Slashdot Mirror
Microsoft Obliquely Acknowledges Windows 0-day Bug Published on Twitter (arstechnica.com)
A privilege escalation flaw in Windows 10 was disclosed earlier this week on Twitter. From a report: The flaw allows anyone with the ability to run code on a system to elevate their privileges to "SYSTEM" level, the level used by most parts of the operating system and the nearest thing that Windows has to an all-powerful superuser. This kind of privilege escalation flaw enables attackers to break out of sandboxes and unprivileged user accounts so they can more thoroughly compromise the operating system. Microsoft has not exactly acknowledged the flaw exists; instead it offered a vague and generic statement: "Windows has a customer commitment to investigate reported security issues, and proactively update impacted devices as soon as possible. Our standard policy is to provide solutions via our current Update Tuesday schedule." So, if the flaw is acknowledged (and it's certainly real!) then the company will most likely fix it in a regular update released on the second Tuesday of each month.
1. Trump goes to prison for life
2. Trump's phat booty is raped by a well-hung inmate daily
3. NO COLLUSION!
4. Trump pretends it never happened
5. Trump dies and is buried under the prison
The End
Microsoft has proven itself time and time again to be an insecure platform to work on. Why most users don't abandon that platform and move to something a little more secure is beyond me (e.g some Linux distro, OS X, etc). Maybe people just don't care, in which case they deserve all the problems they get staying with Microsoft. I just hope some day people will value their privacy and security enough to say "I'm done with Microsoft" (I have), unless they have to use it on a work computer. How long will people keep putting up with crappy, 0-day infested spyware?
Unless there's more than is in the summary, the headline should read "Microsoft does not Acknowledge Windows 0-day Bug Published on Twitter".
http://www.geoffreylandis.com
One of my favorite fables. Microsoft should probably stop dicking their hackers around with their bounty program and just pay them. Obviously guy could have made bank selling this to the NSA, GRU, or Mossad. But gave it away for free obviously to make the point that Microsoft expects him to work for free.
I'm actually hoping he drops a new one every day for a week.
I mean, if we're going to spin words here...
If you see the comments and write up in the documents and demo he released. It's fairly easy to exploit, in lay terms: the Task Scheduler read/writes to a location as SYSTEM and you can ask it to write any permissions to that file. Since the location of that file is publicly accessible for everyone, you could replace a job file with a DLL and then the system will write permissions for it to be executable as SYSTEM.
Custom electronics and digital signage for your business: www.evcircuits.com
...the Montreal winters became so unbearable that I realized I couldnâ(TM)t live that way any longer...
I was having thoughts about hurting the people around me or other âoedarkâ thoughts. Indeed, these had plagued me for years.
When the lows of those oppressive Montreal winters hit, the thoughts became unrelenting.
I won't go into detail about the content of those thoughts, but suffice it to say they were filled with terrible things that made me feel like a danger to those around me.
--------- and awaaaaay we goooo.
You hate. We all hate it. But it's the best of the those hated things. And I hate it. But no plans on taking it out on anyone. I leave that for the wacko Trumpers. They will do it no matter what. Because Trump. That's why.
Windows 10 will soon force monthly charges.
Basically, if there is a monthly charge for Windows 10, Microsoft will make more money if there are more bugs in updates. They will apparently fix the bugs only for those who are paying monthly.
and you have to tell the people who use it that you have to wall it up... It's curious how many "accidental" security issues just let someone literally take full control of the computer. It's almost as if they were purposefully built, and intentionally covered up. Hm.
...except this sort of thing has been happening on various *nix systems for many years now.
Yes, Windoze 10 is a piece of shit, and should be migrated away from, but for different reasons.
Questions:
1) Do you think Microsoft won't begin charging everyone later? That's what Adobe Systems did after releasing Creative Suite version 6. It is now Adobe Creative Cloud.
2) Will "business users" want Microsoft to have more control over their computers?
Maybe I can use the exploit to uninstall Cortana, "Telemetry" (i.e. spyware) and Edge. All useless crap I don't want on my PC.
Here's hoping !
This is /. so you don't have to oversimplify. .job file in the Tasks folder. Since the task scheduler runs under the system account, it should impersonate the caller when doing so, since otherwise when setting the permissions, the kernel will check if system, rather than the caller, is allowed to set the specified permissions. This is done correctly for the folder, but due to an oversight the task scheduler doesn't impersonate the caller when setting the DACL on the .job file.
What's actually going on is that the task scheduler has an API that allows you to set the DACL (discretionary access control list, the list of permissions for various user accounts or groups) for a task's folder and
Now, any user can create a job and were it not for a bug like this one there'd be no reason to disallow this since the job would only run with privileges that were already available in some way to the user creating the job in the first place. But this fact can be used to exploit the bug, by dropping a hard link to some file in the Tasks folder and then using the API to set a new DACL on it. Because of the bug you can gain write access for files that are normally read-only for you and on which you normally cannot set a new DACL.
The scenario used by the POC is as follows: Locate a dynamic link library that gets loaded into a process running as system. These are normally shielded from modification by normal users and even system, because normally only TrustedInstaller can modify these files. It's important it isn't already loaded, otherwise we'll get a sharing violation later when we try to edit it. Drop a hard link to this dynamic link library into the Tasks folder and edit the DACL to give you write access. Modify the dynamic link library to contain your exploit code. Perform whatever action needed to trigger loading the library, and presto!