Google's Project Zero exposes unpatched Windows 10 lockdown bypass

https://www.zdnet.com/article/googles-project-zero-reveals-windows-10-lockdown-bypass/

by _o_ • 8 years ago

225 117 8 years ago

ge0rg2• 8 years ago

Original source: https://bugs.chromium.org/p/project-zero/issues/detail?id=15...

saagarjha3• 8 years ago

Could someone who’s more knowledgeable about how Windows works than I am provide a semi-technical explanation of how this works?

campuscodi• 8 years ago

Yeah. It's not as severe as the article makes it seem. It's just a bypass in a very insignificant component for which you need 2-3 other vulns to exploit.

I presume the editor just wanted to put an article out with Microsoft and Project Zero in the title, rather than analyze the actual flaw in the context of its severity.

pjc50• 8 years ago

There is a lockdown mode which restricted which COM objects could be instantiated from .net code to a short whitelist.

The whitelist is based on GUID. The lookup of GUID to actual binary is done through the registry.

COM hosting implementations should check that the object they got is the one they asked for. Net doesn't. So if you can write to the registry you can escape the sandbox.

foepys• 8 years ago

Denying the deadline extension to May 8th [1] is quite a dick move by Google, considering that it took them 6 months to fix the extremely harmful sitemap ranking bug in their search engine[2]. And after they fixed the bug, they only paid peanuts to the researcher for a bug that could've cost Google's customers tens of millions in misplaced ad campaigns.

1: https://bugs.chromium.org/p/project-zero/issues/detail?id=15...

2: http://www.tomanthony.co.uk/blog/google-xml-sitemap-auth-byp...

saagarjha3• 8 years ago

It seems that the researcher was relatively happy with the outcome. They could have certainly gone public far earlier if they had chosen to do so.

JumpCrisscross• 8 years ago

that could've cost Google's customers tens of millions in misplaced ad campaigns

You're comparing an operating system security bug to advertisers' lives being made inconvenient.

pookeh• 8 years ago

Yeah so? Both involve tons of money.

jhall14682• 8 years ago

First of all, Google has no responsibility to give any period of time. It isn't a "dick move". Second, the researcher in question:

1) Never gave a required date for disclosure. 2) Upon requesting the right to disclose, was told no and he followed suit. 3) Was initially offered a bug bounty of $1300, which was upgraded to $5000. He apparently never bartered on that issue at all.

So your entire post was completely irrelevant.

s2g5• 8 years ago

Disclosing unpatched vulnerabilities when the company is asking for an extension of a few weeks to patch is absolutely a dick more and extremely irresponsible.

dingo_bat• 8 years ago

First of all, Google has no responsibility to give any period of time.

Any security researcher has a responsibility to disclose a vulnerability in such a way that it does not cause widespread damage. I don't know why you would think otherwise.

shawnz• 8 years ago

First of all, Google has no responsibility to give any period of time. It isn't a "dick move".

The motivation of the project is supposedly to protect Google's users. Being firm on disclosure deadlines helps ensure that vendors take the issue seriously. Did they have any indication that Microsoft wasn't taking this seriously? If not, then it sounds like their true motivation is elsewhere.

emiliobumachar• 8 years ago

Bartering on reward money before disclosure can easily look like -or be- blackmail.

avttre• 8 years ago

Why 90 days? Why not 30, 14, or 7? Microsoft might have requested responsible disclosure for exploits affecting Windows, but what gave Google the right to set a deadline?

I feel the 2 US companies have a friendly competition with each other which can help secure their systems.

saagarjha3• 8 years ago

Nobody has any right to set a deadline. The 90 days is merely Google being courteous.

fintler• 8 years ago

For something installed on so many devices, 90 days seems like an incredibly tight timeframe to change anything.

alkonaut• 8 years ago

For a bug that should take no more than a few days to patch and test 90 days seems like more than enough for a product with automatic security updates.

