Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft finds privilege escalation vulnerability in Huawei driver

microsoft.com

Post reply on HN
Print view View original

111–120 of 138 posts

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#111

Post by mortb »

DanielBMarkham wrote: post #105
wyattpeak wrote: post #72

Earlier quoted context omitted.

Not addressing the main point but the aside - I like it when companies have a clear financial interest in solving a problem. Sure I get the warm fuzzies when a company like Google circa 2005 does something to help people with nothing obvious to gain from it. But in my experience companies like Google circa 2005 tend to become companies like Google circa 2019. People acting in their own interest are reliable.

Apologies for digressing, but this is an important point. Instead of the facile happytalk "Don't Be Evil", a much better slogan might be "Be as evil as you want, just don't hide anything from me and let's have an open and honest relationship" Companies keep using the average user's technology ignorance against them. That was kinda cool and probably acceptable when you were the smart kid making a few dollars here or t…

Word. I very much miss a serious ethical discussion in the tech crowd that I see myself as part of, being a developer. I think we should admit that we are part of a technocracy. If you know the tech you may pull any stunt off, even when you're a big company. The people that need question our actions are not likely to understand the problem.

To cut short to my conclusion: We should be more humble about our less tech educated users and act accordingly.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#112

Post by rujuladanh »

monocasa wrote: post #52
rujuladanh wrote: post #51

Earlier quoted context omitted.

A driver allowing to map any page is like recording a magician from all angles. The only reasonable usage of such a situation is for the magician him/herself, to study his/her own performance. And even then, it is not usually done that way.

There's a lot of situations where you map in trampolines to perform work inside a process on behalf of that process.

The article is about a driver that allows to map any physical page.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#113

Post by novaleaf »

monocasa wrote: post #44
novaleaf wrote: post #41

Earlier quoted context omitted.

The microsoft article mentions that Windows Defender caught multiple machines performing kernel injections near the same time with this driver as the root cause. Meaning it was already being exploited. This doesn't mean the actual flaw was malicious, but being actively exploited, it seems intent doesn't really matter.

I don't see anything saying this was being actively exploited; the non malicious use case would set off their scanners on all MateBooks running this driver.

from the article:

> While monitoring alerts related to kernel-mode attacks, one alert drew our attention:

>The alert process tree showed an abnormal memory allocation and execution in the context of services.exe by a kernel code. Investigating further, we found that an identical alert was fired on another machine around the same time.

This shows code injection taking place, via the exploited code. You are right that they don't mention what code was injected (probably they don't know)

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#114

Post by brianpgordon »

So these "alerts" are coming from Microsoft's cloud-powered anti-malware service? It's kind of disturbing that they have enough data on Microsoft servers to conduct such an in-depth after-the-fact investigation of events on an endpoint machine. Are businesses really OK with sharing telemetry on this level?

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#115

Post by monocasa »

novaleaf wrote: post #113
monocasa wrote: post #44

Earlier quoted context omitted.

I don't see anything saying this was being actively exploited; the non malicious use case would set off their scanners on all MateBooks running this driver.

from the article: > While monitoring alerts related to kernel-mode attacks, one alert drew our attention: >The alert process tree showed an abnormal memory allocation and execution in the context of services.exe by a kernel code. Investigating further, we found that an identical alert was fired on another machine around the same time. This shows code injection taking place, via the exploited code. You are right that…

> via the exploited code

Their scanner doesn't show any exploitation happening, and they don't say that it does.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#116

Post by monocasa »

zaphirplane wrote: post #87
monocasa wrote: post #42

Earlier quoted context omitted.

Device Manager only handles kernel drivers. Best practice is to put as much as possible into a highly privileged, but still user mode process so it can crash without bluescreening your system. If you assume that this code can crash (hence why it was delegated to user mode in the first place) it makes sense to code in a resurrection capability.

