Slashdot Mirror
Microsoft: Windows 10 Devices Open To 'Full Compromise' From Huawei PC Driver (zdnet.com)
According to ZDNet, researchers at Microsoft have discovered a buggy Huawei utility that could have given attackers a cheap way to undermine the security of the Windows kernel. From the report: Microsoft has now detailed how it found a severe local privilege escalation flaw in the Huawei PCManager driver software for its MateBook line of Windows 10 laptops. Thanks to Microsoft's work, the Chinese tech giant patched the flaw in January. As Microsoft researchers explain, third-party kernel drivers are becoming more attractive to attackers as a side-door to attacking the kernel without having to overcome its protections using an expensive zero-day kernel exploit in Windows. The flaw in Huawei's software was detected by new kernel sensors that were implemented in the Windows 10 October 2018 Update, aka version 1809.
The kernel sensors are meant to address the difficulty of detecting malicious code running in the kernel and are designed to detect user-space asynchronous procedure call (APC) code injection from the kernel. Microsoft Defender ATP anti-malware uses these sensors to detect actions caused by kernel code that may inject code into user-mode. Huawei's PCManager triggered Defender ATP alerts on multiple Windows 10 devices, prompting Microsoft to launch an investigation. [...] The investigation led the researcher to the executable MateBookService.exe. Due to a flaw in Huawei's 'watchdog' mechanism for HwOs2Ec10x64.sys, an attacker is able to create a malicious instance of MateBookService.exe to gain elevated privileges. The flaw can be used to make code running with low privileges read and write to other processes or to kernel space, leading to a "full machine compromise." Long-time Slashdot reader shanen writes: Though the story features Huawei, there doesn't seem to be anything specific to that company there. Just innuendo that you can't trust Chinese companies, eh? "Don't throw your computer into that Chinese briar patch!" Anyway, the sordid reality is that Microsoft is the root of all evils in the Windows platform. If increasing security had been half as important as maximizing profits, then we'd be in a much better world today. All complicated software is buggy, but adding complexity for no good reason is just begging for more problems. Here's a crazy solution approach: Any OS feature that isn't used by a LARGE majority of the users should be REMOVED from the OS. Maybe that isn't strong enough. Maybe the OS should be strictly limited to what absolutely needs to be there. Guard those eggs carefully!
The kernel sensors are meant to address the difficulty of detecting malicious code running in the kernel and are designed to detect user-space asynchronous procedure call (APC) code injection from the kernel. Microsoft Defender ATP anti-malware uses these sensors to detect actions caused by kernel code that may inject code into user-mode. Huawei's PCManager triggered Defender ATP alerts on multiple Windows 10 devices, prompting Microsoft to launch an investigation. [...] The investigation led the researcher to the executable MateBookService.exe. Due to a flaw in Huawei's 'watchdog' mechanism for HwOs2Ec10x64.sys, an attacker is able to create a malicious instance of MateBookService.exe to gain elevated privileges. The flaw can be used to make code running with low privileges read and write to other processes or to kernel space, leading to a "full machine compromise." Long-time Slashdot reader shanen writes: Though the story features Huawei, there doesn't seem to be anything specific to that company there. Just innuendo that you can't trust Chinese companies, eh? "Don't throw your computer into that Chinese briar patch!" Anyway, the sordid reality is that Microsoft is the root of all evils in the Windows platform. If increasing security had been half as important as maximizing profits, then we'd be in a much better world today. All complicated software is buggy, but adding complexity for no good reason is just begging for more problems. Here's a crazy solution approach: Any OS feature that isn't used by a LARGE majority of the users should be REMOVED from the OS. Maybe that isn't strong enough. Maybe the OS should be strictly limited to what absolutely needs to be there. Guard those eggs carefully!
Personally I’m highly suspicious of Huawei and I don’t think this was a flaw. “Intended design” is what I suspect is a better description.
Well, there's spam egg sausage and spam, that's not got much spam in it.
Wait up there, Windows 10 is compromised by default. It includes software that invades your privacy, analyses your data and your internet access and does not inform you what it sends and specifically purposefully has been done in a way to block users for turning it off reliably (they shit cunts routinely turn it back on, purposefully). It forces the install of programs without user choice and that includes altering defaults, running advertisements and basically turning over control of that 'NOT-personal computer', to a blatantly corrupt for profit corporation, as a conspiracy between that 'CUNT' corporation and the equally corrupt USA government.
