Using Binary Diffing to Discover Windows Kernel Memory Disclosure Bugs

https://googleprojectzero.blogspot.com/2017/10/using-binary-diffing-to-discover.html

by Rondom • 9 years ago

180 79 9 years ago

googleprojectzero.blogspot.com

mappu• 9 years ago

I know some Windows 7 holdouts, who either prefer the interface or they're against telemetry. That was a defensible position as long as 7 was still under security support, but these findings put an end to that. Time to switch, and -1 trust in Microsoft's lifecycle statements.

marksomnian2• 9 years ago

But why don't they just switch to Windows 8? It solves all their problems.

jm547ster• 9 years ago

Basically are if they’re moving to 10. It’s more or less a re-skin with added telemetry & Cortana. Personally I preferred 8 to 7, I guess the touchscreen oriented metro interface was enough for desktop purists to recoil in horror. Was really only “hardcore” gamers who were holder-outers anyway

dom0• 9 years ago

Windows 7 still has about 50 % market share. That's more than just some holdouts, over all.

tdb7893• 9 years ago

In my experience much of that is corporations which are always slow to switch. Almost all the people who buy windows machines I know have gotten windows 10

DigitalJack• 9 years ago

Gp was speaking specifically about some holdouts they know.

Analemma_• 9 years ago

We need a cultural shift in this industry away from thinking it’s OK to run outdated and vulnerable software. “Why should we upgrade? $OLD_VERSION works fine!” Yeah, and driving a car with no seatbelts or airbags works fine too... until it doesn’t.

inferiorhuman• 9 years ago

Sure that's great, but air bags and seat belts also come with cameras that record your behavior and report back to the auto manufacturer. And ads.

jenscow• 9 years ago

But Windows 7 is still being supported (or so they say).

panic• 9 years ago

Many people running Windows 7 aren't "in this industry" -- they're ordinary people trying to use their computers to do work, or play games, or keep in touch with other people. What our industry needs to do is stop building software full of crap (ads, spyware, bugs) people don't want. If the software is good, people will upgrade.

bobcostas55• 9 years ago

If 10 wasn't seen as an enormous downgrade people would treat the vulnerability issues more seriously. Just the other day I saw a huge powershell script whose purpose was to remove all the bloatware (which apparently re-installs itself on its own if you uninstall it normally). I don't want to bother with that stuff...

And on top of that you have the telemetry, endless horror stories of forced restarts for updates, updates resetting settings and/or degrading performance (which took 5 months to resolve in the case of the Creators Update: https://betanews.com/2017/09/11/windows-10-game-performance-...)...7 works like clockwork, with no bullshit.

ksk4• 9 years ago

It seems like Microsoft has "learnt" from Chrome and the whole web-apps ecosystem where the users are conscripted into accepting continuous updates. I don't doubt that the average user is better off, but they should be making escape-hatches available for the technical folks who wish to exert a greater level of control over machines they administer.

userbinator• 9 years ago

Yeah, and driving a car with no seatbelts or airbags works fine too... until it doesn’t.

People still ride motorcycles, many times more dangerous, which proves that (IMHO fortunately) safety/security is NOT the only thing that everyone cares about.

The general authoritarianism in the comments here, and implication that everyone always and only wants "more secure", while neglecting all the other factors, is a bit unsettling...

As the old saying goes, "Those who sacrifice freedom for security deserve neither."

Oxitendwe• 9 years ago

It is one of the greatest failings of our industry that we are apparently incapable of constructing programs that are in any sense "complete" due to requiring vast amounts of upkeep just to ensure their most basic possible property: that their semantics are defined completely by their source code and not inputs (as is not the case with programs containing remote code execution or escaping bugs like SQL injections, XSS, etc). This constant upkeep not only has an enormous cost in terms of time spent modifying these programs to move them asymptotically closer to a version with clearly defined semantics, but (unlike other classes of bugs which involve incorrect behavior that do not have implications for security) produce an air of mistrust and a general malaise and lack of confidence in all software.

One direct implication of this fact, for programs which must be constantly updated to fix their security flaws, is that because the only semblance of trust and security you can obtain in using this software comes from its popularity and reputation (because these things generally mean a large amount of resources can be spent auditing and testing ("many eyes make all bugs shallow"), and because a large userbase means that any bugs found will be more valuable and more difficult to find, and thus less likely to be used against people who are not profitable to be hacked, which is most people), viably forking large projects becomes impossible without a similar or proportional amount of resources to the original project. Without that, having confidence in the new project becomes much more difficult, because you cannot receive an assurance that bugs found in the original project will be fixed in the fork, and because bugs found in the fork might be easier to find (because of less thorough testing, because of fewer resources) and so of less value, and so have a higher chance of ending up in the hands of low-level skiddies who might use them even less responsibly than e.g. the NSA (who has never directly installed ransomware on anyone's computer, that I know of). None of this of course is mentioning the effect this culture of fear and mistrust (and its basis in reality) has on computer users who truly are valuable targets, and must use computers to do their job knowing full well that they are a mire of both intentional and unintentional security vulnerabilities and that somewhere out there exists a string of exploits that can be used to exfiltrate their IP address and send them straight to the gulags.

