Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Skype can't fix a nasty security bug without a massive code rewrite

zdnet.com

Post reply on HN
Print view View original

51–60 of 99 posts

Re: Skype can't fix a nasty security bug without a massive code rewrite

#51

Post by ocdtrekkie »

vforvangelis wrote: post #45

An interim solution could be to install the UWP Skype app from the Store. I don't think it relies on Updater.exe for patches.

Yeah, the article seems to fail to mention that the current version of Windows, which almost everyone had two years to upgrade to for free, has a version of Skype that isn't vulnerable. Given that Windows 10 has been out since 2015, and everyone with a Windows license going back to 2009 had a free upgrade path, failing to mention that Skype on Windows 10 (they don't recommend classic Skype for Windows 10 users) isn't vulnerable borders on the FUD barrier.

Re: Skype can't fix a nasty security bug without a massive code rewrite

#52

Post by user5454 »

enzanki_ars wrote: post #39
user5454 wrote: post #9

From the disclosure ( http://seclists.org/fulldisclosure/2018/Feb/33 ): > An unprivileged (local) user who is able to place UXTheme.dll or any of the other DLLs loaded by the vulnerable executable in %SystemRoot%\Temp\ gains escalation of privilege to the SYSTEM account. On my machine at least an unprivileged user does not have access to %SystemRoot%\Temp\ so it seems to be a case of what Raymond Chen refers to as "o…

I need to test this later as I only have access to an unprivileged account at the moment, but based on comments online ( https://stackoverflow.com/a/11917816 ), C:\Windows\Temp (%systemroot%\Temp redirects here, and is the folder Skype accesses from, is write only for unprivileged users (FILE_ADD_FILE). Preliminary testing shows that I was able to write there with out any problem. No way for me to read it at the mome…

You're right. It is possible to write a file but not to list or access any other files. So it is a security bug. You could "fix" it yourself though, by using a privileged account and copy any DLLs loaded by the Skype updater into the directory.. An unprivileged user would not be able to overwrite the files.

Re: Skype can't fix a nasty security bug without a massive code rewrite

#53

Post by sp332 »

cptskippy wrote: post #15
enzanki_ars wrote: post #2

I must be missing something obvious here. Why can’t skype just hard code the locations and hashes of the dll files it needs to load? Why is Skype loading random DLLs from user accessible folders? I must be misunderstanding how Windows programs use DLLs and why it needs to just search for them. Edit: @jwilk in the comments here pointed to a better article about the security vulnerability [1]. Based on the technical de…

> A couple of lines to fix the bug, in theory Yes that's all it takes. No code reviews, security review, integration testing, quality assurance testing, compatibility testing, or validation. None of the work on the installer or updater. No release notes or other communication to the community. Just a couple lines of code. Easily done before morning coffee.

I think this is a response to the headline, which specifically mentions a "massive code rewrite".

Re: Skype can't fix a nasty security bug without a massive code rewrite

#55

Post by _jal »

brazzledazzle wrote: post #11
enzanki_ars wrote: post #2

I must be missing something obvious here. Why can’t skype just hard code the locations and hashes of the dll files it needs to load? Why is Skype loading random DLLs from user accessible folders? I must be misunderstanding how Windows programs use DLLs and why it needs to just search for them. Edit: @jwilk in the comments here pointed to a better article about the security vulnerability [1]. Based on the technical de…

It would be interesting to see Google Project Zero’s take on it. It’s a shame they didn’t discover it because I’m sure the back and forth between them and the Skype devs would have been really interesting.

PZ almost certainly is aware of at least the general issue - Windows DDL hijacking posts hit the Full Disclosure list pretty much weekly. It is a very well-known issue, at least among those who subscribe to security lists, approaching dead-horse status.

Re: Skype can't fix a nasty security bug without a massive code rewrite

#56

Post by sodapopcan »

cptskippy wrote: post #15
enzanki_ars wrote: post #2

I must be missing something obvious here. Why can’t skype just hard code the locations and hashes of the dll files it needs to load? Why is Skype loading random DLLs from user accessible folders? I must be misunderstanding how Windows programs use DLLs and why it needs to just search for them. Edit: @jwilk in the comments here pointed to a better article about the security vulnerability [1]. Based on the technical de…

> A couple of lines to fix the bug, in theory Yes that's all it takes. No code reviews, security review, integration testing, quality assurance testing, compatibility testing, or validation. None of the work on the installer or updater. No release notes or other communication to the community. Just a couple lines of code. Easily done before morning coffee.

"Can't you just..."

Re: Skype can't fix a nasty security bug without a massive code rewrite

#57

Post by saurik »

Tiki wrote: post #35
chaz6 wrote: post #8

Earlier quoted context omitted.

The cynic in me thinks this is already known and is in use by a "strategic partner" as a vector. The next version will only make it harder to find and exploit.

Your comment reminded me of this: https://notepad-plus-plus.org/news/notepad-7.3.3-fix-cia-hac... I doubt this was intentional at first, but the fact that they don't want to fix it is very fishy.

That is a very different issue, as there the concept is that the original file in the original location is being replaced. As is stated in that post, at that point the person could just as easily replace the program itself with a modified version of the entire program. That is not a security issue in the software.

Re: Skype can't fix a nasty security bug without a massive code rewrite

#59

Post by bernardino »

shlant wrote: post #40
pier25 wrote: post #26

The new Skype version has been terrible, at least on macOS. What are some good alternatives that offer group calls and screen sharing?

The new Skype is so bad, we joke that it must be malware. The design was bad already, but holy eyesore. At least the MacOS version works. On android, when I log in as my account, the only contacts I have are those from my sisters account (???) and none of my subscriptions are there so I can't even make calls that require Skype credit even though my account has credit. I had to add my wife as a contact and none of my…

I wonder what the engineering team is doing over at Skype HQ. I can't even see my message history with the latest overhaul/update. I would migrate to a new platform but most of my friends are already on Skype, thus migrating to another would be a hassle.

Re: Skype can't fix a nasty security bug without a massive code rewrite

#60

Post by enzanki_ars »

user5454 wrote: post #52
enzanki_ars wrote: post #39

Earlier quoted context omitted.

I need to test this later as I only have access to an unprivileged account at the moment, but based on comments online ( https://stackoverflow.com/a/11917816 ), C:\Windows\Temp (%systemroot%\Temp redirects here, and is the folder Skype accesses from, is write only for unprivileged users (FILE_ADD_FILE). Preliminary testing shows that I was able to write there with out any problem. No way for me to read it at the mome…

You're right. It is possible to write a file but not to list or access any other files. So it is a security bug. You could "fix" it yourself though, by using a privileged account and copy any DLLs loaded by the Skype updater into the directory.. An unprivileged user would not be able to overwrite the files.

Not sure, but based on the image in the stackoverflow link, it states that it has FILE_ADD_FILE, which translates in the GUI to “Create files / write data,” which I would assume means that overwrites are possible. Don’t trust my word on that though as I am no expert. Will try that a bit later and see what happens.
Post reply on HN