For a bug with completely unknown scope and very difficult fixes (such as the recent intel issues) the story might be different. But 90 days here? Why would Microsoft need more than that?

Buge3• 8 years ago

The right to freedom of speech means Google can say what they want when they want about the vulnerability, giving them the right to set a deadline.

There are certainly companies doing much worse than setting 90 day deadlines. For example VUPEN, Hacking Team, and GrayKey selling undisclosed vulnerabilities to "good" governments, and other companies servicing the shadier governments[1].

[1] https://www.bloomberg.com/news/features/2017-01-18/the-post-...

pbhjpbhj2• 8 years ago

The right to freedom of speech means Google ...

Surely it means specific people employed by Google may "speak". Does the right extend to corporations?

lvh10• 8 years ago

What gives Microsoft the right to set the deadline? It’s their bug, and the bad guys aren’t going to stop using a bug because Microsoft has decided to be slow at patching.

andrewguenther• 8 years ago

To people calling this a dick move by Google, I encourage you to look at the actual issue in Monorail. The reason given for not extending the deadline was that the issue is not particularly severe, and there are also similar bypass issues which are currently unpatched. If it isn't going to help protect customers, what's the point in granting an exception?

https://bugs.chromium.org/p/project-zero/issues/detail?id=15...

cesis• 8 years ago

My thinking would be exactly the opposite - severe bugs have to be disclosed sooner while non-severe can be left lingering around.

eganist4• 8 years ago

And Google has actually had a track record of using that reasoning as well, so it's not like their words actually mean much. Great example of a drive-by high-sev exploit getting exposed long before Microsoft could patch: https://www.digitaltrends.com/computing/google-project-zero-...

I appreciate the work they do, and I sure as hell appreciate the talent, but Google is mostly treating this entire endeavor as a giant marketing and recruiting trick.

(It worked well; they stole my favorite pentester from one of my preferred boutique consulting firms.)

braythwayt• 8 years ago

Alice: "My bug isn't particularly severe, and there are similar issues from Bob and Carol. If it isn't going to protect customers, what is the point in fixing it?"

Bob: "My bug isn't particularly severe, and there are similar issues from Alice and Carol. If it isn't going to protect customers, what is the point in fixing it?"

Carol: "My bug isn't particularly severe, and there are similar issues from Alice and Bob. If it isn't going to protect customers, what is the point in fixing it?"

oh_sigh• 8 years ago

That preexisting exploit has been known since at least August 3 2017, so it's not like MS is scrambling to fix these.

lvh10• 8 years ago

Because attackers only need 1 of the bugs to work? The argument only tenuously holds for disclosure to begin with, but it doesn’t make sense at all for patching.

Also, the other bug has been known, with POC, for more than half a year.

VMG• 8 years ago

it seems that cartels are sometimes very useful

Dylan168073• 8 years ago

First off, this is about disclosure, not fixing.

Second, you're neglecting the time aspect.

This is a valid argument: "There's a similar issue that microsoft hasn't bothered patching for months, so what's the point in keeping it secret?"

This is not a valid argument: "In a few months there will be a similar issue, so what's the point in keeping it secret?"

So there is no loop leading to mistakes.

dewiz• 8 years ago

Google, you have 90 days to stop tracking web users, then Windows will start asking desktop users if they would like to block tracking by filtering DNS requests

ILikeConemowk• 8 years ago

I would pay to see this happen.

"Google, we believe in our user's right to privacy and are looking for ways to improve their experience on our platforms. Due to your non-compliance with the upcoming GDPR and past misdeeds we have classified all your services as spyware and will be protecting our users accordingly should you fail to address this matter in 90 days from now.

Kisses, Microsoft."

mtgx• 8 years ago

I think you know why Microsoft won't do that. They do the same kind of tracking in Windows 10.