Windows services have a restart if I crash mode, why wouldn’t that be used instead. This seems about making sure the user can’t stop it from starting

It's a huge pain on the ass to setup right. Soft faults where the process is still running but is deadlocked don't get restarted for instance.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#117

Post by monocasa »

xenadu02 wrote: post #86
monocasa wrote: post #17

Earlier quoted context omitted.

I mean, it's goofy, hacky, and has obvious security flaws but doesn't look malicious. Calling it a "backdoor" ascribes a certain intentionality to the vulnerability that's not clear is warranted. It's about the code quality I expect from the management shovelware that comes preloaded on laptops from any major brand. Source: I've written kernel drivers and exploits.

Did your drivers also give usermode code the ability to map arbitrary memory addresses of the usermode code's choosing, thus granting full rw access to all memory pages in the system? Either Huawei's driver developers are both incompetent and stupid or they're injecting malicious backdoors.

That's not what this driver does, you need to re-read the article.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#118

Post by skybrian »

kbenson wrote: post #95
skybrian wrote: post #92

Earlier quoted context omitted.

If gaming the markets is of limited use, I wonder why market participants put so much effort into it? I mean, consider Wall Street, Las Vegas, used car sales - the list goes on and on. It's a rich area of storytelling that goes back to the dawn of recorded history.

If you say what you mean by gaming the system with any of those, Wall Street, Las Vegas, used car sales, maybe I can respond intelligently. As it is, I'm not sure what you're referring to. Most things I think of that would be considered gaming the system to do with those have to do with human rules applied to a system, instead of emergent market economics, and that's what I was referring to. There is gaming of market…

At a high level, the market is supposed to provide an incentive to serve customers - "solving a problem" or "help people" as the original post put it.

My point is that real-world incentives are never perfectly aligned with such lofty, nebulous goals. They are about things you can measure such as how much money you can make. Making money is not the same as helping people and no incentive scheme is clever enough to make it so. Customers are often smarter than rules but even then, customers can be fooled. So there will always a way to make money without helping people and when you increase incentives, it also increases incentive to do things that aren't actually the goal.

This means that to some extent we rely on people to follow the spirit of the incentives and not to simply be amoral incentive-maximizers.

(This is closely related to the principal-agent problem, except the principal here is society in general.)

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#119

Post by stefan_ »

monocasa wrote: post #45
stefan_ wrote: post #30

Earlier quoted context omitted.

What is not malicious about a driver whose pure function (this thing literally has no other value or purpose) is maintaining an invincible NT_AUTHORITY process of their pre-installed management software? And achieving that by allocating a RWX page in services.exe? What are we even doing W^X for? Maybe we have different expectations of what a driver is. Take a look for yourself, even the updated PC Manager Software on…

> What is not malicious > malicious - adj. - having or showing a desire to cause harm to someone I'ts goofy, and wouldn't pass a design review that I was a part of, but it isn't "showing a desire to cause harm". It just looks like a rushed design. > about a driver whose pure function (this thing literally has no other value or purpose) I see nothing about how this driver doesn't have any other functions. > is maintai…

> I see nothing about how this driver doesn't have any other functions.

Obviously, you didn't look at it.

This is the irony of it all. There is nothing simple about writing a device driver to do what literally three lines of code in userland registering a service could have achieved. It is the furthest thing from a rushed design you could possibly do; it is taking the wrong turn 10 times and incurring exponential costs each time. That is why it's called a backdoor or malicious; it demonstrates unique niche knowledge in things that are the furthest imaginable distance from the shitty .NET amalgamation that their actual PC manager software is.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#120

Post by monocasa »

rujuladanh wrote: post #112
monocasa wrote: post #52

Earlier quoted context omitted.

There's a lot of situations where you map in trampolines to perform work inside a process on behalf of that process.

The article is about a driver that allows to map any physical page.

That majority isn't.

And while there's better ways to handle it, and it wouldn't pass a design review of mine, it's pretty common to make a driver specific /dev/mem equivalent. For isntance https://forum.xda-developers.com/showthread.php?t=2057818

Post reply on HN