Another cost of this unfortunate facet of computer programming is that for programs which cannot be directly updated (for example, their source code is not available), modifying them so that they are closer to a version with clearly-defined semantics is extremely difficult, involves specialized skills which are not possessed by most programmers, and generally just doesn't happen very often. Although one could also make this an argument in favor of source code availability, in any case this is a very common occurrence.

So, I don't think at all that the problem is this culture of foolishly thinking that we actually know how to write programs - the problem is that we can't. The solution then, at least in the long term, is learning how to write complete programs that do not require constant adjustments in order to ensure clearly defined semantics, not to just figure out how to stay afloat better in this horrifying quagmire of shifting quicksand that we've built the foundations of computer software on.

c3534l• 9 years ago

I think the fact that consumers don't feel like they have an alternative is a problem. Also, remember many people use their computers for purposes that require no security measures be taken. Who cares if someone hacks a computer that is only used for excel and casual web-browsing?

serf• 9 years ago

it's not about the use-case of the victim, it's about the system resources it adds to the pool for the attacker to use as they wish.

Now add "offline" to your list and i'd agree. Every online node is a potential threat not to just the direct victim but to potentially anyone else on the net.

comex• 9 years ago

Who cares if someone hacks a computer that is only used for excel and casual web-browsing?

I’d say most users would care if all their Excel documents got encrypted by some ransomware. Backups help, but they’re not a silver bullet, and the type of unsophisticated user you’re depicting probably doesn’t have them anyway.

Aside from that - does that casual web browsing include anyone checking their email? If so, now the attacker can probably get full access to their email account(s). Even a purely automated attack can send spam or scams to the user’s contacts, which is bad, though arguably not the end of the world. If a human attacker is targeting the user individually, they can do much worse - starting with using the email account as a stepping stone to all their other accounts, and limited only by their imagination. I suppose that most users aren’t likely to be targeted in that way, but you never know.

gspetr• 9 years ago

There's usually more to that than those 2 use cases: https://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hac...

gadling• 9 years ago

But Windows 7 is still under security support and will be till Jan 2020. (See here: https://support.microsoft.com/en-us/help/13853/windows-lifec...)

saulrh• 9 years ago

Misparse, I think. Both "was"es refer to the state of using 7 being defensible. Maybe a better phrasing: Using 7 would have remained defensible as long as it had security support, but now even that's insufficient. Alternatively, the parent argues that 7 is de facto unsupported now no matter what Microsoft claims.

cjsuk• 9 years ago

Time for class action.

Fej• 9 years ago

Telemetry was backported to 7/8.

I imagine it's not as bad as the 10 telemetry, but still, it's there.

CtrlAltT5wpm• 9 years ago

Removing the telemetry on Windows 7 (or 8.1, where I'm at) is far easier than the questionably effective flaming hoops you have to jump through to do the same on 10. It's a matter of uninstalling a few updates and that's more or less it. I've disabled automatic updates as well, but check daily to make sure I'm up to date as far as security is concerned.

discreditable• 9 years ago

I've long suspected that Microsoft (and other large players) only most eagerly support their latest product. Long-term support is only done begrudgingly. In Microsoft's case, I recall a few Office updates over the past 2yrs that boned up Outlook 2013 for some folks but relatively few affected Outlook 2016.

katastic• 9 years ago

Windows 7 is still supported. Geez. It came out in >>2009<<.

Also, Windows 10 bricks every one of my lower end computers. Windows Defender, Telemetry, and more eat 100% disk usage. It's indefensible. Worse, Windows 10 refuses to let you CORRECT the problem. They make new user accounts that are ABOVE the user's top permissions so you have to go to insane lengths to disable a service.

And I say all of this as someone who professionally supports Microsoft installations. There's NO need to defend Microsoft in places that don't need it. They're big boys. They should just get their shit together and handle criticism.

