Live data from Hacker News

Microsoft finds privilege escalation vulnerability in Huawei driver

microsoft.com

71–80 of 138 posts

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#71
post #49

Earlier quoted context omitted.

What? Maybe the Epoch Times is biased, but the Falun Gong is nothing like scientology: it has no fees and isn't trying to coerce anyone to join. It's a minority group that is persecuted by the CCP.

What kind of minority group? They're religious kooks. That doesn't mean they deserve to be stamped out, necessarily, but they're also not a "minority group" by the common definition of the term.

[flagged]

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#72

From scanning the page it sounds like Huawei used a hack to make their MateBookService unkillable, unremovable, by unhooking in to services.exe. That in the process of that they left the possibility that the device they were using HwOs.*\.sys was only protected from being used by checking the program had the right path, thus leaving it open to crackers (it being basically g+rw) to use to get the ring-0 permissions ne…

Not addressing the main point but the aside - I like it when companies have a clear financial interest in solving a problem.

Sure I get the warm fuzzies when a company like Google circa 2005 does something to help people with nothing obvious to gain from it. But in my experience companies like Google circa 2005 tend to become companies like Google circa 2019. People acting in their own interest are reliable.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#73

Earlier quoted context omitted.

What kind of minority group? They're religious kooks. That doesn't mean they deserve to be stamped out, necessarily, but they're also not a "minority group" by the common definition of the term.

[flagged]

I read my grandma’s FaLun Gong book when I was 8. Eye opening that it’s completely bullshit and lies(the founder claimed he is omnipotent and could cure cancer). However China has a large gullible and uneducated population and you can’t imagine the harm such nonsense group could cause. And hell yes they definitively used it to profit. It’s freaking a hoax. It’s not a religion and It has nothing to do with “disagree with authoritarian” at all

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#74
Given China's preponderance to mass surveillance and Huawei's obvious ties to the state, it's probably smart to take a critical look at anything they write. Willful ignorance and incompetence or cleverly crafted vuln with plausible deniability?

I guess, does it even matter at that point if you get ring-0 permissions? Probably shouldn't ever use their products regardless of the cause.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#75

Earlier quoted context omitted.

> I mean, it's goofy, hacky, and has obvious security flaws but doesn't look malicious. Plausible deniability. If you were to implement a backdoor for a company, would you write "professionally done" all over it?

So now every bug on a privilege boundary is a backdoor, because of "plausible deniability"?

Did I say that? The point is that it just because it looks like an "honest mistake" doesn't mean it is. If you were to create a backdoor, that's exactly how you'd want to do it.

Given the circumstances, one might wish to err on the side of caution.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#76

From scanning the page it sounds like Huawei used a hack to make their MateBookService unkillable, unremovable, by unhooking in to services.exe. That in the process of that they left the possibility that the device they were using HwOs.*\.sys was only protected from being used by checking the program had the right path, thus leaving it open to crackers (it being basically g+rw) to use to get the ring-0 permissions ne…

Not addressing the main point but the aside - I like it when companies have a clear financial interest in solving a problem. Sure I get the warm fuzzies when a company like Google circa 2005 does something to help people with nothing obvious to gain from it. But in my experience companies like Google circa 2005 tend to become companies like Google circa 2019. People acting in their own interest are reliable.

The problem is that most incentives can be gamed. There are good and bad ways to get customers to buy more or make the stock price go up.

People are smarter than metrics. Increase the incentives and you also increase the incentive to cheat. Sometimes the best you can do is insulate people from incentives, so people have the leeway to do the right thing without acting against their own best interest.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#77

Earlier quoted context omitted.

What kind of minority group? They're religious kooks. That doesn't mean they deserve to be stamped out, necessarily, but they're also not a "minority group" by the common definition of the term.

[flagged]

I don't think you engaged with my comment in good faith, here.

Falun gong are han Chinese who chose to identify with a particular religious offshoot. That doesn't make them a minority group as westerners understand it. Would you call Mormons minorities?

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#78

Earlier quoted context omitted.

Not addressing the main point but the aside - I like it when companies have a clear financial interest in solving a problem. Sure I get the warm fuzzies when a company like Google circa 2005 does something to help people with nothing obvious to gain from it. But in my experience companies like Google circa 2005 tend to become companies like Google circa 2019. People acting in their own interest are reliable.

The problem is that most incentives can be gamed. There are good and bad ways to get customers to buy more or make the stock price go up. People are smarter than metrics. Increase the incentives and you also increase the incentive to cheat. Sometimes the best you can do is insulate people from incentives, so people have the leeway to do the right thing without acting against their own best interest.

Well, that's why there's generally a difference between market incentives and regulatory incentives. In this case, I believe we are referring to market based incentives, where gaming them is of limited use because the market should respond to that gaming.

That said, regulatory incentives and punishments have their place too, IMO generally where the market isn't responding well, or information isn't available enough to allow for an efficient market, or as a response to some other regulatory market effects. But, as you noted, you'll often get some interesting behavior right at the edge of where the regulation kicks in because there's often a hard change instead of a gradual shift as an efficient market would allow.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#79
post #36

Earlier quoted context omitted.

With Win10 they do ship those drivers through Windows updates.

They’ve done it for previous versions as well. I think that practice goes back to Vista at the very least.

It started in Vista, AFAIK, but it didn't really become reliably useful for _most_ of the drivers on even relatively common hardware configurations until 7, and even now it's still not complete (I installed a Coffee Lake-era Intel desktop with Win10, and I still got to play Hunt the Unknown Device Driver even after the endless reboots for updating had installed every driver Windows Update offered, and that's for onboard peripherals, not a fly-by-night USB device or PCIe card.)

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#80

Earlier quoted context omitted.

[flagged]

I don't think you engaged with my comment in good faith, here. Falun gong are han Chinese who chose to identify with a particular religious offshoot. That doesn't make them a minority group as westerners understand it. Would you call Mormons minorities?

Outside of Utah, yes.
Post reply on HN