Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft finds privilege escalation vulnerability in Huawei driver

microsoft.com

Post reply on HN
Print view View original

121–130 of 138 posts

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#121

Post by monocasa »

stefan_ wrote: post #119
monocasa wrote: post #45

Earlier quoted context omitted.

> What is not malicious > malicious - adj. - having or showing a desire to cause harm to someone I'ts goofy, and wouldn't pass a design review that I was a part of, but it isn't "showing a desire to cause harm". It just looks like a rushed design. > about a driver whose pure function (this thing literally has no other value or purpose) I see nothing about how this driver doesn't have any other functions. > is maintai…

> I see nothing about how this driver doesn't have any other functions. Obviously, you didn't look at it. This is the irony of it all. There is nothing simple about writing a device driver to do what literally three lines of code in userland registering a service could have achieved. It is the furthest thing from a rushed design you could possibly do; it is taking the wrong turn 10 times and incurring exponential cos…

Quote the piece of the article that says that the driver has no other functions.

Particularly given that they describe how there's multiple ioctls.

And I can tell you from experience that relying on the service manager for a full watchdog solution is fraught with peril. It'll catch hard crashes, but not for instance dead locks.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#122

Post by monocasa »

zvrba wrote: post #106
londons_explore wrote: post #94

Earlier quoted context omitted.

Perhaps they wanted the service killable, but for it to always restart? Considering the physical memory mapping stuff, I wouldn't be surprised if the service doesn't have some roles firmware should have had - for example ensuring the battery charger is stopped when the battery is fully charged to prevent a fire.

> Perhaps they wanted the service killable, but for it to always restart? Then you use a DACL than gives only PROCESS_TERMINATE permission [1] to the desired group (Administrators, Users, …). If killed, service control manager will figure out that the program exited abnormally and restart it. [1] Overview of all permissions on process objects that can be allowed or denied in a DACL https://docs.microsoft.com/en-us/wi…

That doesn't kill dead locked processes, or processes that aren't listening on the management IF. You see this with services that can't be "sc stop"ed.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#123

Post by monocasa »

vardump wrote: post #110
monocasa wrote: post #64

Earlier quoted context omitted.

The code is designed to be a privilege _deescalation_. It's already running in kernel mode, and is deferring work to a user mode process.

To create a backdoor, you could not be obvious. Like do something obviously evil in the driver... You'd build it out of many building blocks in several components that individually look like honest mistakes. "Mistakes" that can be combined to create something malicious. That's what you need to achieve plausible deniability. You'll need to make it look innocent. (I also write Windows kernel mode drivers.)

Did you think that the recent Apache privilege escalation exploit is a malicious piece?

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#124

Post by monocasa »

jorblumesea wrote: post #74

Given China's preponderance to mass surveillance and Huawei's obvious ties to the state, it's probably smart to take a critical look at anything they write. Willful ignorance and incompetence or cleverly crafted vuln with plausible deniability? I guess, does it even matter at that point if you get ring-0 permissions? Probably shouldn't ever use their products regardless of the cause.

The thing already had ring 0 permissions, the code with the bug in it is a kernel driver.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#125

Post by xenadu02 »

monocasa wrote: post #117
xenadu02 wrote: post #86

Earlier quoted context omitted.

Did your drivers also give usermode code the ability to map arbitrary memory addresses of the usermode code's choosing, thus granting full rw access to all memory pages in the system? Either Huawei's driver developers are both incompetent and stupid or they're injecting malicious backdoors.

That's not what this driver does, you need to re-read the article.

> Having been able to freely invoke IOCTL handlers of the driver from user-mode, we looked for other capabilities that can be abused. We found one: the driver provided a capability to map any physical page into user-mode with RW permissions. Invoking this handler allowed a code running with low privileges to read-write beyond the process boundaries—to other processes or even to kernel space. This, of course, means a full machine compromise.

Please, continue.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#126

Post by monocasa »

xenadu02 wrote: post #125
monocasa wrote: post #117

Earlier quoted context omitted.

That's not what this driver does, you need to re-read the article.

> Having been able to freely invoke IOCTL handlers of the driver from user-mode, we looked for other capabilities that can be abused. We found one: the driver provided a capability to map any physical page into user-mode with RW permissions. Invoking this handler allowed a code running with low privileges to read-write beyond the process boundaries—to other processes or even to kernel space. This, of course, means a…

Ok, I missed that part. Most people here are up in arms about the page mapping for the code injection.

But FWIW, it's a pretty common thing for shitty drivers. Here's one example: https://forum.xda-developers.com/showthread.php?t=2057818

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#127

Post by rujuladanh »

monocasa wrote: post #120
rujuladanh wrote: post #112

Earlier quoted context omitted.

The article is about a driver that allows to map any physical page.

That majority isn't. And while there's better ways to handle it, and it wouldn't pass a design review of mine, it's pretty common to make a driver specific /dev/mem equivalent. For isntance https://forum.xda-developers.com/showthread.php?t=2057818

I am not sure what you are trying to say.

Any driver for a multiuser OS that essentially bypasses protection mechanisms by the kernel for non-root users is broken, period.

There is no argument about it.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#128

Post by kbenson »

skybrian wrote: post #118
kbenson wrote: post #95

Earlier quoted context omitted.

If you say what you mean by gaming the system with any of those, Wall Street, Las Vegas, used car sales, maybe I can respond intelligently. As it is, I'm not sure what you're referring to. Most things I think of that would be considered gaming the system to do with those have to do with human rules applied to a system, instead of emergent market economics, and that's what I was referring to. There is gaming of market…

At a high level, the market is supposed to provide an incentive to serve customers - "solving a problem" or "help people" as the original post put it. My point is that real-world incentives are never perfectly aligned with such lofty, nebulous goals. They are about things you can measure such as how much money you can make. Making money is not the same as helping people and no incentive scheme is clever enough to mak…

> At a high level, the market is supposed to provide an incentive to serve customers

That's not what markets do. Markets are a means of efficiently and accurately pricing things in a responsive way. Some markets don't even have customers. That price may or may not be money, depending on the market in question.

> My point is that real-world incentives are never perfectly aligned with such lofty, nebulous goals.

For markets, definitely not, since that's not really what they are for, and any created incentive will at best attempt to move a market towards that.

> Making money is not the same as helping people and no incentive scheme is clever enough to make it so. Customers are often smarter than rules but even then, customers can be fooled. So there will always a way to make money without helping people and when you increase incentives, it also increases incentive to do things that aren't actually the goal.

Nobody here has said it is. The original comment noted "People acting in their own interest are reliable." I interpreted that to mean "when there are forces urging a person or group to act a certain way for their own self interest, it's easier to rely on them to continue acting that way". If Microsoft benefits from doing something that benefits others, it's easier to rely on them to continue doing that. I'm still not sure what point you were trying to make from that, since I'm not following how your latest comment relates to that or to my call for clarification, since I thought maybe you were interpreting the statement somewhat differently than I was.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#129

Post by skybrian »

kbenson wrote: post #128
skybrian wrote: post #118

Earlier quoted context omitted.

At a high level, the market is supposed to provide an incentive to serve customers - "solving a problem" or "help people" as the original post put it. My point is that real-world incentives are never perfectly aligned with such lofty, nebulous goals. They are about things you can measure such as how much money you can make. Making money is not the same as helping people and no incentive scheme is clever enough to mak…

> At a high level, the market is supposed to provide an incentive to serve customers That's not what markets do. Markets are a means of efficiently and accurately pricing things in a responsive way. Some markets don't even have customers. That price may or may not be money, depending on the market in question. > My point is that real-world incentives are never perfectly aligned with such lofty, nebulous goals. For ma…

My point is that "Microsoft benefits from doing something that benefits others" is never going to be entirely true, or at least not for long.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#130

Post by zaphirplane »

monocasa wrote: post #116
zaphirplane wrote: post #87

Earlier quoted context omitted.

Windows services have a restart if I crash mode, why wouldn’t that be used instead. This seems about making sure the user can’t stop it from starting

It's a huge pain on the ass to setup right. Soft faults where the process is still running but is deadlocked don't get restarted for instance.

Same problem if you write your own supervisor except you are writing a process supervisor
Post reply on HN