Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft, Once Infested with Security Flaws, Does an About-Face

nytimes.com

Post reply on HN
Print view View original

101–110 of 185 posts

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#101

Post by millstone »

blinkingled wrote: post #94
tptacek wrote: post #93

Earlier quoted context omitted.

This is extraordinarily silly. In modern systems security, real security boundaries aren't enforced at the language level. No amount of ObjC message-sending trickery is going to change your UID.

Yeah, I have been around long enough to know you can't change to UID zero by message passing. That is just preposterous to assume. I was talking at the Runtime level - I even cited an app that was calling a runtime method to get list of running apps. Essentially they have no reliable runtime permission model - they rely on obscurity and static scanning to prevent you from passing message to some receivers that they d…

The runtime is trivial to bypass on Android as well: Reflection, NDK, etc. It's not intended to enforce a security policy.

The "receivers that they don't want you to" on iOS is not about security, but correctness, binary compatibility, and app store guidelines. iOS's security model is not defeated by bypassing the ObjC runtime.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#102

Post by ryanpetrich »

blinkingled wrote: post #94
tptacek wrote: post #93

Earlier quoted context omitted.

This is extraordinarily silly. In modern systems security, real security boundaries aren't enforced at the language level. No amount of ObjC message-sending trickery is going to change your UID.

Yeah, I have been around long enough to know you can't change to UID zero by message passing. That is just preposterous to assume. I was talking at the Runtime level - I even cited an app that was calling a runtime method to get list of running apps. Essentially they have no reliable runtime permission model - they rely on obscurity and static scanning to prevent you from passing message to some receivers that they d…

Apple is slowly migrating a massive amount of system features out of private frameworks and into background daemons protected by entitlements or privacy prompts. The end goal is that all sensitive data or hardware features are completely inaccessible from inside the sandbox, neither by private API, nor IOKit, nor syscall, nor direct filesystem access.

Retrieving the application list is a particularly poor example as there used to be a public API that did exactly that: CFPreferencesCopyApplicationList

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#103

Post by blinkingled »

millstone wrote: post #101
blinkingled wrote: post #94

Earlier quoted context omitted.

Yeah, I have been around long enough to know you can't change to UID zero by message passing. That is just preposterous to assume. I was talking at the Runtime level - I even cited an app that was calling a runtime method to get list of running apps. Essentially they have no reliable runtime permission model - they rely on obscurity and static scanning to prevent you from passing message to some receivers that they d…

The runtime is trivial to bypass on Android as well: Reflection, NDK, etc. It's not intended to enforce a security policy. The "receivers that they don't want you to" on iOS is not about security, but correctness, binary compatibility, and app store guidelines. iOS's security model is not defeated by bypassing the ObjC runtime.

No it isn't - if your app did not ask for say a permission to connect to Internet or get a list of apps - there is no way to do that using reflection or NDK or whatever.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#104

Post by mikestew »

Though many comments here speak of engineering flaws, but to me it was a cultural flaw. The most outstanding anecdote I have to illustrate this is when I told my manager that "I can't run that internal test tool (the insect farm thing, for those that were in DevDiv around 2003-ish) that runs 24/7 with complete network access because it requires need> admin privileges."

That nearly got me fired. You read that right: when I point out that a sloppily written application that someone wanted the entire developer division to run was insecure, my manager basically told me to run it or else. If the dev can't even be bothered to not write to PROGRAM_FILES (which is the only reason it needed admin privileges), what other holes does it have? Well, I'm not about to find out on my dev box that's hooked to the corpnet. Running on an internal-only alpha version of the early .NET runtime to boot; what could possibly go wrong? (And as it turned out, nothing went wrong, but still...)

And this was after Valentine's mail was sent. SQL Slammer had already happened. What, you thought the whole company just jumped on the security bandwagon? Yeah, I thought a new day had dawned, too. You can make 'em quit blindly using strcpy, but you won't change their minds with an email even after Valentine asks the whole company to come in and take Slammer support calls.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#105

Post by millstone »

blinkingled wrote: post #56
tptacek wrote: post #36

Earlier quoted context omitted.

