A bug sure, but does anyone really care much about local privilege escalation on Windows? On a system where Skype is installed?
Skype can't fix a nasty security bug without a massive code rewrite
31–40 of 99 posts
Re: Skype can't fix a nasty security bug without a massive code rewrite
#32Earlier quoted context omitted.
> A couple of lines to fix the bug, in theory Yes that's all it takes. No code reviews, security review, integration testing, quality assurance testing, compatibility testing, or validation. None of the work on the installer or updater. No release notes or other communication to the community. Just a couple lines of code. Easily done before morning coffee.
> No code reviews, security review, integration testing, quality assurance testing, compatibility testing, or validation. If this was a small startup, I can absolutely see those being hurdles. This is Microsoft on a product they've had for 20+ years that is a major part of their platform - those things should be mostly automated and well oiled machines. A mature enterprise level company has no excuses for "QA is hard…
I'm guessing if they fix this bug the simple way they break the entire product and the proper way is many months of work (entire eco-system restructure).
Re: Skype can't fix a nasty security bug without a massive code rewrite
#33Earlier quoted context omitted.
> A couple of lines to fix the bug, in theory Yes that's all it takes. No code reviews, security review, integration testing, quality assurance testing, compatibility testing, or validation. None of the work on the installer or updater. No release notes or other communication to the community. Just a couple lines of code. Easily done before morning coffee.
> No code reviews, security review, integration testing, quality assurance testing, compatibility testing, or validation. If this was a small startup, I can absolutely see those being hurdles. This is Microsoft on a product they've had for 20+ years that is a major part of their platform - those things should be mostly automated and well oiled machines. A mature enterprise level company has no excuses for "QA is hard…
Ironically I would comment exactly what you did with, but the roles reversed:
“If this was a small startup I couldn’t see those being hurdles but at a behemoth like MS with an almost 2 decade old product I can.”
Re: Skype can't fix a nasty security bug without a massive code rewrite
#34I must be missing something obvious here. Why can’t skype just hard code the locations and hashes of the dll files it needs to load? Why is Skype loading random DLLs from user accessible folders? I must be misunderstanding how Windows programs use DLLs and why it needs to just search for them. Edit: @jwilk in the comments here pointed to a better article about the security vulnerability [1]. Based on the technical de…
> Why is Skype loading random DLLs from user accessible folders?
%SYSTEMROOT%/Temp doesn't seem to be user-readable at all, so I'm having trouble understanding how you write anything there without already having escalated permissions.
Re: Skype can't fix a nasty security bug without a massive code rewrite
#35Earlier quoted context omitted.
I was just about to come back here and mention that. The article and comments that @stevekemp linked to provided a lot of insight, but as you mentioned, there are ways to prevent exploits of that nature, which the comments in the article point to also. Something still seems to be missing from my understanding of what Skype is doing...
The cynic in me thinks this is already known and is in use by a "strategic partner" as a vector. The next version will only make it harder to find and exploit.
Your comment reminded me of this: https://notepad-plus-plus.org/news/notepad-7.3.3-fix-cia-hac...
I doubt this was intentional at first, but the fact that they don't want to fix it is very fishy.
Re: Skype can't fix a nasty security bug without a massive code rewrite
#36Earlier quoted context omitted.
> A couple of lines to fix the bug, in theory Yes that's all it takes. No code reviews, security review, integration testing, quality assurance testing, compatibility testing, or validation. None of the work on the installer or updater. No release notes or other communication to the community. Just a couple lines of code. Easily done before morning coffee.
> No code reviews, security review, integration testing, quality assurance testing, compatibility testing, or validation. If this was a small startup, I can absolutely see those being hurdles. This is Microsoft on a product they've had for 20+ years that is a major part of their platform - those things should be mostly automated and well oiled machines. A mature enterprise level company has no excuses for "QA is hard…
As a former Microsoft employee, my experience was that the longer a product was around, the harder it was to figure out who understood any part of it well enough to change something.
I would guess I averaged about 10 lines a month on my project that had been around for decades. Making even slight tweaks required dozens of meetings, design discussions, functional and performance testing, etc. etc. It took an eternity.
Re: Skype can't fix a nasty security bug without a massive code rewrite
#37The new Skype version has been terrible, at least on macOS. What are some good alternatives that offer group calls and screen sharing?
https://jitsi.org/
Surprisingly good. No account required, no limit on number of people, good screen sharing, works everywhere(because web-based).
Re: Skype can't fix a nasty security bug without a massive code rewrite
#38I must be missing something obvious here. Why can’t skype just hard code the locations and hashes of the dll files it needs to load? Why is Skype loading random DLLs from user accessible folders? I must be misunderstanding how Windows programs use DLLs and why it needs to just search for them. Edit: @jwilk in the comments here pointed to a better article about the security vulnerability [1]. Based on the technical de…
> Why is Skype loading random DLLs from user accessible folders? %SYSTEMROOT%/Temp doesn't seem to be user-readable at all, so I'm having trouble understanding how you write anything there without already having escalated permissions.
I need to test this later as I only have access to an unprivileged account at the moment, but based on comments online (https://stackoverflow.com/a/11917816), the folder is write only for unprivileged users (FILE_ADD_FILE).
Re: Skype can't fix a nasty security bug without a massive code rewrite
#39From the disclosure ( http://seclists.org/fulldisclosure/2018/Feb/33 ): > An unprivileged (local) user who is able to place UXTheme.dll or any of the other DLLs loaded by the vulnerable executable in %SystemRoot%\Temp\ gains escalation of privilege to the SYSTEM account. On my machine at least an unprivileged user does not have access to %SystemRoot%\Temp\ so it seems to be a case of what Raymond Chen refers to as "o…
I need to test this later as I only have access to an unprivileged account at the moment, but based on comments online (https://stackoverflow.com/a/11917816), C:\Windows\Temp (%systemroot%\Temp redirects here, and is the folder Skype accesses from, is write only for unprivileged users (FILE_ADD_FILE).
Preliminary testing shows that I was able to write there with out any problem. No way for me to read it at the moment though...
Edit: As noted by another user here, yes, it is writeable. https://news.ycombinator.com/item?id=16367722
Re: Skype can't fix a nasty security bug without a massive code rewrite
#40The new Skype version has been terrible, at least on macOS. What are some good alternatives that offer group calls and screen sharing?
The new Skype is so bad, we joke that it must be malware. The design was bad already, but holy eyesore. At least the MacOS version works.
On android, when I log in as my account, the only contacts I have are those from my sisters account (???) and none of my subscriptions are there so I can't even make calls that require Skype credit even though my account has credit. I had to add my wife as a contact and none of my chat history with her showed up. As close to unusable as it comes...