Microsoft, Once Infested with Security Flaws, Does an About-Face • Hacker News Board

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#111

Post by blinkingled » Wed, Nov 18, 2015, 9:41 PM UTC

millstone wrote: post #105

blinkingled wrote: post #56

Earlier quoted context omitted.

> in a lot of practical ways better than that of Android. Umm no - the update situation is better on iOS but fundamentally iOS has bigger problems - https://twit.tv/shows/security-now/episodes/532?autostart=fa... . That problem is unfixable easily due to the way ObjC works. Android gets code access control for free with Java. There have always been Jailbreaks for most iOS versions and it's not like they haven't had o…

Java's access controls are trivial to bypass on Android. Neither the Android or iOS runtimes are there to enforce a security policy. You should read Apple's iOS Security Whitepaper: http://www.apple.com/business/docs/iOS_Security_Guide.pdf See for example the data protection classes: a very thoughtful design, with no analog in Android, and that certainly could not have come about by "happenstance." Heck, Android does…

> Java's access controls are trivial to bypass on Android.

You keep repeating that but I am certain you don't understand what you are talking about. Go download the Android SDK, emulator and write an app that does that and post it on Github We will talk about it then.

Also - I'll leave this here - http://www.macrumors.com/2015/10/19/apple-to-remove-hundreds...

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#112

Post by smacktoward » Wed, Nov 18, 2015, 9:44 PM UTC

delish wrote: post #96

quanticle wrote: post #84

Earlier quoted context omitted.

The entire concept of UAC and programs not running by default was introduced in Vista. It was such a big change that it pretty much ruined the reputation of the OS, single-handedly. I remember that one of the major complaints about Vista was the number and intrusiveness of UAC prompts, which occurred because programs were doing things like keeping settings in C:\Program Files, rather than the user's application data…

I've used Linux for many years, but I've always defended Vista. The other complaint about Vista was excessive resource use. I tell people that When XP came out, Intel released the Pentium 4. When Vista came out, Intel released the Core 2 Duo. I'm conflating processor date with date-you-could-buy-a-computer-with-that-chip, but still: Pentium 4 is a world away from Core. Windows Vista does a lot more than XP. The compl…

The real problem with Vista and resource use came from the OEMs. Details here: http://blog.seattlepi.com/microsoft/2008/02/27/full-text-mic...

Microsoft has a program where they certify that hardware will work acceptably with their operating systems. This is important in the run-up to a new version of Windows, because during the period when everyone knows that Windows X+1 is coming soon but all you can buy off the shelf are machines with Windows X, people want to be confident that they'll be able to upgrade to Windows X+1 when it's available.

For Vista, if your machine passed this certification, you got the right to ship it with a shiny sticker that said "Vista Ready." Seeing the "Vista Ready" sticker on that XP laptop on the shelf at Best Buy told customers that they could buy it without fear. It was certified future-proof.

However, Vista required more resources than XP did to run with acceptable performance. That meant that OEMs had a ton of ultra-cheap XP machines in the pipeline that could not with a straight face be called "Vista Ready." And this was a problem, because they didn't want to get stuck with warehouses full of machines nobody would buy because they couldn't run Vista.

So what they pushed for, and what MS eventually gave them, was a new certification: "Vista Capable." Unlike "Vista Ready," "Vista Capable" didn't mean Vista would run well on the hardware in question. It just meant you could install Vista on it, with no guarantees as to how it would actually run. And the shiny "Vista Capable" sticker looked pretty much exactly like the shiny "Vista Ready" sticker, so if you weren't looking carefully, it was easy to confuse the two.

The OEMs loved this solution, because they could now slap "Vista Capable" stickers on all those crappy XP machines and unload them on people. But, entirely predictably, then Vista came out and suddenly tons of people were installing it on hardware that was nowhere near beefy enough for it. So for umpty-ump millions of people who bought that crappy hardware, the experience of using Vista was painful and awkward and slooooow. Eventually even the cheapest machines were powerful enough to meet Vista's requirements -- but by that point Vista's reputation had been sealed. As the saying goes, you never get a second chance to make a first impression.

But the OEMs did get all that inventory out of their warehouses. So, you know, mission accomplished.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#113

Post by Justsignedup » Wed, Nov 18, 2015, 9:46 PM UTC

pcwalton wrote: post #76

ChuckMcM wrote: post #57

Earlier quoted context omitted.

Not that weird. Illustrative perhaps. So you and I would have agreed in 2007 that Windows was much better at security than they had been, but we are both pretty tightly connected to the technology market. Today, 8 years later, my Mom and Dad think Windows is a "secure" system as they haven't had any issues for long enough that their opinion of it has changed. The final leg of this journey will be when Windows + Windo…

> I'm curious why you mention Google though, their security record on Android is a lot worse than either Windows phone or IOS. In many ways I feel like they are exactly Windows in 2003 with regard to "its secure if you use our APIs" kind of security. Chrome (OS)'s security model is a lot better, and compared to Android it was designed more in-house. Android was an acquisition and has more legacy design baggage (thoug…

Android's security is actaully fantastic. The problem is the inability for google to distribute security updates. In 6.0 I now get monthly security updates and there is even a "security update version" of like "november 2015" in the status.

The latest junk even made it into Android 4.1 devices for security updates. But that is neither here nor there, the fact that we have 4.1 devices is a problem.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#114

Post by robotresearcher » Wed, Nov 18, 2015, 10:04 PM UTC

loginusername wrote: post #15

"Microsoft was once the epitome of evrything that is wrong with security in technology." Certainly they have improved over the last decade, but who hasn't? Not to mention they have boatloads of cash to throw at the problem. But the fact^W opinion remains Windows is still the easiest target of any OS. A user can configure any OS to be less secure, and other OS can become as popular a target as Windows but there's some…

> How are you ever going to assess the quality of this software in terms of security?

If it's very important to you, you can obtain a license that includes source code:

https://www.microsoft.com/en-us/sharedsource/

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#115

Post by [deleted] » Wed, Nov 18, 2015, 10:04 PM UTC

millstone wrote: post #105

blinkingled wrote: post #56

Earlier quoted context omitted.

> in a lot of practical ways better than that of Android. Umm no - the update situation is better on iOS but fundamentally iOS has bigger problems - https://twit.tv/shows/security-now/episodes/532?autostart=fa... . That problem is unfixable easily due to the way ObjC works. Android gets code access control for free with Java. There have always been Jailbreaks for most iOS versions and it's not like they haven't had o…

Java's access controls are trivial to bypass on Android. Neither the Android or iOS runtimes are there to enforce a security policy. You should read Apple's iOS Security Whitepaper: http://www.apple.com/business/docs/iOS_Security_Guide.pdf See for example the data protection classes: a very thoughtful design, with no analog in Android, and that certainly could not have come about by "happenstance." Heck, Android does…

[deleted]

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#116

Post by amatwl » Wed, Nov 18, 2015, 10:35 PM UTC

joshyeager wrote: post #51

hackuser wrote: post #49

Earlier quoted context omitted.

> professional security people would have told you the same thing back in 2007 Did they really turn it around that fast, in one iteration of Windows (XP was released 2001, Vista in 2007)? I would think that fixing bugs would be necessary but not nearly sufficient, and they would have had to re-architect and re-develop major parts of the system. And Microsoft needed to do that while maintaing the backward compatibilit…

Vista was a major security redesign, not just bug fixes. UAC was one of the biggest security improvements in the OS, because it meant that users were no longer running as admin by default.

UAC is not a security feature/ boundary (even according to MSFT themselves). It was aimed to help stop ISVs from writing software assuming admin privileges.

Vista had A LOT of security improvements overall, but UAC shouldn't be considered as one of them (similar to PatchGuard for x64 Windows - it's cited as sometimes a security feature, but it's not).

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#117

Post by btilly » Wed, Nov 18, 2015, 10:38 PM UTC

blinkingled wrote: post #103

millstone wrote: post #101

Earlier quoted context omitted.

The runtime is trivial to bypass on Android as well: Reflection, NDK, etc. It's not intended to enforce a security policy. The "receivers that they don't want you to" on iOS is not about security, but correctness, binary compatibility, and app store guidelines. iOS's security model is not defeated by bypassing the ObjC runtime.

