Skip to comments.
Exploiting design flaws in the Win32 API for privilege escalation.
Chris Paget ^
| 03/06/2002
| Chris Paget
Posted on 08/06/2002 2:31:20 PM PDT by sourcery
click here to read article
Navigation: use the links below to view more comments.
first previous 1-20, 21-40, 41-45 next last
To: sigSEGV
But thats not the case. Even in the reply email the author got, the writer explained it in simple terms, no?
To: E. Pluribus Unum
As a matter of fact, Dude, Microsoft believes that bugs should not be publicized.
And where in that article does it say that MS is lobbying Congress to have laws put in place to outlaw disclosure? That was your contention. Put up or shut up.
22
posted on
08/07/2002 9:57:06 AM PDT
by
Bush2000
To: sigSEGV
Why don't you just admit that the Win32 API was never designed for a multi-user environment and no one should be using it as such?
Dude, trying reading a bit about NT security and ACLs. I don't have time to educate you.
23
posted on
08/07/2002 9:59:05 AM PDT
by
Bush2000
To: Bush2000
Win32 API != NT. Read up on NT architecture. NT could just as well have run PM instead of Win32. What you see here is an example of how a UI from a system with weak protection is difficult to bring forward into one with strong protection. Apple chose to break with the past in OS X and confine old software to compatibility boxes.
24
posted on
08/07/2002 10:03:03 AM PDT
by
eno_
To: Bush2000
And where in that article does it say that MS is lobbying Congress to have laws put in place to outlaw disclosure? That was your contention. Put up or shut up. "The fact that [eEye] explained how the virus works, to the point of explaining how you execute the code that exploits it, was too much information," (Microsoft's Richard L.) Smith says.
Publishing bug exploits will be classified as an act of terror, Dude. You can get anything past Congress these days in the name of anti-terror. The DMCA already made it a crime to reverse-engineer encryption schemes. The precedent has been set to criminalize detailed examination of any proprietary code.
To: Bush2000
DMCA and one company has already used it to quash bug reports.
To: zx2dragon
DMCA and one company has already used it to quash bug reports.
I could care less about some random company. We were talking about Microsoft. Where's evidence that it has used or tried to use DMCA to squash bug reports?
27
posted on
08/07/2002 10:19:23 AM PDT
by
Bush2000
To: eno_
Win32 API != NT.
No kidding, Sherlock. But Win32 does call into the
NT kernel to do messaging and windowing.
28
posted on
08/07/2002 10:33:33 AM PDT
by
Bush2000
To: sourcery
I don't understand why a "system/root"-process such, as this anti-virus program, should be allowed to provide a GUI (with widgets such as edit-boxes, buttons, etc.) to a "guest" user. Isn't this the crux of the problem?
To: KayEyeDoubleDee
30
posted on
08/07/2002 1:09:34 PM PDT
by
sourcery
To: TheEngineer
I don't understand why a "system/root"-process such, as this anti-virus program, should be allowed to provide a GUI (with widgets such as edit-boxes, buttons, etc.) to a "guest" user. Isn't this the crux of the problem?The "crux" of the problem depends upon the assumptions one makes. The problems with windows often result from more than one cause, all of which are necessary for a particular problem to exist. So naming one of the causes as the "crux" is like identifying one of the legs of a tripod as "the" leg that makes the object a tripod.
The problem isn't so much a particular note, musician or instrument: it's the symphony as a whole.
31
posted on
08/07/2002 1:16:48 PM PDT
by
sourcery
To: sourcery
So that's how The Dark Side works!!! Thanks for the info.
(just kidding about the evil empire thing. I could just as easliy make jokes about pigeon-holing myself into a Unix box)
To: Bush2000
HP is hardly some random company and even though they backed down (eventually), they have the right under DMCA.
You expect them to write laws for specific companies now?
To: zx2dragon
HP is hardly some random company and even though they backed down (eventually), they have the right under DMCA. You expect them to write laws for specific companies now?
MS has been the target of a large number of bug reports and it hasn't ever asserted any legal rights under DMCA. Don't you ever get tired of unjustified paranoia?
34
posted on
08/08/2002 2:09:24 PM PDT
by
Bush2000
To: sourcery
This isn't news. This is how automation testing software works. Everybody that should know already knows about hijacking the message loop. Don't think I've ever seen anybody use this for malicious code, and the message loop goes all the way back to the beginning, it's how Windows has always worked. Much ado about nothing.
35
posted on
08/08/2002 2:20:25 PM PDT
by
discostu
To: E. Pluribus Unum
36
posted on
08/08/2002 2:36:28 PM PDT
by
discostu
To: discostu
This isn't news. This is how automation testing software works. Everybody that should know already knows about hijacking the message loop. Certainly there are legitimate reasons for an application to send many types of messages to windows it doesn't own. Some of these pose some security risks if unrestricted (e.g. posting keyboard events) but are clearly useful in other cases. Others (e.g. 'save edit field to memory') have no legitimate cross-application use and are the source of the security holes discussed here.
37
posted on
08/08/2002 10:23:28 PM PDT
by
supercat
To: discostu
So you think MS is trying to put Charles Petzold in jail?! Did Charles Petzold publish explicit instructions on malicious hacking of Windows for fun and profit!?
To: E. Pluribus Unum
Charles Petzold published specific instructions on how to send messages on the Windows Message Loop and how the loop works. And all his books are published by MS. Not sure how anyone could consider the loop Windows deep dark secret since they've been publishing books that give you explicit instructions on how to use it for a decade.
39
posted on
08/09/2002 7:55:44 AM PDT
by
discostu
To: supercat
i don't deny that there are potential security issues in the loop. What I deny is that this was something MS has been hiding from people and only astute investigation by watchdoggers have exposed it. Anybody that ever learned Windows programming from the books MS publishes knows about the loop, it's been well documented since the 16-bit days. What I find shocking is that apparently so many people never heard of it before.
40
posted on
08/09/2002 7:59:57 AM PDT
by
discostu
Navigation: use the links below to view more comments.
first previous 1-20, 21-40, 41-45 next last
Disclaimer:
Opinions posted on Free Republic are those of the individual
posters and do not necessarily represent the opinion of Free Republic or its
management. All materials posted herein are protected by copyright law and the
exemption for fair use of copyrighted works.
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson