Slashdot Mirror
Microsoft Modifies Open-Source Code, Blows Hole In Windows Defender (theregister.co.uk)
An anonymous reader quotes a report from The Register: A remote-code execution vulnerability in Windows Defender -- a flaw that can be exploited by malicious .rar files to run malware on PCs -- has been traced back to an open-source archiving tool Microsoft adopted for its own use. The bug, CVE-2018-0986, was patched on Tuesday in the latest version of the Microsoft Malware Protection Engine (1.1.14700.5) in Windows Defender, Security Essentials, Exchange Server, Forefront Endpoint Protection, and Intune Endpoint Protection. This update should be installed, or may have been automatically installed already on your device. The vulnerability can be leveraged by an attacker to achieve remote code execution on a victim's machine simply by getting the mark to download -- via a webpage or email or similar -- a specially crafted .rar file while the anti-malware engine's scanning feature is on. In many cases, this analysis set to happen automatically.
When the malware engine scans the malicious archive, it triggers a memory corruption bug that leads to the execution of evil code smuggled within the file with powerful LocalSystem rights, granting total control over the computer. The screwup was discovered and reported to Microsoft by legendary security researcher Halvar Flake, now working for Google. Flake was able to trace the vulnerability back to an older version of unrar, an open-source archiving utility used to unpack .rar archives. Apparently, Microsoft forked that version of unrar and incorporated the component into its operating system's antivirus engine. That forked code was then modified so that all signed integer variables were converted to unsigned variables, causing knock-on problems with mathematical comparisons. This in turn left the software vulnerable to memory corruption errors, which can crash the antivirus package or allow malicious code to potentially execute.
When the malware engine scans the malicious archive, it triggers a memory corruption bug that leads to the execution of evil code smuggled within the file with powerful LocalSystem rights, granting total control over the computer. The screwup was discovered and reported to Microsoft by legendary security researcher Halvar Flake, now working for Google. Flake was able to trace the vulnerability back to an older version of unrar, an open-source archiving utility used to unpack .rar archives. Apparently, Microsoft forked that version of unrar and incorporated the component into its operating system's antivirus engine. That forked code was then modified so that all signed integer variables were converted to unsigned variables, causing knock-on problems with mathematical comparisons. This in turn left the software vulnerable to memory corruption errors, which can crash the antivirus package or allow malicious code to potentially execute.
By Shaun Nichols in San Francisco 4 Apr 2018 at 21:37
https://www.theregister.co.uk/2018/04/04/microsoft_windows_defender_rar_bug/
This is over 24 hours old.. Thanks for the timely update BeauHD.
By Shaun Nichols in San Francisco 4 Apr 2018 at 21:37
https://www.theregister.co.uk/2018/04/04/microsoft_windows_defender_rar_bug/
Public Defender.exe
Here is an actual screen shot of the exploit in action, along with Bill Gates' personal reaction.
Sounds exactly like standard operating procedure at Microsoft.
Microsoft: bringing the Blue Screen of Death to Open Source Software since 2015.
Why is Snark Required?
Nothing to see here.
Someone at MS modified code without understanding all the implications, and/or they modified code and someone else at MS called the code without being aware of the modification.
"Forking open source code" could just as easily been "bought closed-source project from third party them modified it," "hired contractor to write a library then modified it," or "forked code from another MS project then modified it."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
This is a Microsoft product. So it is no surprise. Benn a very insecure week for them. But they are getting better at simply inviting the bad guy in. Black Hats are thankin' ya Mister Nutella.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Why this condonation in the article?
It seems like the bigger story here is that Microsoft has included code from the GPL-licensed unrar in their Windows Defender product, without releasing the full source code as required by the license agreement. Am I missing anything? The FSF needs to go after them for this!
Maybe they used a version with a license similar to this one.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
No, that's not the bigger story. Get some perspective. This is a severe vulnerability that is going to cause very serious problems for god-knows-how-many people. The impact of this being exploited is far more important than whether or not MS violated the licence for unrar.
This is what you get when you have globalist anti-american social justice hiring practices with an H1B third world CEO and H1B programmers, and refusing to hire articulate and talented American talent, third world programmer == third world code. Instead of fanatical American geeks who love what they do, you have degree mill poorly paid third world programmers who work for peanuts. When you come from a third world country with open defecation they have a very low standard of what excellence is to begin with, so you end up with poorly paid workers producing poorly designed, garbage code. This is a "success" compared with the standards of their originating country.
just disable the option to scan compressed archives.
However if they didn't disclose in the Windows Defender documentation somewhere prominent that it is a violation of the license to use said code to reverse engineer the RAR file format, then they may have voided their license rights under the otherwise permissive license and Alexander Roshal may have standing to sue them.
While I don't much appreciate the RAR format for making my life difficult, I would appreciate seeing him get a punitive payday over Microsoft from it :)
If MS put something out that wasn't a massive security hole, that would be news.
MS hires nothing but numb-nuts and this is the predictable result.
No need that the scanner runs with LocalSystem rights, it could run standalone with no privileges and could be fed the files to scan by some RPC mechanism.
No need that the scanner runs with LocalSystem rights, it could run standalone with no privileges and could be fed the files to scan by some RPC mechanism.
you don't understand a bloody goddamned THING about computer security if you think that secure code should trust the answers it gets from untrusted code