Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft finds privilege escalation vulnerability in Huawei driver

microsoft.com

Post reply on HN
Print view View original

51–60 of 138 posts

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#51

Post by rujuladanh »

_cs2017_ wrote: post #15
stefan_ wrote: post #8

Earlier quoted context omitted.

There is no valid reason, ever, for a driver to do what the Huawei driver did here. That should be obvious given the detection methods that Microsoft implemented in the kernel to find and prevent just this behavior. The Microsoft blog might stop short of calling it malware, but I think we don't need the faux politeness here. The fact that their malware also contained a privilege escalation (the "vulnerability") is me…

Since you make a very strong claim on a very complex topic, would you mind if I asked you to share whether you have expertise / credentials on drivers and security? Edit: I'm not sure if it's considered appropriate to ask for credentials on HN. There's one way to find out :)

A driver allowing to map any page is like recording a magician from all angles.

The only reasonable usage of such a situation is for the magician him/herself, to study his/her own performance. And even then, it is not usually done that way.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#52

Post by monocasa »

rujuladanh wrote: post #51
_cs2017_ wrote: post #15

Earlier quoted context omitted.

Since you make a very strong claim on a very complex topic, would you mind if I asked you to share whether you have expertise / credentials on drivers and security? Edit: I'm not sure if it's considered appropriate to ask for credentials on HN. There's one way to find out :)

A driver allowing to map any page is like recording a magician from all angles. The only reasonable usage of such a situation is for the magician him/herself, to study his/her own performance. And even then, it is not usually done that way.

There's a lot of situations where you map in trampolines to perform work inside a process on behalf of that process.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#53

Post by kiwijamo »

allset_ wrote: post #36
Jonnax wrote: post #31

Is there any value in these driver add-on tools that manufacturers ship? Like printer drivers they seem to be badly coded messes that create attack surfaces. For a typical laptop everything except bios updates can be got straight from the vendor of the component. I'm surprised microsoft haven't started distributing stuff like GPU, Chipset and other drivers themselves.

With Win10 they do ship those drivers through Windows updates.

They’ve done it for previous versions as well. I think that practice goes back to Vista at the very least.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#54

Post by flukus »

msie wrote: post #4

Backdoor is such a loaded word to use for a vulnerability. Especially since Huawei is involved. Shame on the person who came up with the title and the reporter who uses the term in the article.

I'm all for assuming incompetence over maliciousness, but that requires a certain amount of goodwill and trust toward the perpetrator, which is something Huawei doesn't have.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#55

Post by yourbandsucks »

verall wrote: post #49
murderfs wrote: post #6

Earlier quoted context omitted.

The Epoch Times is a Falun Gong propaganda arm, and Falun Gong is basically Chinese Scientology that the CCP has been trying to stamp out.

What? Maybe the Epoch Times is biased, but the Falun Gong is nothing like scientology: it has no fees and isn't trying to coerce anyone to join. It's a minority group that is persecuted by the CCP.

What kind of minority group?

They're religious kooks. That doesn't mean they deserve to be stamped out, necessarily, but they're also not a "minority group" by the common definition of the term.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#56

Post by hojjat12000 »

Jonnax wrote: post #31

Is there any value in these driver add-on tools that manufacturers ship? Like printer drivers they seem to be badly coded messes that create attack surfaces. For a typical laptop everything except bios updates can be got straight from the vendor of the component. I'm surprised microsoft haven't started distributing stuff like GPU, Chipset and other drivers themselves.

I have a Matebook D. The manager is useful to update your drivers all at once (plus your bios too). It's the only program that comes with the laptop, so no bloatware. I've been happy with the laptop, and I don't think there is any malice here, just a stupid mistake, that they already have fixed it.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#57

Post by bsder »

monocasa wrote: post #25
noir_lord wrote: post #19

Earlier quoted context omitted.

On the other hand a reliable backdoor that also looks like sloppy code is better, as most of us are familiar with truly awful code it’s a nice layer of plausible deniability. As the full saying goes. Never attribute to malice what can be explained by stupidity...but don’t rule out malice.

By that logic we should be calling all vulnerabilities "backdoors" just in case.

Freetype buffer overflow leads to privilege escalataion.

All code is security code.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#58

Post by colordrops »

padiyar83 wrote: post #50
stefan_ wrote: post #8

Earlier quoted context omitted.

There is no valid reason, ever, for a driver to do what the Huawei driver did here. That should be obvious given the detection methods that Microsoft implemented in the kernel to find and prevent just this behavior. The Microsoft blog might stop short of calling it malware, but I think we don't need the faux politeness here. The fact that their malware also contained a privilege escalation (the "vulnerability") is me…

Hanlon's razor - Never attribute to malice that which is adequately explained by stupidity.

Hanlon's razor is used by the malicious to fool the stupid. While we are spouting aphorisms, here's another one: "never say never".

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#59

Post by monocasa »

bsder wrote: post #57
monocasa wrote: post #25

Earlier quoted context omitted.

By that logic we should be calling all vulnerabilities "backdoors" just in case.

Freetype buffer overflow leads to privilege escalataion. All code is security code.

Definitely don't disagree, but are the freetype developers being malicious when they leave in a bug?

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#60

Post by village-idiot »

monocasa wrote: post #17
stefan_ wrote: post #8

Earlier quoted context omitted.

There is no valid reason, ever, for a driver to do what the Huawei driver did here. That should be obvious given the detection methods that Microsoft implemented in the kernel to find and prevent just this behavior. The Microsoft blog might stop short of calling it malware, but I think we don't need the faux politeness here. The fact that their malware also contained a privilege escalation (the "vulnerability") is me…

I mean, it's goofy, hacky, and has obvious security flaws but doesn't look malicious. Calling it a "backdoor" ascribes a certain intentionality to the vulnerability that's not clear is warranted. It's about the code quality I expect from the management shovelware that comes preloaded on laptops from any major brand. Source: I've written kernel drivers and exploits.

Problem: any well written exploit will be designed to look like a mistake.
Post reply on HN