Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft finds privilege escalation vulnerability in Huawei driver

microsoft.com

Post reply on HN
Print view View original

131–138 of 138 posts

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#131

Post by novaleaf »

monocasa wrote: post #115
novaleaf wrote: post #113

Earlier quoted context omitted.

from the article: > While monitoring alerts related to kernel-mode attacks, one alert drew our attention: >The alert process tree showed an abnormal memory allocation and execution in the context of services.exe by a kernel code. Investigating further, we found that an identical alert was fired on another machine around the same time. This shows code injection taking place, via the exploited code. You are right that…

> via the exploited code Their scanner doesn't show any exploitation happening, and they don't say that it does.

I admit that I am reading into the line "abnormal memory allocation and execution" and thinking it's intentional.

You are right that they don't seem to know what code was being executed. Just that some code (be it real code or random garbage) was injected and executed.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#132

Post by monocasa »

zaphirplane wrote: post #130
monocasa wrote: post #116

Earlier quoted context omitted.

It's a huge pain on the ass to setup right. Soft faults where the process is still running but is deadlocked don't get restarted for instance.

Same problem if you write your own supervisor except you are writing a process supervisor

Well, no, because you can write your supervisor in a way that does protect against that. In fact that's hat they're doing here.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#133

Post by monocasa »

novaleaf wrote: post #131
monocasa wrote: post #115

Earlier quoted context omitted.

> via the exploited code Their scanner doesn't show any exploitation happening, and they don't say that it does.

I admit that I am reading into the line "abnormal memory allocation and execution" and thinking it's intentional. You are right that they don't seem to know what code was being executed. Just that some code (be it real code or random garbage) was injected and executed.

It's intentional; it's not "exploitation". It's really doing privilege deescalation of the shellcode.

They know the code it's running for the most part, it's the CreatProcessW stuff they talk about.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#134

Post by will4274 »

yourbandsucks wrote: post #77
will4274 wrote: post #71

Earlier quoted context omitted.

[flagged]

I don't think you engaged with my comment in good faith, here. Falun gong are han Chinese who chose to identify with a particular religious offshoot. That doesn't make them a minority group as westerners understand it. Would you call Mormons minorities?

Yes. I'm an American and America was founded by a bunch of religious offshoots who were being persecuted in their home country for being offshoots (protestants) rather than having the majority religion of their peers (Catholic). Religious minorities are minorities too.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#135

Post by HeWhoLurksLate »

DanielBMarkham wrote: post #105
wyattpeak wrote: post #72

Earlier quoted context omitted.

Not addressing the main point but the aside - I like it when companies have a clear financial interest in solving a problem. Sure I get the warm fuzzies when a company like Google circa 2005 does something to help people with nothing obvious to gain from it. But in my experience companies like Google circa 2005 tend to become companies like Google circa 2019. People acting in their own interest are reliable.

Apologies for digressing, but this is an important point. Instead of the facile happytalk "Don't Be Evil", a much better slogan might be "Be as evil as you want, just don't hide anything from me and let's have an open and honest relationship" Companies keep using the average user's technology ignorance against them. That was kinda cool and probably acceptable when you were the smart kid making a few dollars here or t…

  Companies keep using the average user's technology ignorance against them.
So, then, do OSS things like vsCode, which are made for developers, go in the "Company plays to the users technological strengths" column"?

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#136

Post by HeWhoLurksLate »

skybrian wrote: post #129
kbenson wrote: post #128

Earlier quoted context omitted.

> At a high level, the market is supposed to provide an incentive to serve customers That's not what markets do. Markets are a means of efficiently and accurately pricing things in a responsive way. Some markets don't even have customers. That price may or may not be money, depending on the market in question. > My point is that real-world incentives are never perfectly aligned with such lofty, nebulous goals. For ma…

My point is that "Microsoft benefits from doing something that benefits others" is never going to be entirely true, or at least not for long.

Autodesk benefits from providing students CAD software in school so that they use it in the workplace. This benefits the students, who no longer have to buy a license during college, and benefits them (Autodesk) by making sure they have a "captive market". Gaming the system? Yes- it plays to the needs of poor college students, who then are comfortable with their development environment and don't want to learn another thing, too.

As long as Autodesk is providing this program, students are:

A) not pirating their software,

B) becoming used to their tools (being completely unfamiliar with CAD as an engineer is a bad start), and

C) starting in the Autodesk ecosystem.

As long as students keep using Autodesk's platform, Autodesk is:

A) strengthening its market share

B) able to continue development (because the now-working previously students are using their software)

C) Relevant in the college setting, where professors have a large say in what goes and what doesn't.

There are probably always going to be college students, there are probably always going to be engineering jobs, and engineers will always need to have a CAD package. As long as those two things exist, Autodesk (or any other company with a CAD package) can gain goodwill, ensure relevancy, and invest in their future by giving their software away for free now. This is "gaming" a market in a long-term symbiotic manner.

Full disclosure: I'm an engineering student, in high school, and really appreciate the free copies of Autodesk Inventor and Dassault Systemes' Solidworks that I've gotten.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#137

Post by HeWhoLurksLate »

pbhjpbhj wrote: post #65
mastax wrote: post #62

Earlier quoted context omitted.

Google writes about the bugs they find, Microsoft writes about the bugs they find. What's strange to you?

Meh, I just suspect they're not as forthcoming about bugs they find for their preferred hardware partners no matter how crazily bad they are. Partialism like that makes me distrust them, perhaps my skepticism falls the wrong way here, maybe I'm reading an undercurrent that's not there.

I at least trust that the things they report on to be accurate.

Re: Microsoft finds privilege escalation vulnerability in Huawei driver

#138

Post by HeWhoLurksLate »

YawningAngel wrote: post #96
londons_explore wrote: post #94

Earlier quoted context omitted.

Perhaps they wanted the service killable, but for it to always restart? Considering the physical memory mapping stuff, I wouldn't be surprised if the service doesn't have some roles firmware should have had - for example ensuring the battery charger is stopped when the battery is fully charged to prevent a fire.

That isn't a safe approach, as your laptop becomes a file hazard as soon as you install any other OS (even clean windows!). I'm not sure that this is a more robust mechanism for achieving that outcome than a Windows service in any case.

Perhaps in hardware?
Post reply on HN