Original source, much better info + technical details: https://www.microsoft.com/security/blog/2019/03/25/from-aler...
Ok, we've changed the URL to that from https://www.theepochtimes.com/microsoft-finds-backdoor-in-hu....
Microsoft finds privilege escalation vulnerability in Huawei driver
11–20 of 138 posts
Re: Microsoft finds privilege escalation vulnerability in Huawei driver
#12Backdoor is such a loaded word to use for a vulnerability. Especially since Huawei is involved. Shame on the person who came up with the title and the reporter who uses the term in the article.
There is no valid reason, ever, for a driver to do what the Huawei driver did here. That should be obvious given the detection methods that Microsoft implemented in the kernel to find and prevent just this behavior. The Microsoft blog might stop short of calling it malware, but I think we don't need the faux politeness here. The fact that their malware also contained a privilege escalation (the "vulnerability") is me…
Really? Because MS and others have stated what Huawei did here isn't unheard of.
This is simply news because it's Huawei and many want them to be guilty of backdooring US entities. Perhaps they are, but no more many other "respected" US companies.
Re: Microsoft finds privilege escalation vulnerability in Huawei driver
#13Re: Microsoft finds privilege escalation vulnerability in Huawei driver
#14Better article: https://www.microsoft.com/security/blog/2019/03/25/from-aler...
Changed now. Thanks!
Re: Microsoft finds privilege escalation vulnerability in Huawei driver
#15Backdoor is such a loaded word to use for a vulnerability. Especially since Huawei is involved. Shame on the person who came up with the title and the reporter who uses the term in the article.
There is no valid reason, ever, for a driver to do what the Huawei driver did here. That should be obvious given the detection methods that Microsoft implemented in the kernel to find and prevent just this behavior. The Microsoft blog might stop short of calling it malware, but I think we don't need the faux politeness here. The fact that their malware also contained a privilege escalation (the "vulnerability") is me…
Since you make a very strong claim on a very complex topic, would you mind if I asked you to share whether you have expertise / credentials on drivers and security?
Edit: I'm not sure if it's considered appropriate to ask for credentials on HN. There's one way to find out :)
Re: Microsoft finds privilege escalation vulnerability in Huawei driver
#16Re: Microsoft finds privilege escalation vulnerability in Huawei driver
#17Backdoor is such a loaded word to use for a vulnerability. Especially since Huawei is involved. Shame on the person who came up with the title and the reporter who uses the term in the article.
There is no valid reason, ever, for a driver to do what the Huawei driver did here. That should be obvious given the detection methods that Microsoft implemented in the kernel to find and prevent just this behavior. The Microsoft blog might stop short of calling it malware, but I think we don't need the faux politeness here. The fact that their malware also contained a privilege escalation (the "vulnerability") is me…
I mean, it's goofy, hacky, and has obvious security flaws but doesn't look malicious. Calling it a "backdoor" ascribes a certain intentionality to the vulnerability that's not clear is warranted. It's about the code quality I expect from the management shovelware that comes preloaded on laptops from any major brand.
Source: I've written kernel drivers and exploits.
Re: Microsoft finds privilege escalation vulnerability in Huawei driver
#18Backdoor is such a loaded word to use for a vulnerability. Especially since Huawei is involved. Shame on the person who came up with the title and the reporter who uses the term in the article.
Agreed, it looks like the driver is just trying to keep MateBookServices.exe alive in a dumb way.
My guess is someone had a hard time deciphering MSDN rather than some malicious motivation. I've had to wade through the CreateProcess and svchost docs before, the options and security restrictions are labyrinthine. I'm not sure how some Chinese engineer reading a translation could much better.
Re: Microsoft finds privilege escalation vulnerability in Huawei driver
#19Earlier quoted context omitted.
There is no valid reason, ever, for a driver to do what the Huawei driver did here. That should be obvious given the detection methods that Microsoft implemented in the kernel to find and prevent just this behavior. The Microsoft blog might stop short of calling it malware, but I think we don't need the faux politeness here. The fact that their malware also contained a privilege escalation (the "vulnerability") is me…
I mean, it's goofy, hacky, and has obvious security flaws but doesn't look malicious. Calling it a "backdoor" ascribes a certain intentionality to the vulnerability that's not clear is warranted. It's about the code quality I expect from the management shovelware that comes preloaded on laptops from any major brand. Source: I've written kernel drivers and exploits.
On the other hand a reliable backdoor that also looks like sloppy code is better, as most of us are familiar with truly awful code it’s a nice layer of plausible deniability.
As the full saying goes.
Never attribute to malice what can be explained by stupidity...but don’t rule out malice.
Re: Microsoft finds privilege escalation vulnerability in Huawei driver
#20Earlier quoted context omitted.
There is no valid reason, ever, for a driver to do what the Huawei driver did here. That should be obvious given the detection methods that Microsoft implemented in the kernel to find and prevent just this behavior. The Microsoft blog might stop short of calling it malware, but I think we don't need the faux politeness here. The fact that their malware also contained a privilege escalation (the "vulnerability") is me…
I mean, it's goofy, hacky, and has obvious security flaws but doesn't look malicious. Calling it a "backdoor" ascribes a certain intentionality to the vulnerability that's not clear is warranted. It's about the code quality I expect from the management shovelware that comes preloaded on laptops from any major brand. Source: I've written kernel drivers and exploits.
From Microsoft’s blog post:
Inspecting MateBookService.exe!main revealed a “startup mode” that revived the service if it’s stopped – some sort of watchdog mechanism meant to keep the Huawei PC Manager main service running.
I agree that it’s hard to prove malice, but why should any PC management software go out of their way to ensure that it never gets shut down?