There are a lot of great people at Apple and the security model of iOS is an achievement --- in a lot of practical ways better than that of Android. But I do not know a lot of people who would argue the Apple has a better security program than Google does. Google's team is better funded and better staffed, and has a much broader charter than Apple's.

> in a lot of practical ways better than that of Android. Umm no - the update situation is better on iOS but fundamentally iOS has bigger problems - https://twit.tv/shows/security-now/episodes/532?autostart=fa... . That problem is unfixable easily due to the way ObjC works. Android gets code access control for free with Java. There have always been Jailbreaks for most iOS versions and it's not like they haven't had o…

Java's access controls are trivial to bypass on Android. Neither the Android or iOS runtimes are there to enforce a security policy.

You should read Apple's iOS Security Whitepaper: http://www.apple.com/business/docs/iOS_Security_Guide.pdf See for example the data protection classes: a very thoughtful design, with no analog in Android, and that certainly could not have come about by "happenstance."

Heck, Android doesn't even encrypt your data by default! That alone makes iOS "fundamentally more secure."

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#106

Post by caskance »

vox_mollis wrote: post #88
mtgx wrote: post #2

Too bad it's doing the opposite on the privacy front, trying to collect more data than ever about Windows users, by default.

This is the salient point. What good is platform security when the platform is keylogging and shipping telemetry to a third party not in your control?

Which third party is this?

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#107

Post by millstone »

blinkingled wrote: post #103
millstone wrote: post #101

Earlier quoted context omitted.

The runtime is trivial to bypass on Android as well: Reflection, NDK, etc. It's not intended to enforce a security policy. The "receivers that they don't want you to" on iOS is not about security, but correctness, binary compatibility, and app store guidelines. iOS's security model is not defeated by bypassing the ObjC runtime.

No it isn't - if your app did not ask for say a permission to connect to Internet or get a list of apps - there is no way to do that using reflection or NDK or whatever.

And on iOS, if your app does not receive permission to access your location or contacts or camera or Internet, there's no way to do that by using objc_msgSend or whatever.

On both platforms, these security policies are enforced at the process boundary, not by the runtime.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#108

Post by smacktoward »

quanticle wrote: post #84
hackuser wrote: post #55

Earlier quoted context omitted.

> UAC was one of the biggest security improvements I assumed it was just an interface stapled onto the old system, and something underneath that allowed changing permissions without logging off. It might have had a big effect, but it doesn't sound like a significant change in the system. But maybe my assumptions are wrong ...

The entire concept of UAC and programs not running by default was introduced in Vista. It was such a big change that it pretty much ruined the reputation of the OS, single-handedly. I remember that one of the major complaints about Vista was the number and intrusiveness of UAC prompts, which occurred because programs were doing things like keeping settings in C:\Program Files, rather than the user's application data…

This, exactly.

Vista is now my go-to example for when people managing platforms say "just break badly written applications, their incompetence is their problem, not ours." Microsoft took a staggering PR hit when all sorts of crappy, poorly-written applications broke under Vista, because their users all blamed Microsoft for it. People don't know their applications are crappy under the hood; all they know is that they used to work, and now they don't.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#109

Post by keithpeter »

tootie wrote: post #100
tim333 wrote: post #79

Earlier quoted context omitted.

Though Microsoft have improved their computers still often come laden with crapware much of the time unlike Apple or I think most Chromebooks. You then end up with stuff like Superfish if you're not lucky.

I buy the PCs for him and personally remove the crapware. He just clicks on random stuff. If it tells him to buy something, he buys it.

hosts file?

http://winhelp2002.mvps.org/hosts.txt

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#110

Post by mejari »

loginusername wrote: post #35

"All software is large." FALSE. But this statement does not surprise me. It is this distorted view of programs that is a large part of the "security" problem, in my opinion.

Saying it is false and calling views "distorted" does nothing to further the conversation. If you're interested in furthering conversation on the subject try providing reasoning behind your statements instead of condescension.
Post reply on HN