Live data from Hacker News

A Windows Defender bug was so gaping its PoC exploit had to be encrypted

arstechnica.com

31–40 of 41 posts

Re: A Windows Defender bug was so gaping its PoC exploit had to be encrypted

#31
post #21
post #12

Earlier quoted context omitted.

Or a testament to how little the industry actually cares about security once you ask them to actually put their money on the line. Windows Defender was new in windows 10; there is no conceivable justification for using the kind of programming language that leads to this kind of vulnerability. But, here we are.

Windows Defender has been around since Vista (XP, if you include systems it didn't ship with). More important than that nitpick - do you really see no conceivable justification for using C++? Really? None? The entire language is unsuitable for new development? And somehow, you captured this insight which managed to be overlooked by all the engineers working at Microsoft? What do you suggest we do? Gather the whole wo…

While I agree with much of your response I specifically disagree with the notion that a single person on the outside cannot identify a problem with the decision making of an insular group.

Many people in microsoft seem to be thoroughly stuck in the microsoft way of doing things even when not ideal. How many COM objects did they for years after COM was dead? For how long did they ignore the concept of an AST during parsing of C++? Even in msvc2015 rev 3 you can't reliably turn this feature on for even a moderately sized codebase, but it is the default for GCC and Clang and has been for years. There might be a lot of smart people as microsoft, but they are often isolated from cutting edge ideas or squashed by bureaucracy.

I even really like C++, but perhaps for a security product that isn't particularly performance sensitive something else would have been better. It doesn't seem to run all the time like other AV products and just at the boundaries where information can get in and out this means it does a lot less work and has looser performance constraints, perhaps they could have used C# another in house languages.

Re: A Windows Defender bug was so gaping its PoC exploit had to be encrypted

#34
post #30
post #21

Earlier quoted context omitted.

Windows Defender has been around since Vista (XP, if you include systems it didn't ship with). More important than that nitpick - do you really see no conceivable justification for using C++? Really? None? The entire language is unsuitable for new development? And somehow, you captured this insight which managed to be overlooked by all the engineers working at Microsoft? What do you suggest we do? Gather the whole wo…

> The entire language is unsuitable for new development? Yes. > And somehow, you captured this insight which managed to be overlooked by all the engineers working at Microsoft? Apparently. Astonishing that they didn't, but the fact that they managed to ship this bug is already astonishing, so any explanation of how that happened will also be astonishing. > What do you suggest we do? Gather the whole world, hold hands…

There really aren't any codebases the size of Linux or Windows written in those languages. I'm not saying that there couldn't be, but there isn't currently. There is also a great deal of effort being put into making C++ more robust.

When there finally are large codebases written in Rust, it will be apparent that there are still some of the same issues.

I think that I agree with you though that there may not be real cases where GC won't work anymore.

Re: A Windows Defender bug was so gaping its PoC exploit had to be encrypted

#35

> This full system x86 emulator runs as SYSTEM, is unsandboxed, is enabled by default and remotely accessible to attackers. Can anyone more familiar with these issues tell me why Microsoft is still running this stuff as SYSTEM? Seeing as Tavis has been poking holes in the same component for a couple of months now, I assume it's a design choice and there has to be some good reason for it. Right?

For defender to be able to do the kinds of things that AV does it has to run as system. Once you are running as SYSTEM what does "sandboxing" even mean?

Re: A Windows Defender bug was so gaping its PoC exploit had to be encrypted

#37

> Asked if Microsoft had previously fuzzed the Windows Defender component, a company representative said yes. > "Fuzzing is one of a number of techniques we employ to update and strengthen our software," the representative said in an e-mail. "It is a standard practice we use as part of the Security Development Lifecyle for our products." This journalist is naive. This answer says "sure we use fuzzing, but we have no…

That's awfully cynical. The answer they got is more indicative of the fact that they're talking to a representative rather than one of the engineers who would have actually been responsible for fuzzing it, so all the representative can really do is say what the policy is rather than answer the specific question of "was this particular component fuzzed"?

Re: A Windows Defender bug was so gaping its PoC exploit had to be encrypted

#38
post #37

> Asked if Microsoft had previously fuzzed the Windows Defender component, a company representative said yes. > "Fuzzing is one of a number of techniques we employ to update and strengthen our software," the representative said in an e-mail. "It is a standard practice we use as part of the Security Development Lifecyle for our products." This journalist is naive. This answer says "sure we use fuzzing, but we have no…

That's awfully cynical. The answer they got is more indicative of the fact that they're talking to a representative rather than one of the engineers who would have actually been responsible for fuzzing it, so all the representative can really do is say what the policy is rather than answer the specific question of "was this particular component fuzzed"?

We live in a society presently governed by anarchic advertising and mass-hypnosis. Cynical is called-for.

Re: A Windows Defender bug was so gaping its PoC exploit had to be encrypted

#39
post #21
post #12

Earlier quoted context omitted.

Or a testament to how little the industry actually cares about security once you ask them to actually put their money on the line. Windows Defender was new in windows 10; there is no conceivable justification for using the kind of programming language that leads to this kind of vulnerability. But, here we are.

Windows Defender has been around since Vista (XP, if you include systems it didn't ship with). More important than that nitpick - do you really see no conceivable justification for using C++? Really? None? The entire language is unsuitable for new development? And somehow, you captured this insight which managed to be overlooked by all the engineers working at Microsoft? What do you suggest we do? Gather the whole wo…

> The entire language is unsuitable for new development?

Arguably, yes. Look at the outcome: a component specifically intended to improve system security has been found to have multiple extremely severe vulnerabilities. If Microsoft can't write memory-safe C++ code, even with PREfix at their disposal, maybe high-privilege code shouldn't be written in C++.

Post reply on HN