Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft finds privilege escalation vulnerability in Huawei driver

microsoft.com

Post reply on HN
Print view View original

81–90 of 138 posts

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#81

Post by blarpleBlarbz »

jorblumesea wrote: post #74

Given China's preponderance to mass surveillance and Huawei's obvious ties to the state, it's probably smart to take a critical look at anything they write. Willful ignorance and incompetence or cleverly crafted vuln with plausible deniability? I guess, does it even matter at that point if you get ring-0 permissions? Probably shouldn't ever use their products regardless of the cause.

Honestly, Microsoft's shitbird security track record for the past umpteen years is such a clusterfuck that it's impossible to consider them as doing anything other than deliberately shipping the leakiest possible operating system to as many Americans as possible, with express intent to open a general surveillance portal exposing every user to analytical scrutiny for decades on end.

And with that, also a shrug, because yoooooooouuuuu asked for it!

From 95 to 98 to NT to 2000 to XP to Vista, and on and on, and it only gets worse.

But hey, woah! Now someone else is sticking their nose in front of America's magic mirror??? My goodness! Heavans to Betsy!

If Microsoft hadn't been such utter garbage since nineteen ninety fucking five, interrupting my fucking life with unstoppable automatic updates "for security patches" every other week... patches that forbade me from unplugging a machine in my own home, lest summarily it brick itself, I might be inclined to raise an eyebrow at yet another vulnerability, but alas... That's not the years of Microsoft history I remember.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#82

Post by thought_alarm »

pbhjpbhj wrote: post #26

From scanning the page it sounds like Huawei used a hack to make their MateBookService unkillable, unremovable, by unhooking in to services.exe. That in the process of that they left the possibility that the device they were using HwOs.*\.sys was only protected from being used by checking the program had the right path, thus leaving it open to crackers (it being basically g+rw) to use to get the ring-0 permissions ne…

When you buy a computer, whom do you trust? Microsoft, for keeping the manufacturers at bay?

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#83

Post by geezerjay »

padiyar83 wrote: post #50
stefan_ wrote: post #8

Earlier quoted context omitted.

There is no valid reason, ever, for a driver to do what the Huawei driver did here. That should be obvious given the detection methods that Microsoft implemented in the kernel to find and prevent just this behavior. The Microsoft blog might stop short of calling it malware, but I think we don't need the faux politeness here. The fact that their malware also contained a privilege escalation (the "vulnerability") is me…

Hanlon's razor - Never attribute to malice that which is adequately explained by stupidity.

Honest question: is it plausible that someone who is knowledgeable enough to understand and implement this exploit is also oblivious to ita exploitability?

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#85

Post by gsich »

bsder wrote: post #57
monocasa wrote: post #25

Earlier quoted context omitted.

By that logic we should be calling all vulnerabilities "backdoors" just in case.

Freetype buffer overflow leads to privilege escalataion. All code is security code.

>All code is security code.

Debian disagrees. They are wrong to do so.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#86

Post by xenadu02 »

monocasa wrote: post #17
stefan_ wrote: post #8

Earlier quoted context omitted.

There is no valid reason, ever, for a driver to do what the Huawei driver did here. That should be obvious given the detection methods that Microsoft implemented in the kernel to find and prevent just this behavior. The Microsoft blog might stop short of calling it malware, but I think we don't need the faux politeness here. The fact that their malware also contained a privilege escalation (the "vulnerability") is me…

I mean, it's goofy, hacky, and has obvious security flaws but doesn't look malicious. Calling it a "backdoor" ascribes a certain intentionality to the vulnerability that's not clear is warranted. It's about the code quality I expect from the management shovelware that comes preloaded on laptops from any major brand. Source: I've written kernel drivers and exploits.

Did your drivers also give usermode code the ability to map arbitrary memory addresses of the usermode code's choosing, thus granting full rw access to all memory pages in the system?

Either Huawei's driver developers are both incompetent and stupid or they're injecting malicious backdoors.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#87

Post by zaphirplane »

monocasa wrote: post #42
codeinstyle wrote: post #37

Earlier quoted context omitted.

>...because it’s the hardware management service and if it goes down you’re no longer managing the hardware? I’m no expert on device drivers but to my knowledge, Windows already allows you to manage devices and install drivers through Device Managers. Then if drivers are already installed for the various devices and hardware components, what exactly is the hardware management service managing on top of the individual…

Device Manager only handles kernel drivers. Best practice is to put as much as possible into a highly privileged, but still user mode process so it can crash without bluescreening your system. If you assume that this code can crash (hence why it was delegated to user mode in the first place) it makes sense to code in a resurrection capability.

Windows services have a restart if I crash mode, why wouldn’t that be used instead. This seems about making sure the user can’t stop it from starting

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#88

Post by indigo945 »

yourbandsucks wrote: post #77
will4274 wrote: post #71

Earlier quoted context omitted.

[flagged]

I don't think you engaged with my comment in good faith, here. Falun gong are han Chinese who chose to identify with a particular religious offshoot. That doesn't make them a minority group as westerners understand it. Would you call Mormons minorities?

I think it is pretty common to refer to Jews or Muslims as minorities, and it doesn't seem weird to me to call Mormons a minority group as well.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#89

Post by zvrba »

Weird approach by Huawei. If you want a program to stay up and running, you write a windows service; autostart with restart for recovery in case of crash. The service process can set its own DAC so that only SYSTEM can open its handle, hence the process in inaccessible/unkillable to ordinary users, even administrators.

The knowledge needed to do so is far less than what is needed to pull the hack that Huawei did.

So to quote another user:

> Problem: any well written exploit will be designed to look like a mistake.

and given the above, I'm inclined to believe that this was meant as a deniable exploit ("honest mistake").

What I wrote above is what I miss in the MS's analysis. There are cleaner and simpler ways to achieve what Huawei tried to accomplish. I would be astonished that the person(s) having knowledge to write a kernel driver don't know about DACLs and how to use them to prevent tampering with a process.

EDIT: The article does end with guidelines. However, I'd be more happy if MS explicitly wrote "They should have done THIS (using exising, well-documented, UM only OS functionality) instead to achieve their goal."

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#90

Post by zaphirplane »

yourbandsucks wrote: post #77
will4274 wrote: post #71

Earlier quoted context omitted.

[flagged]

I don't think you engaged with my comment in good faith, here. Falun gong are han Chinese who chose to identify with a particular religious offshoot. That doesn't make them a minority group as westerners understand it. Would you call Mormons minorities?

In general, You are defining minority group as minority ethnicity only
Post reply on HN