Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft finds privilege escalation vulnerability in Huawei driver

microsoft.com

Post reply on HN
Print view View original

21–30 of 138 posts

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#21

Post by monocasa »

codeinstyle wrote: post #20
monocasa wrote: post #17

Earlier quoted context omitted.

I mean, it's goofy, hacky, and has obvious security flaws but doesn't look malicious. Calling it a "backdoor" ascribes a certain intentionality to the vulnerability that's not clear is warranted. It's about the code quality I expect from the management shovelware that comes preloaded on laptops from any major brand. Source: I've written kernel drivers and exploits.

From Microsoft’s blog post: Inspecting MateBookService.exe!main revealed a “startup mode” that revived the service if it’s stopped – some sort of watchdog mechanism meant to keep the Huawei PC Manager main service running. I agree that it’s hard to prove malice, but why should any PC management software go out of their way to ensure that it never gets shut down?

...because it's the hardware management service and if it goes down you're no longer managing the hardware?

Like this stuff is usually designed by EEs and they love their watchdogs at all levels. Having a watchdog is very standard for this stuff.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#22

Post by walrus01 »

msie wrote: post #4

Backdoor is such a loaded word to use for a vulnerability. Especially since Huawei is involved. Shame on the person who came up with the title and the reporter who uses the term in the article.

Without stating a judgment one way or the other on the organization...

Epoch times is run by Falun Gong.

The Chinese official government line is that Falun Gong is an extremely dangerous cult that should be repressed. I've seen people on the English language internet intentionally comparing it to Jim Jones, David Koresh, etc.

In reality it seems to be more like a Chinese version of Scientology.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#23

Post by stefan_ »

_cs2017_ wrote: post #15
stefan_ wrote: post #8

Earlier quoted context omitted.

There is no valid reason, ever, for a driver to do what the Huawei driver did here. That should be obvious given the detection methods that Microsoft implemented in the kernel to find and prevent just this behavior. The Microsoft blog might stop short of calling it malware, but I think we don't need the faux politeness here. The fact that their malware also contained a privilege escalation (the "vulnerability") is me…

Since you make a very strong claim on a very complex topic, would you mind if I asked you to share whether you have expertise / credentials on drivers and security? Edit: I'm not sure if it's considered appropriate to ask for credentials on HN. There's one way to find out :)

What is so complex about it? This is a very simple code injection technique ported to kernel space. Only, of course, there is essentially no use for code injection in any sort of production software.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#24

Post by [deleted] »

stefan_ wrote: post #23
_cs2017_ wrote: post #15

Earlier quoted context omitted.

Since you make a very strong claim on a very complex topic, would you mind if I asked you to share whether you have expertise / credentials on drivers and security? Edit: I'm not sure if it's considered appropriate to ask for credentials on HN. There's one way to find out :)

What is so complex about it? This is a very simple code injection technique ported to kernel space. Only, of course, there is essentially no use for code injection in any sort of production software.

[deleted]

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#25

Post by monocasa »

noir_lord wrote: post #19
monocasa wrote: post #17

Earlier quoted context omitted.

I mean, it's goofy, hacky, and has obvious security flaws but doesn't look malicious. Calling it a "backdoor" ascribes a certain intentionality to the vulnerability that's not clear is warranted. It's about the code quality I expect from the management shovelware that comes preloaded on laptops from any major brand. Source: I've written kernel drivers and exploits.

On the other hand a reliable backdoor that also looks like sloppy code is better, as most of us are familiar with truly awful code it’s a nice layer of plausible deniability. As the full saying goes. Never attribute to malice what can be explained by stupidity...but don’t rule out malice.

By that logic we should be calling all vulnerabilities "backdoors" just in case.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#26

Post by pbhjpbhj »

From scanning the page it sounds like Huawei used a hack to make their MateBookService unkillable, unremovable, by unhooking in to services.exe. That in the process of that they left the possibility that the device they were using HwOs.*\.sys was only protected from being used by checking the program had the right path, thus leaving it open to crackers (it being basically g+rw) to use to get the ring-0 permissions needed to run the "stay resident"-type hack Huawei were using. And that in turn meant a process could overwrite MateBookService and gain it's own privelege escalation??

