Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft 0-day feud escalates as researcher threatens another exploit dump

theregister.com

Post reply on HN
Print view View original

41–50 of 103 posts

Re: Microsoft 0-day feud escalates as researcher threatens another exploit dump

#41

Post by g_p »

Retr0id wrote: post #26
kotaKat wrote: post #24

Earlier quoted context omitted.

Sniffing the TPM's been available for quite some time, actually - and quite cheap! https://pulsesecurity.co.nz/articles/TPM-sniffing The best way would be to arguably keep the key completely off the TPM and use remote attestation. There's some preboot products out there like WinMagic SecureDoc* that use a little Linux partition, spin up just enough to get a network connection up to a remote server, provide authentica…

Something I've never understood about TPM attestation, is what happens if you plug the TPM into a microcontroller and give it all the same measurements that it would normally receive during a normal boot? Would that let you spoof attestations?

Yes, you should be able to. In essence, the state of the TPM is represented in the values of the PCRs (Platform Configuration Registers). Those are hash-extended through the boot process.

You can create a key or similar attribute which has an unlock policy based on those PCR values. If you play back the log of PCR write events from first principles (the log can be captured for debug purposes), you'll put the TPM into the same state and should be able to use anything protected by the respective policy.

For attestation, I presume you're thinking about sending an attested PCR quote - in that case, the TPM uses a non-extractable key to sign the current PCR states. As you can put the PCRs into the "correct" state, you'd be able to get a signed attestation the system is in that state.

Re: Microsoft 0-day feud escalates as researcher threatens another exploit dump

#42

Post by rileymat2 »

It is not all about money, but microsoft had a net income of 101 billion last year, and a 36% profit margin.

I am not saying humans or AI can create "perfect" software, but NASA has shown there is a HUGE gap between what can be achieved and what commercial software has generally done. We have given software a pass on the liability for the damage it can caused when it is defective for too long, that's the only way to change this, it must hit the bottom line.

Re: Microsoft 0-day feud escalates as researcher threatens another exploit dump

#43

Post by vorpalhex »

rustyhancock wrote: post #13

I know this is a crazy take. But I go feel so down trodden by many many tech corps these days I find it hard not to have a smidge of satisfaction for this guy pointing out the colossal favour research developers do for them by responsible disclosure. That said, I feel bad for the inevitable victims of exploitation and also I am certain he will end up criminalized or as per usual the law will enforce a large corps wil…

Microsoft chose to run a shoddy bounty program. The researcher tried to do the right thing.

Microsoft could have prevented this. They were warned. It's their own fault.

The exploit exists whether or not the researcher reports it. They didn't make the exploit.

Re: Microsoft 0-day feud escalates as researcher threatens another exploit dump

#44

Post by fsckboy »

this is from 2010 but says that microsoft was not going to pay bug bounties https://www.computerworld.com/article/1510124/microsoft-no-m...

did they start to do that at some point, or is this a pressure (blackmail?) campaign to get the to do that? I have no love for, but rather hate for, Microsoft, so I'm not suggesting blackmail in the sense of defending them, but it's something they could claim.

this is on Microsoft's website, they don't promise much for CVD

https://www.microsoft.com/en-us/msrc/cvd

Re: Microsoft 0-day feud escalates as researcher threatens another exploit dump

#45

Post by Shank »

jeroenhd wrote: post #18
mittensc wrote: post #9

Earlier quoted context omitted.

> so far as i can tell yellowkey is problematic, as the exploit takes advantage of a backdoor that ms needs, to "manage" your computer. It does look like an intentional backdoor. The way ms is responding to it is even more suspicious. Pretty funny since this defeats security on most corporate laptops, so impact is huge. You'd expect them to treat the reporter better and fix the issue fast... I'm curious why they put…

The backdoor could be a bug, but I don't really understand how it happened. The attack works by having an NTFS log get replayed against another partition than the one the log is stored on. Sending the right signals to unlock Bitlocker in TPM-only mode is a necessity for recovery operations. Managing to replace the executable launched post verification is a plausible attack vector. The weird thing is why it's possible…

The thing that made Nightmare think it was a backdoor is that the bug is only present in the recovery version of the DLLs, not the one built into the system, and not prior versions of Windows. It’s also for a file system feature that Microsoft hasn’t “touched” in ages and they consider fairly esoteric.

