even below what someone would get answering randomly.
And how can we get good professors or good candidates to begin with if all good talent (along with some of the bad one) is H1B hired in the US? I don't live in the US and hate your H1B program, as we cannot compete with the wages you offer to the few talented people we have. We used to have an IBM research lab in the 80's and some incredibly competent people (who were once my university professors), but all of them are long gone abroad.
Source: I split my time between being a professor in an major university and having an IT company.
Do you work at being an asshole or does it just come naturally to you?
why do you think Americans are better programmers?
Puritan work ethic. It's good and bad.
An expectation of excellence. It's good and bad.
High competitiveness and a willing to ignore work-life balance for greater professional achievement. It's good and bad.
American programmers. They are better. Decades of facts prove that true.
Damn I need some popcorn; this shit is funny.
You act as if Microsoft had some heyday in the past where they were competent.
You didn't refute any of his points. You didn't even try.
If they were so "low", it would have been easy and in your favor to have done so.
But you didn't. Because you couldn't.
The puritan work ethic is dead.
"First they came for the slanderers and i said nothing."
I actually feel stupider after reading your post. Seriously. Somehow the black hole of your stupidity reached out across the internets and made me slightly stupider than I was before. The only way I can figure it out is if you have negative IQ. You should get that checked out.
mostly our standard for excellence is very low and people's motivation to do a good job reach only to the point where their get their wages, with absolutely no desire to go beyond, learn more, or do better.
This applies to first world countries too...
However, there is generally a higher standard of education available and ability to speak english is a given in the US and other english speaking countries.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
No need that the scanner runs with LocalSystem rights, it could run standalone with no privileges and could be fed the files to scan by some RPC mechanism.
AC Z-80 SoftCard https://en.wikipedia.org/wiki/...
Domestic spying is now "Benign Information Gathering"
Please present the decades of facts you speak of.
No need that the scanner runs with LocalSystem rights, it could run standalone with no privileges and could be fed the files to scan by some RPC mechanism.
you don't understand a bloody goddamned THING about computer security if you think that secure code should trust the answers it gets from untrusted code
Holy cow I just assumed. Mentally I still see the "original" whenever that link appears in the brackets.
Only kids and n00bs code in Java, real programmers code in C and assembler. Because real programmers aren't afraid of goto and global variables.
It has little to do with who is better at what. I see excellent Indian programmers turn out complete turds that have to be fixed by their mediocre American peers on a pretty regular basis. A contributing factor, and the one I believe to be the most impactful, is that the Indian is a foreign contractor -- he has no skin in the game, and really couldn't care less if the product meets any standards of excellence, because his company will just find him another position should his current one be eliminated or the hiring company go tango uniform -- while the American has a job and benefits to defend.
It also has something to do with the level of contractor you get. My company, for instance, has a special agreement with one of the largest H1B holders in the world to get their greenest contractors at a very low negotiated price. That means we have to train them to do their jobs, making them ineffective at the roles they are traditionally placed to fill, and once they start to get the hang of things their parent company places them elsewhere at a higher rate, giving us another green candidate to train.
This leads to a lot of people disliking Indians based on copious, albeit negatively biased, first-hand experience, when they should be blaming the system and the companies that exploit it, foreign and domestic. And frankly, I can't blame them too much... most don't know the whole story, and can only draw conclusions based on what they see, which is pretty terrible.
No it's not, it's just resting.
> You haven't been here long, have you?
I know your question is rhetoric (ha!), but since you asked I may have been here from the start.
Wikipedia says Slashdot was founded on October, 1997. I was searching about Linux before October, 1998 when I bought my first Linux CD. That means I probably got to know /. in the earlier months of 1998 -- because I was interested in knowing what Linux was -- if not at the end of '97.
So here's your answer: /. has been bad since long, but I'm older than the mediocrity era.