They had an opportunity to actually hurt Google by blocking tracking scripts long ago with their "Do Not Track" feature enabled by default in its browser. And they wasted it by simply asking advertisers like Google nicely if they'd like to stop tracking users or not (you'll never guess what happened next!).

Microsoft has already been found violating previous and less strict EU privacy laws recently. I think Google, Microsoft, Facebook, Amazon - they'll all end-up paying big fines in the EU within 18 months after the GDPR passes, because neither take it seriously enough and they still think they can use "angles" to trick the regulators as well as users into getting that data without real consent. They can't, and they'll learn it the hard way.

Oh, and the Privacy Shield will likely fall by the end of the year, too. So brace yourselves, it's going to be a wild ride for these privacy violators.

Oletros• 8 years ago

" Due to your non-compliance with the upcoming GDPR "

Honest question, why is Google not in compliance with GDPR?

nl2• 8 years ago

Just think about it before you ask for that.

Imagine if DNS resolution on Windows was pay-to-play.

rasz• 8 years ago

This could happen 10 years ago, today Microsoft embraced tracking and spying. Win 10 grabs more info about you than google.

hengheng• 8 years ago

Does it? I wouldn't know how to tell it that much.

hungerstrike• 8 years ago

No it doesn’t. Not even close.

kerng3• 8 years ago

You need to check your facts.

hello_asdf• 8 years ago

It's unfortunate that this is necessary, but you can use this if you'd like to limit that a bit. You'll have to put it on your router or on your own dns server though, as I think Windows will ignore some hosts from the system file.

https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocke...

kerng3• 8 years ago

Please do this! :)

nikic• 8 years ago

The only "dick move" involved here is the fact that zdnet wrote this article. Minor security issue lapses standard disclosure deadline? Who cares. Instead we get this attempt to sensationalize this into some kind of big Google vs. Microsoft rivalry.

finchisko2• 8 years ago

I think there are so many point of views here. I'm not going to defend Google nor Microsoft, but imagine you're paid by Google to work on security issues. What would be the metric to prove your existence, if there is no public awareness of your work, like this zdnet article? Project Zero IMO from time to time need to show they exists and doing great job. I think that could be one of reasons, why they resists to prolong standard 90 day period.

lvh10• 8 years ago

I have a hard time thinking of a more elite team than P0. They earned their stripes long before they got there. The disclosure policy is the right thing to do, not to make someone feel better about their job.

finchisko2• 8 years ago

It's one of the points of view, not saying the most significant one.

kerng3• 8 years ago

Read about the details. Wow, having a bug like this being discussed so broadly shines a bad light on Google IMHO. Its appears like targeted news against Microsoft. It's not mich newsworthy defense in depth issue. If an adversary can modify the registry, they can do a lot more harm.

jacksmith210062• 8 years ago

Why does MS struggle so much with security?

jiveturkey• 8 years ago

Why does everyone struggle so much with security?

jacksmith210062• 8 years ago

ChromeOS been secure since the get go. Just seems weird Google can do it and MS struggles so much.

Now you get GNU/Linux out of the box but security intact.

iofiiiiiiiii• 8 years ago

They do not struggle - Microsoft have one of the more sensible and well functioning security organizations in the software world. This just is not a very important bug.

bitmapbrother2• 8 years ago

Google reported the issue to Microsoft on January 19. Microsoft confirmed the issue about three weeks later

Microsoft should make a mental note that when you receive an email from a member of Google's Project Zero team you don't wait 3 weeks to respond.

bootloop• 8 years ago

Answering an email and confirming an issue is not really the same thing.

wdr1• 8 years ago

Microsoft should attempt to verify issues quicker than 3 weeks, particularly when all details are provided?

bitmapbrother2• 8 years ago

If it takes 3 weeks to confirm an issue reported to you by a Project Zero team member, especially when they provide you a detailed report on how to replicate the exploit, then you need to optimize your process.

Google's Project Zero exposes unpatched Windows 10 lockdown bypass

Related Stories