Skype can't fix a nasty security bug without a massive code rewrite

Post by user5994461 » Tue, Feb 13, 2018, 7:37 PM UTC

latencyloser wrote: post #36

vorpalhex wrote: post #28

Earlier quoted context omitted.

> No code reviews, security review, integration testing, quality assurance testing, compatibility testing, or validation. If this was a small startup, I can absolutely see those being hurdles. This is Microsoft on a product they've had for 20+ years that is a major part of their platform - those things should be mostly automated and well oiled machines. A mature enterprise level company has no excuses for "QA is hard…

As a former Microsoft employee, my experience was that the longer a product was around, the harder it was to figure out who understood any part of it well enough to change something. I would guess I averaged about 10 lines a month on my project that had been around for decades. Making even slight tweaks required dozens of meetings, design discussions, functional and performance testing, etc. etc. It took an eternity.

Post by Kipters » Tue, Feb 13, 2018, 7:44 PM UTC

Post by amag » Tue, Feb 13, 2018, 8:51 PM UTC

enzanki_ars wrote: post #60

user5454 wrote: post #52

Earlier quoted context omitted.

You're right. It is possible to write a file but not to list or access any other files. So it is a security bug. You could "fix" it yourself though, by using a privileged account and copy any DLLs loaded by the Skype updater into the directory.. An unprivileged user would not be able to overwrite the files.

Not sure, but based on the image in the stackoverflow link, it states that it has FILE_ADD_FILE, which translates in the GUI to “Create files / write data,” which I would assume means that overwrites are possible. Don’t trust my word on that though as I am no expert. Will try that a bit later and see what happens.

Post by paulddraper » Tue, Feb 13, 2018, 9:11 PM UTC

joshumax wrote: post #77

EnFinlay wrote: post #72

Earlier quoted context omitted.

I'm far from an expert, but my guess is that the quote > "Windows provides multiple ways to do it," he said. But DLL hijacking isn't limited to Windows, he said -- noting that it can apply to Macs and Linux, too. is an artifact of the reporting, and not worth head scratching about. The exploit would look completely different on Mac or Linux. As far as I know.

I was about to say this. My Debian machine updates software through apt + dpkg, and I installed Skype via the Skype repository. Why would Skype for Linux then choose to bundle its own updater, thereby breaking the integrity a package manager provides?

Post by taspeotis » Tue, Feb 13, 2018, 9:39 PM UTC

Amezarak wrote: post #30

taspeotis wrote: post #13

Earlier quoted context omitted.

I believe the default permissions for a volume grant users the ability to create folders, so they should be able to create a folder in C: called Temp and put files into it. It’s also possible that when Skype’s updater creates the folder it has different ACLs.

%SYSTEMROOT% is C:\Windows, not C:\. I too cannot access C:\Windows\Temp at all without escalating permissions. Neither can I write to anything in C:\Windows as described in the original source without escalated permissions. I'm a little puzzled about what would stop someone with the same permissions from doing exactly the same thing with the fully qualified name.