Like why did it take 15+ years to get proper rescalable command prompt, or virtual desktops? I've got literally dozens upon dozens of stories of Microsoft products being half invented, half completed and half reliable, and MSDN documents that companies rely on for $$$ decisions that end up being erronious or conflicting with other KB articles.

aspenmayer• 9 years ago

I don't get this recent usage of "brick." Unless it cooks the CPU or is otherwise non-bootable after installing 10, persisting even through other boot media, that isn't a brick. I've seen upgrades fail due to many issues including prior OS corruption and failing storage media, but clean installs of Windows 10 work nearly every time on nearly any hardware that supports ACPI. Driver issues notwithstanding, I don't see anything to support your assertion that Windows 10 bricks lower end PCs. And if the hardware is older than that, it isn't worth your time to even install any other OS on, is it? Diminishing returns.

Not meant to be a criticism, I'm just curious what specific issues you were having that you articulate as bricking.

hyperman1• 9 years ago

Does someone know a reliable source of the windows telemetry story today. Googling gives a huge bunch of articles which are out of date, or filled with random assertions from random people. I would be very gratefull for: * Exact, technical-level details of what each windows version (7-8-10) is monitoring ('Basic Health and Quality' says nothing). * How to disable it. So it stays off * And some kind of technical proof (Like a wireshark trace or something)

snaky2• 9 years ago

Things tend to change anyway. You never know what Microsoft will roll out tomorrow.

Microsoft has responded to claims that its Windows 10 Enterprise operating system ignores user preferences in Group Policy with the advice that, basically, it does and you shouldn't meddle with it.
On Monday, we revealed that a security researcher had used a packet sniffer to show that many settings designed to prevent access to the internet were being ignored with connections to a range of third-party servers

https://www.theinquirer.net/inquirer/news/3010547/microsoft-...

Brybry• 9 years ago

It's more than just telemetry or the interface. It's about taking some step forwards, and many more steps backwards.

Sure, they made an OS that was better for the world because it forces options that mitigate the damage computer illiterate users were doing but at the expense of usability for power users.

For example, picking and choosing windows updates is a much worse process in Windows 10. There's a lot more bloat in general that is a lot harder/more annoying to turn off than the bloat in previous versions of Windows.

There are design choices that make working around bugs harder. For example, my friend currently has a serious performance hit if Windows Defender's real time monitoring is on. Windows 10 can automatically turns real time monitoring back on if you turn it off, even if you set a group policy and registry settings to disable it.

He'll probably end up disabling Windows Defender entirely just because Microsoft can't trust users to manage their own settings.

acdha4• 9 years ago

For example, picking and choosing windows updates is a much worse process in Windows 10.

That’s because this is a bad idea for almost all users: it increases the odds of updates not being installed or people having problems due to an untested combination of updates which wouldn’t have happened if they’d installed everything.

Similarly, if Windows Defender does have a notable performance issue beyond what’s typical for AV as a class, the right way to avoid it is to install a separate AV rather than running an Internet-connected system without it.

NiveaGeForce5• 9 years ago

Windows 10 should work fine by default

https://np.reddit.com/r/Windows10/comments/74xc2z/windows_an...

NiveaGeForce5• 9 years ago

Windows 10 is also much more efficient

https://np.reddit.com/r/Windows10/comments/74xc2z/windows_an...

And more secure

https://np.reddit.com/r/Surface/comments/6ifyxq/spotify_for_...

sqldba2• 9 years ago

I see that the two they fixed disclosed more memory than expected - but is that enough reason to fix it? It seems like you’d probably want a complete POC before fixing them. Or are there common POCs that these obviously fall into?

bonzini2• 9 years ago

Kernel memory disclosure pretty much always provides an easy way to bypass kernel address randomization (KASLR).

tankenmate• 9 years ago

For those not fully aware of why; if you can get a copy of a section of the kernel stack (which should have been zeroed but wasn't) you'll get the kernel memory (which is different from user memory) addresses of function calls, data structures, etc which then allow you target where to insert your own code / data. In other words it allows you to accurately hijack kernel functions and/or compromise kernel data structures, e.g. change the owner of a kernel object, process or task. It's half of what you need to compromise the kernel (you now know where to inject code/data). The other is having a way to inject code/data.

EDIT - grammar fix.

chris_wot• 9 years ago

I'm still trying to work out when they fixed this:

https://bugs.documentfoundation.org/show_bug.cgi?id=62764

They got memory dumps from me, but never got back to me about it. It was incredibly poor form, I literally rebuilt systems from scratch to get them the memory dumps, and they never even told me if it helped.

Pretty shitty really. I found a nasty issue, and all I wanted was to know if they were going to fix it. Hell, I didn't even want credit - just knowing it was fixed would have been great.

bonzini2• 9 years ago

They probably didn't even realize they were fixing it. That happens sometimes.

Using Binary Diffing to Discover Windows Kernel Memory Disclosure Bugs

Related Stories