31–40 of 138 posts
Like printer drivers they seem to be badly coded messes that create attack surfaces.
For a typical laptop everything except bios updates can be got straight from the vendor of the component.
I'm surprised microsoft haven't started distributing stuff like GPU, Chipset and other drivers themselves.
Backdoor is such a loaded word to use for a vulnerability. Especially since Huawei is involved. Shame on the person who came up with the title and the reporter who uses the term in the article.
Without stating a judgment one way or the other on the organization... Epoch times is run by Falun Gong. The Chinese official government line is that Falun Gong is an extremely dangerous cult that should be repressed. I've seen people on the English language internet intentionally comparing it to Jim Jones, David Koresh, etc. In reality it seems to be more like a Chinese version of Scientology.
From scanning the page it sounds like Huawei used a hack to make their MateBookService unkillable, unremovable, by unhooking in to services.exe. That in the process of that they left the possibility that the device they were using HwOs.*\.sys was only protected from being used by checking the program had the right path, thus leaving it open to crackers (it being basically g+rw) to use to get the ring-0 permissions ne…
It's still ironic that Huawei get's some free audit for their stuff now and it's sold as they are bad, while everything is terrible - I won't install Logitech software after this epic bug here: https://bugs.chromium.org/p/project-zero/issues/detail?id=16...
Earlier quoted context omitted.
The Epoch Times is run by Falun Gong so they have an anti-Chinese government slant.
Pretty sure it's not anti-Chinese government. It's the anti-"current Chinese policy" and the way it treat dissidents, minorities, journalists etc.
From scanning the page it sounds like Huawei used a hack to make their MateBookService unkillable, unremovable, by unhooking in to services.exe. That in the process of that they left the possibility that the device they were using HwOs.*\.sys was only protected from being used by checking the program had the right path, thus leaving it open to crackers (it being basically g+rw) to use to get the ring-0 permissions ne…
I guess it's because Defender ATP is basically some kind of cloud-service for security and because everyone is running Windows for everything it's targeted at managers or so. I have no idea how useful it is, but I guess they have some advanced techniques to detect certain attacks (like this one, or the dropped DoublePulsar) - If you have to defend some important Active Directory Setup it's probably not a bad deal. It…
MS must have written a huge exposé on that one, can't seem to find it on their Security site though.
Is there any value in these driver add-on tools that manufacturers ship? Like printer drivers they seem to be badly coded messes that create attack surfaces. For a typical laptop everything except bios updates can be got straight from the vendor of the component. I'm surprised microsoft haven't started distributing stuff like GPU, Chipset and other drivers themselves.
Earlier quoted context omitted.
From Microsoft’s blog post: Inspecting MateBookService.exe!main revealed a “startup mode” that revived the service if it’s stopped – some sort of watchdog mechanism meant to keep the Huawei PC Manager main service running. I agree that it’s hard to prove malice, but why should any PC management software go out of their way to ensure that it never gets shut down?
...because it's the hardware management service and if it goes down you're no longer managing the hardware? Like this stuff is usually designed by EEs and they love their watchdogs at all levels. Having a watchdog is very standard for this stuff.
I’m no expert on device drivers but to my knowledge, Windows already allows you to manage devices and install drivers through Device Managers.
Then if drivers are already installed for the various devices and hardware components, what exactly is the hardware management service managing on top of the individual drivers?
I am asking this as the only plausible reason to be doing this (at least for me) is if Windows isn’t providing enough tools for device management that needs coordination between the hardware components on the machine, so I would appreciate someone with more knowledge to shed some light on the subject.
Earlier quoted context omitted.
There is no valid reason, ever, for a driver to do what the Huawei driver did here. That should be obvious given the detection methods that Microsoft implemented in the kernel to find and prevent just this behavior. The Microsoft blog might stop short of calling it malware, but I think we don't need the faux politeness here. The fact that their malware also contained a privilege escalation (the "vulnerability") is me…
Really? Because MS and others have stated what Huawei did here isn't unheard of. This is simply news because it's Huawei and many want them to be guilty of backdooring US entities. Perhaps they are, but no more many other "respected" US companies.
Earlier quoted context omitted.
There is no valid reason, ever, for a driver to do what the Huawei driver did here. That should be obvious given the detection methods that Microsoft implemented in the kernel to find and prevent just this behavior. The Microsoft blog might stop short of calling it malware, but I think we don't need the faux politeness here. The fact that their malware also contained a privilege escalation (the "vulnerability") is me…
I mean, it's goofy, hacky, and has obvious security flaws but doesn't look malicious. Calling it a "backdoor" ascribes a certain intentionality to the vulnerability that's not clear is warranted. It's about the code quality I expect from the management shovelware that comes preloaded on laptops from any major brand. Source: I've written kernel drivers and exploits.
Plausible deniability. If you were to implement a backdoor for a company, would you write "professionally done" all over it?
Earlier quoted context omitted.
By that logic we should be calling all vulnerabilities "backdoors" just in case.
Perhaps you should because the end result is the same, shit code sinks ships. Somebody could have written it intentionally or somebody could have been a dumbshit. Doesn't matter to me because now my computer is compromised.