Re: Microsoft 0-day feud escalates as researcher threatens another exploit dump

#46

Post by bink »

Responding to bug bounty reports is a thankless job. Especially these days it's a flood of AI spam, language barriers, "pay me first", incomplete reports, huge egos, and people who think every find should be treated as a critical vulnerability. The people who handle these reports often do so after-hours or on holidays. In smaller companies they're also often the ones who manage the triage, patching, testing, and security release process. In larger companies they have to find owners for every line of code and convince those code owners of the severity (often knowing that neither or them will be rewarded for doing the work).

All it takes is one wrong person to be assigned as a report comes in, a person who doesn't understand the real value of a bounty program, or one person having a bad day to completely ruin a company's reputation. It seems like that might have happened here (of course MS has done this before so who knows if it'll matter in the end).

Microsoft needs to be completely transparent and to do so immediately. They should, with the reporters permission, release all communications. They can exclude technical details if patches aren't available yet. Doing anything less is going to prevent a lot of people from using their bounty program in the future and we'll all be worse off for it. They almost certainly made a mistake and they need to own up to it.

Re: Microsoft 0-day feud escalates as researcher threatens another exploit dump

#47

Post by dlgeek »

Retr0id wrote: post #38
pitched wrote: post #30

Earlier quoted context omitted.

TPM-only saves you against someone pulling your drive. Probably more than enough for a USB drive. Enable startup PIN if you’re worried about someone grabbing the whole laptop.

I'm asking about TPM attestation in general, not Bitlocker

Yes.

Some modern CPUs have moved the TPM inside the CPU itself. But traditionally, TPMs were attached via the LPC (low pin-count) bus, and you could absolutely sniff them or de-solder them and arbitrarily MiTM.

Re: Microsoft 0-day feud escalates as researcher threatens another exploit dump

#48

Post by 12_throw_away »

8cvor6j844qw_d6 wrote: post #6

> “CVD is a two-way street,” he said. “The vendor has some responsibility as well, so to go out publicly stating this person violated CVD without showing any of the correspondence seems bold.” > “It confusingly claims their program ‘ensures researchers are compensated and publicly acknowledged’ in a statement answering a researcher who says he got neither,” Well said.

TBH, the microsoft statement itself feels like slop. Not necessarily LLM slop (although who are we kidding, it probably was), but definitely like corporate slop, written by some manager with no context for how any of this is supposed to work (they laid off all the people who did), but with a need to make some sort of statement-shaped response

Re: Microsoft 0-day feud escalates as researcher threatens another exploit dump

#49

Post by legohead »

I guess I'll play devil's advocate here, don't shoot me.

Over the course of my career I've had to deal with multiple hacks, DDOSes, and even situations working with the FBI. It's a mess, and extremely frustrating and unfair to those of us who are just trying to do a good job and make a living. Those of you who are throwing stones at Microsoft's coding, how confident are you that your code is safe from this new AI age?

Obviously MS handled this poorly, even after reading this article it's not clear how MS handles bug bounties. But that doesn’t mean this “researcher” deserves a pass.

Releasing 0-days, especially working exploit code for unpatched vulnerabilities, is extremely unethical. It has real potential to cause a lot of harm to regular engineers, and users who had nothing to do with the dispute.

Re: Microsoft 0-day feud escalates as researcher threatens another exploit dump

#50

Post by skinfaxi »

rileymat2 wrote: post #42

It is not all about money, but microsoft had a net income of 101 billion last year, and a 36% profit margin. I am not saying humans or AI can create "perfect" software, but NASA has shown there is a HUGE gap between what can be achieved and what commercial software has generally done. We have given software a pass on the liability for the damage it can caused when it is defective for too long, that's the only way to…

Is NASA software accessible over the public internet?
Post reply on HN