Chaos - everything, everywhere, everywhen
None of your comments have anything to do with the problem that Microsoft found. The folks in Redmond have put a lot of work into Windows 10 security while trying to retain the current partner ecosystem and backwards compatibility.
Here's a crazy solution approach: Any OS feature that isn't used by a LARGE majority of the users should be REMOVED from the OS. Maybe that isn't strong enough. Maybe the OS should be strictly limited to what absolutely needs to be there. Guard those eggs carefully!
While this looks to make sense at first sight, it is flawed.
Suppose there are a 100 functions that less than 5% of the users use. Removing each of them will only affect 5% of the users. Removing all of them might affect nearly 100% of them users, as each of them needs another feature to work.
I do agree on MS' bad reputation when it comes to security, but even that was not the root cause here. Their driver approval process needs might need more attention.
Or maybe something absurd as, say, open-source drivers? Ideally the whole kernel and driver stack would be OS. Maybe in the future law will require such, for safety and accountability. They can keep their other junk like office closed afaic.
A glitch a day keeps the bugs away.
Malice, negligence or just "shit happens", low-level hardware drivers are a problem. The protection is pretty much the same no matter how the vulnerability got there.
Hardware drivers and the kernel require powerful capabilities - and are responsible for ENFORCING security policy. Since they control security, they can't be controlled by it.
At one point people developed the idea of the microkernel as a theoretical way of reducing the attack surface. In practice, that evolved into virtualization - the hardware drivers being separate from the application software, to the extent of being two separate operating systems. Virtualization gives a good layer of security (though nothing is perfect).
Another good solution is exemplified by USB 2.0, where the hardware driver is stored within the hardware itself, as firmware, and totally separate from the operating system. The OS trusted driver needs only be a generic driver that an talk to that class of hardware via a standard interface protocol.
Thunderbolt goes the opposite way, exposing your PCI-E bus to externally connected devices, giving them the same level of trust as internal parts.
Long-time Slashdot reader shanen writes:
Any OS feature that isn't used by a LARGE majority of the users should be REMOVED from the OS.
Yeah... fuck you. Every piece of software is being gimped like crazy to cater to the lowest common denominator, and features I need are being wiped out every day in the name of improving my experience. Microsoft already requires signed drivers, so whatever happened here is purely a political problem, not a technical one.
If Huawei is installing some stupid "helper" that fucks up the machine, I won't buy a Huawei. I'll build the machine myself and use an OEM copy of Windows, just as I have been doing for the last 20+ years. The last thing I want is for Microsoft to lock down the system even more to ensure I have even less control of my machine.
For the record, I stopped upgrading at Win7. I won't touch Win10 with a barge pole.
Please feel free to visit the latest Linux Kernel tree (or any for several years) and audit the code for the included ESXi drivers (memory management and network specifically) as well as the Cisco VIC network and SCSI driver code.
... which include entire built-in processors for SCSI and RDMA... so that you could pretend to be one of the VMs and communicate to anywhere you want and even issue SCSI requests to the SAN directly over network protocols that can't be monitored on Cisco switches.
It took me an average of 3 minutes between finding attack vectors thanks to VMware's half-assed code that should have been completely rewritten years ago. Now, if you can't find a vulnerability using the ESXi drivers in the Linux code base, you probably shouldn't be allowed near a computer.
The Cisco VIC adapter code is so much better... you not only can find endless numbers of vulnerabilities, but you can actually upload entire new operating systems to the VIC adapters in nearly all Cisco servers (especially HyperFlex) and you can even change the boot firmware by disabling authenticity checks in the driver code. The end result being that you could easily permanently place undetectable backdoors that would require hardware replacement to correct into the VIC adapter.
Even better... as a bonus, I'm quite confident that it is possible on VMware from a guest machine using VMFEX network adapters with Cisco VICs, it should be possible to change the hardware firmware of the VIC adapters
None of this is intentional... it's all because no one takes the time to clean up after their own messes.
As to malice, that seems highly unlikely, as this issue would have been better hidden. In particular, the attacker would have made sure these "sensors" do not detect it.
I have to point out that the "sensors" were new, so malice is still an option. Of course there were beta versions of Windows Update 1809 before the actual update came out, a true malicious operator would have had time to attempt an update to the driver to at least hide the side-door.
fwiw, I'll vote for a screwup.
Mielipiteet omiani - Opinions personal, facts suspect.