Am I close, if so: is there evidence that Huawei were using that access maliciously or was it just "to make sure their 'management software' retained it's place in the OS"??

We're talking about computers manufactured by Huawei here? Surely they can run code at a far lower level, is this MS and Huawei fighting over which of them "owns" the users computer?

[Slight aside: The MS page reads a lot like an advert. Nice link through to a page that itself has "start trial or buy" up top above the hero shot. Name drops some big vulns, Wannacry, DoublePulsar. Devalues the piece IMO because it seems the reason for them doing the work is solely to create an advert.]

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#27

Post by peteradio »

monocasa wrote: post #25
noir_lord wrote: post #19

Earlier quoted context omitted.

On the other hand a reliable backdoor that also looks like sloppy code is better, as most of us are familiar with truly awful code it’s a nice layer of plausible deniability. As the full saying goes. Never attribute to malice what can be explained by stupidity...but don’t rule out malice.

By that logic we should be calling all vulnerabilities "backdoors" just in case.

Perhaps you should because the end result is the same, shit code sinks ships. Somebody could have written it intentionally or somebody could have been a dumbshit. Doesn't matter to me because now my computer is compromised.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#28

Post by threeseed »

xxpor wrote: post #7
msie wrote: post #4

Backdoor is such a loaded word to use for a vulnerability. Especially since Huawei is involved. Shame on the person who came up with the title and the reporter who uses the term in the article.

The Epoch Times is run by Falun Gong so they have an anti-Chinese government slant.

Pretty sure it's not anti-Chinese government.

It's the anti-"current Chinese policy" and the way it treat dissidents, minorities, journalists etc.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#29

Post by mehrdadn »

codeinstyle wrote: post #20
monocasa wrote: post #17

Earlier quoted context omitted.

I mean, it's goofy, hacky, and has obvious security flaws but doesn't look malicious. Calling it a "backdoor" ascribes a certain intentionality to the vulnerability that's not clear is warranted. It's about the code quality I expect from the management shovelware that comes preloaded on laptops from any major brand. Source: I've written kernel drivers and exploits.

From Microsoft’s blog post: Inspecting MateBookService.exe!main revealed a “startup mode” that revived the service if it’s stopped – some sort of watchdog mechanism meant to keep the Huawei PC Manager main service running. I agree that it’s hard to prove malice, but why should any PC management software go out of their way to ensure that it never gets shut down?

Not commenting any way on the particular issue at hand, but to respond to your general question:

> why should any PC management software go out of their way to ensure that it never gets shut down?

The Windows 10 kernel itself goes out of its way to make sure the Windows update service isn't permanently shut down.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#30

Post by stefan_ »

monocasa wrote: post #17
stefan_ wrote: post #8

Earlier quoted context omitted.

There is no valid reason, ever, for a driver to do what the Huawei driver did here. That should be obvious given the detection methods that Microsoft implemented in the kernel to find and prevent just this behavior. The Microsoft blog might stop short of calling it malware, but I think we don't need the faux politeness here. The fact that their malware also contained a privilege escalation (the "vulnerability") is me…

I mean, it's goofy, hacky, and has obvious security flaws but doesn't look malicious. Calling it a "backdoor" ascribes a certain intentionality to the vulnerability that's not clear is warranted. It's about the code quality I expect from the management shovelware that comes preloaded on laptops from any major brand. Source: I've written kernel drivers and exploits.

What is not malicious about a driver whose pure function (this thing literally has no other value or purpose) is maintaining an invincible NT_AUTHORITY process of their pre-installed management software? And achieving that by allocating a RWX page in services.exe? What are we even doing W^X for?

Maybe we have different expectations of what a driver is. Take a look for yourself, even the updated PC Manager Software on their website still has the driver with the goofy shellcode in its installer (no idea if it's just not loaded now):

https://consumer.huawei.com/us/support/pc/matebook-x-pro/

Post reply on HN