Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft finds privilege escalation vulnerability in Huawei driver

microsoft.com

Post reply on HN
Print view View original

101–110 of 138 posts

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#101

Post by mortb »

Maybe, as some posters in this thread are suggesting, this should not be read as a PR article. This should be read as a "Huawei (and others) we are watching you. Stop doing those things we are able to spot your doings, and we are willing to show the world". Of course the article touts about the ability of defender and their forensics team, but there is definitely a possibility that another message is being conveyed. As I am working mostly in web etc I have no experience in writing drivers so this is quite a few software layers below my comfort zone. However, to me having read the article, it seems that the "Watchdog" goal achieved by Huawei's code is done in such a round about fashion that is either a combination of "skilled but sloppy programmer" or "skilled and not sloppy but wanting to be perceived as sloppy". Some context, WannaCry and DOUBLEPULSAR are mentioned several times. Read about the NSA backdoors: https://en.wikipedia.org/wiki/EternalBlue https://en.wikipedia.org/wiki/DoublePulsar

Etrnal Blue was leaked from NSA and developed into WannaCry

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#102

Post by undecisive »

pbhjpbhj wrote: post #26

From scanning the page it sounds like Huawei used a hack to make their MateBookService unkillable, unremovable, by unhooking in to services.exe. That in the process of that they left the possibility that the device they were using HwOs.*\.sys was only protected from being used by checking the program had the right path, thus leaving it open to crackers (it being basically g+rw) to use to get the ring-0 permissions ne…

It's not a question of who owns the computer; the software was trying to do things that Microsoft totally agree with - so much so that Microsoft have a published "right way" of doing it.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#103

Post by mortb »

mortb wrote: post #101

Maybe, as some posters in this thread are suggesting, this should not be read as a PR article. This should be read as a "Huawei (and others) we are watching you. Stop doing those things we are able to spot your doings, and we are willing to show the world". Of course the article touts about the ability of defender and their forensics team, but there is definitely a possibility that another message is being conveyed.…

Another piece of context, the article says that the issue was resolved together with Huawei. Why then make a publicly available article about it naming the company? Why not just patch and pretend that there were no issue, or patch and with a more generic description "we have implemented a mechanism to monitor drivers that might try to execute arbitrary code"?

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#104

Post by emmelaich »

mortb wrote: post #103
mortb wrote: post #101

Maybe, as some posters in this thread are suggesting, this should not be read as a PR article. This should be read as a "Huawei (and others) we are watching you. Stop doing those things we are able to spot your doings, and we are willing to show the world". Of course the article touts about the ability of defender and their forensics team, but there is definitely a possibility that another message is being conveyed.…

Another piece of context, the article says that the issue was resolved together with Huawei. Why then make a publicly available article about it naming the company? Why not just patch and pretend that there were no issue, or patch and with a more generic description "we have implemented a mechanism to monitor drivers that might try to execute arbitrary code"?

If you don't mention the company you implicate everyone.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#105

Post by DanielBMarkham »

wyattpeak wrote: post #72
pbhjpbhj wrote: post #26

From scanning the page it sounds like Huawei used a hack to make their MateBookService unkillable, unremovable, by unhooking in to services.exe. That in the process of that they left the possibility that the device they were using HwOs.*\.sys was only protected from being used by checking the program had the right path, thus leaving it open to crackers (it being basically g+rw) to use to get the ring-0 permissions ne…

Not addressing the main point but the aside - I like it when companies have a clear financial interest in solving a problem. Sure I get the warm fuzzies when a company like Google circa 2005 does something to help people with nothing obvious to gain from it. But in my experience companies like Google circa 2005 tend to become companies like Google circa 2019. People acting in their own interest are reliable.

Apologies for digressing, but this is an important point.