No it isn't - if your app did not ask for say a permission to connect to Internet or get a list of apps - there is no way to do that using reflection or NDK or whatever.

I don't know about the latest version of iOS, but your statement was certainly wrong just 2 years ago.

See https://www.usenix.org/system/files/conference/usenixsecurit... for details of how to write an app that bypasses App Store review but will have security holes that allow your app to access APIs at runtime with no notification that it was not supposed to have access to.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#118

Post by amatwl » Wed, Nov 18, 2015, 10:43 PM UTC

hackuser wrote: post #55

joshyeager wrote: post #51

Earlier quoted context omitted.

Vista was a major security redesign, not just bug fixes. UAC was one of the biggest security improvements in the OS, because it meant that users were no longer running as admin by default.

> UAC was one of the biggest security improvements I assumed it was just an interface stapled onto the old system, and something underneath that allowed changing permissions without logging off. It might have had a big effect, but it doesn't sound like a significant change in the system. But maybe my assumptions are wrong ...

UAC in Vista essentially introduced the idea of a "split token". Administrators get two access tokens: a full access token, and a filtered access token. The filtered access token essentially is a standard user token and used by default. Only when elevating (UAC is prompted) is the full access token used (which is the filtered access token plus various admin-level privileges).

Each token has different privileges on what it allows/ doesn't allow. One notable change in Vista was the introduction of SetTimeZonePrivilege, since in XP, you had to be an adminstrator in order to change the time.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#119

Post by millstone » Wed, Nov 18, 2015, 10:43 PM UTC

blinkingled wrote: post #111

millstone wrote: post #105

Earlier quoted context omitted.

Java's access controls are trivial to bypass on Android. Neither the Android or iOS runtimes are there to enforce a security policy. You should read Apple's iOS Security Whitepaper: http://www.apple.com/business/docs/iOS_Security_Guide.pdf See for example the data protection classes: a very thoughtful design, with no analog in Android, and that certainly could not have come about by "happenstance." Heck, Android does…

> Java's access controls are trivial to bypass on Android. You keep repeating that but I am certain you don't understand what you are talking about. Go download the Android SDK, emulator and write an app that does that and post it on Github We will talk about it then. Also - I'll leave this here - http://www.macrumors.com/2015/10/19/apple-to-remove-hundreds...

> write an app that does that

Here's a sample of how to invoke `Activity.savedDialogKeyFor`, which is private:

    Method privateMethod =
        Activity.class.getDeclaredMethod("savedDialogKeyFor", int.class);
    privateMethod.setAccessible(true);
    String result = (String)privateMethod.invoke(this, 42);
    System.out.println("Got result: " + result);

Worked perfectly on Android Marshmallow emulator. As I said, it's trivial.

> Also - I'll leave this here

What's your point? There was no security exploit here, and no security policy can realistically prevent networked apps from sharing data like your email address. That falls to the review process.

What's remarkable here is how little data this malware was actually able to capture. Certainly less than on Android, where users routinely grant excessive permissions, like giving Netflix access to your phone.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#120

Post by blinkingled » Wed, Nov 18, 2015, 10:55 PM UTC

millstone wrote: post #119

blinkingled wrote: post #111

Earlier quoted context omitted.

> Java's access controls are trivial to bypass on Android. You keep repeating that but I am certain you don't understand what you are talking about. Go download the Android SDK, emulator and write an app that does that and post it on Github We will talk about it then. Also - I'll leave this here - http://www.macrumors.com/2015/10/19/apple-to-remove-hundreds...

> write an app that does that Here's a sample of how to invoke `Activity.savedDialogKeyFor`, which is private: Method privateMethod = Activity.class.getDeclaredMethod("savedDialogKeyFor", int.class); privateMethod.setAccessible(true); String result = (String)privateMethod.invoke(this, 42); System.out.println("Got result: " + result); Worked perfectly on Android Marshmallow emulator. As I said, it's trivial. > Also -…

You're confusing accessing private methods with violating the Android permissions model. Two totally separate things.

Edit: Also my larger point was the iOS security is not fundamentally better than anything else. The closed nature, restrictive policies etc. help but fundamentally it's nothing outstanding. It was a response to tptacek claiming opposite.