Google's Project Zero exposes unpatched Windows 10 lockdown bypass • Hacker News Board

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#21

Post by pg_bot » Sat, Apr 21, 2018, 7:59 AM UTC

s2g wrote: post #17

pg_bot wrote: post #13

Earlier quoted context omitted.

3 months is more than enough time if you care about your customer's privacy and security.

YOu are talking about a very large, complex, mission critical, and incredibly widely used piece of software. If they mess up a patch it's a big deal. If they break systems, introduce further bugs, etc... 90 days to understand the problem, fix the bug, verify the fix, plan the release, get it out to customers. There is a lot of work involved in such a thing.

Correct there is a lot of work to be done. It is not 90 days worth of work. If you think that is not enough time, you need to raise your standards.

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#22

Post by cesis » Sat, Apr 21, 2018, 8:09 AM UTC

andrewguenther wrote: post #19

To people calling this a dick move by Google, I encourage you to look at the actual issue in Monorail. The reason given for not extending the deadline was that the issue is not particularly severe, and there are also similar bypass issues which are currently unpatched. If it isn't going to help protect customers, what's the point in granting an exception? https://bugs.chromium.org/p/project-zero/issues/detail?id=15..…

My thinking would be exactly the opposite - severe bugs have to be disclosed sooner while non-severe can be left lingering around.

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#23

Post by Buge » Sat, Apr 21, 2018, 8:09 AM UTC

dingo_bat wrote: post #16

jhall1468 wrote: post #12

Earlier quoted context omitted.

First of all, Google has no responsibility to give any period of time. It isn't a "dick move". Second, the researcher in question: 1) Never gave a required date for disclosure. 2) Upon requesting the right to disclose, was told no and he followed suit. 3) Was initially offered a bug bounty of $1300, which was upgraded to $5000. He apparently never bartered on that issue at all. So your entire post was completely irre…

> First of all, Google has no responsibility to give any period of time. Any security researcher has a responsibility to disclose a vulnerability in such a way that it does not cause widespread damage. I don't know why you would think otherwise.

Not everyone agrees with you. Some people promote full disclosure.

>Full disclosure is the policy of publishing information on vulnerabilities without restriction as early as possible, making the information accessible to the general public without restriction. In general, proponents of full disclosure believe that the benefits of freely available vulnerability research outweigh the risks, whereas opponents prefer to limit the distribution.

https://en.wikipedia.org/wiki/Full_disclosure_(computer_secu...

https://hn.algolia.com/?query=author:tptacek%20responsible%2...

https://news.ycombinator.com/item?id=16579292

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#24

Post by alkonaut » Sat, Apr 21, 2018, 8:17 AM UTC

saagarjha wrote: post #6

avttre wrote: post #4

Why 90 days? Why not 30, 14, or 7? Microsoft might have requested responsible disclosure for exploits affecting Windows, but what gave Google the right to set a deadline? I feel the 2 US companies have a friendly competition with each other which can help secure their systems.

Nobody has any right to set a deadline. The 90 days is merely Google being courteous.

For a bug that should take no more than a few days to patch and test 90 days seems like more than enough for a product with automatic security updates.

For a bug with completely unknown scope and very difficult fixes (such as the recent intel issues) the story might be different. But 90 days here? Why would Microsoft need more than that?

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#25

Post by campuscodi » Sat, Apr 21, 2018, 8:20 AM UTC

saagarjha wrote: post #5

ge0rg wrote: post #2

Original source: https://bugs.chromium.org/p/project-zero/issues/detail?id=15...

Could someone who’s more knowledgeable about how Windows works than I am provide a semi-technical explanation of how this works?

Yeah. It's not as severe as the article makes it seem. It's just a bypass in a very insignificant component for which you need 2-3 other vulns to exploit.

I presume the editor just wanted to put an article out with Microsoft and Project Zero in the title, rather than analyze the actual flaw in the context of its severity.

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#26

Post by Buge » Sat, Apr 21, 2018, 8:22 AM UTC

avttre wrote: post #4

Why 90 days? Why not 30, 14, or 7? Microsoft might have requested responsible disclosure for exploits affecting Windows, but what gave Google the right to set a deadline? I feel the 2 US companies have a friendly competition with each other which can help secure their systems.

The right to freedom of speech means Google can say what they want when they want about the vulnerability, giving them the right to set a deadline.

There are certainly companies doing much worse than setting 90 day deadlines. For example VUPEN, Hacking Team, and GrayKey selling undisclosed vulnerabilities to "good" governments, and other companies servicing the shadier governments[1].

[1] https://www.bloomberg.com/news/features/2017-01-18/the-post-...

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#27

Post by dewiz » Sat, Apr 21, 2018, 8:22 AM UTC

Google, you have 90 days to stop tracking web users, then Windows will start asking desktop users if they would like to block tracking by filtering DNS requests

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#28

Post by nikic » Sat, Apr 21, 2018, 8:23 AM UTC

The only "dick move" involved here is the fact that zdnet wrote this article. Minor security issue lapses standard disclosure deadline? Who cares. Instead we get this attempt to sensationalize this into some kind of big Google vs. Microsoft rivalry.

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#29

Post by nabc45 » Sat, Apr 21, 2018, 8:28 AM UTC

campuscodi wrote: post #25

saagarjha wrote: post #5

Earlier quoted context omitted.

Could someone who’s more knowledgeable about how Windows works than I am provide a semi-technical explanation of how this works?

Yeah. It's not as severe as the article makes it seem. It's just a bypass in a very insignificant component for which you need 2-3 other vulns to exploit. I presume the editor just wanted to put an article out with Microsoft and Project Zero in the title, rather than analyze the actual flaw in the context of its severity.

A journalist lying. Not particularly noteworthy.

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#30

Post by pjc50 » Sat, Apr 21, 2018, 8:31 AM UTC

saagarjha wrote: post #5

ge0rg wrote: post #2

Original source: https://bugs.chromium.org/p/project-zero/issues/detail?id=15...

Could someone who’s more knowledgeable about how Windows works than I am provide a semi-technical explanation of how this works?

There is a lockdown mode which restricted which COM objects could be instantiated from .net code to a short whitelist.

The whitelist is based on GUID. The lookup of GUID to actual binary is done through the registry.

COM hosting implementations should check that the object they got is the one they asked for. Net doesn't. So if you can write to the registry you can escape the sandbox.