Instead of the facile happytalk "Don't Be Evil", a much better slogan might be "Be as evil as you want, just don't hide anything from me and let's have an open and honest relationship"

Companies keep using the average user's technology ignorance against them. That was kinda cool and probably acceptable when you were the smart kid making a few dollars here or there, everybody loves the story of some genius hacker able to figure out the stock market and made a small fortune on a stunt they could never repeat, but this has gotten completely out of hand. It's gotta stop. We need to start acting in the user's best interests as if they knew as much about the business as we do. That's the only ethical way forward from here.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#106

Post by zvrba »

londons_explore wrote: post #94
zvrba wrote: post #89

Weird approach by Huawei. If you want a program to stay up and running, you write a windows service; autostart with restart for recovery in case of crash. The service process can set its own DAC so that only SYSTEM can open its handle, hence the process in inaccessible/unkillable to ordinary users, even administrators. The knowledge needed to do so is far less than what is needed to pull the hack that Huawei did. So…

Perhaps they wanted the service killable, but for it to always restart? Considering the physical memory mapping stuff, I wouldn't be surprised if the service doesn't have some roles firmware should have had - for example ensuring the battery charger is stopped when the battery is fully charged to prevent a fire.

> Perhaps they wanted the service killable, but for it to always restart?

Then you use a DACL than gives only PROCESS_TERMINATE permission [1] to the desired group (Administrators, Users, …). If killed, service control manager will figure out that the program exited abnormally and restart it.

[1] Overview of all permissions on process objects that can be allowed or denied in a DACL https://docs.microsoft.com/en-us/windows/desktop/ProcThread/...

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#107

Post by jaclaz »

I may be cynical but:

>Our discovery of the driver vulnerabilities also highlights the strength of Microsoft Defender ATP’s sensors. These sensors expose anomalous behavior and give SecOps personnel the intelligence and tools to investigate threats, as we did.

>Anomalous behaviors typically point to attack techniques perpetrated by adversaries with only malicious intent. In this case, they pointed to a flawed design that can be abused. Nevertheless, Microsoft Defender ATP exposed a security flaw and protected customers before it can even be used in actual attacks.

Seems to me a lot like "the ATP sensors and the SecOps did what they are supposed to do" followed by some self-patting/self-applauding on how good the MS technology and guys are good at it.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#108

Post by tastroder »

mortb wrote: post #103
mortb wrote: post #101

Maybe, as some posters in this thread are suggesting, this should not be read as a PR article. This should be read as a "Huawei (and others) we are watching you. Stop doing those things we are able to spot your doings, and we are willing to show the world". Of course the article touts about the ability of defender and their forensics team, but there is definitely a possibility that another message is being conveyed.…

Another piece of context, the article says that the issue was resolved together with Huawei. Why then make a publicly available article about it naming the company? Why not just patch and pretend that there were no issue, or patch and with a more generic description "we have implemented a mechanism to monitor drivers that might try to execute arbitrary code"?

That happens all the time as it's relatively normal to do so in this type of disclosure . With the political focus on Huawei these days it's likely just people noticing this message more than others, it's not like other big manufacturers show better security practices. With Huawei in particular, MS as a US company really couldn't have omitted the name from the disclosure without being put in a weird spot later down the road.

While I agree with other posters that the wording of this disclosure is unnecessarily mixed with a PR piece, naming companies for me is crucial as it allows end users to assess their own impact o f a vulnerability and also puts a public track record on these vendors.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#110

Post by vardump »

monocasa wrote: post #64
kbumsik wrote: post #63

Earlier quoted context omitted.

Then what other kinds of software need to use a privilege escalation?

The code is designed to be a privilege _deescalation_. It's already running in kernel mode, and is deferring work to a user mode process.

To create a backdoor, you could not be obvious. Like do something obviously evil in the driver... You'd build it out of many building blocks in several components that individually look like honest mistakes. "Mistakes" that can be combined to create something malicious.

That's what you need to achieve plausible deniability. You'll need to make it look innocent.

(I also write Windows kernel mode drivers.)

Post reply on HN