Posted on 08/07/2002 7:29:46 AM PDT by JameRetief
Edited on 08/07/2002 7:42:16 AM PDT by Admin Moderator. [history]
Windows can be "shattered", but MS not listening
Flaws, not bugs are "unfixable"
By : Wednesday 07 August 2002, 09:36
The report follows Jim Allchin's statement under oath that some problems in Windows are so great that if the code were released, national security would be threatened.
The web page claims to give details of exactly how to exploit this type of flaw, and the author gives an example of how to elevate privileges.
He has written a sample application which he calls "Shatter" which he claims will allow hackers to elevate privileges.
But the author of the page says he has emailed Microsoft and told them how Windows code can be exploited.
He also says that Microsoft does not classify this type of attack as vulnerabilities. That, he adds, is just not true, and the Win32 API cannot be changed.
He has sent an email to several people and organisations, including Security Focus, to outline his findings.
While he says these kind of vulnerabilities have been discussed before, he says his is the first documented way to exploit the problem, which is not a bug, and which he says affects every Windows software package on the planet.
You can find the Web page here. µ
I also asked the moderator to remove my post #7 (which was a direct copy and paste of another article) due to an inappropriate picture linked from the article. If you wish to read the other article, you can read it on The Register: Win32 API utterly and irredeemably broken
My first though, also. While I'm no huge fan of MS (Windows has its uses), how can the above even remotely make any sense?
Really. This is a fundamental flaw in the way the API was designed, the way the desktop apps communicate with the O/S and the desktop shell, and it's in all Windows boxes all the way back to W95. Allchin was right in that this has some important national security implications, and I'd bet that it's only the tip of the iceberg.
So what can MS do? The only correct way to "address" this is a total re-design of Windows. (Throw away all of your desktop software.) Any other option is a work-around at best, and will break lots of apps which were written for the Win32 API as it is now. It's probably better to NOT touch it, as with an old building loaded with asbestos insulation, even trying to clean it up could be more dangerous than the current threat.
MS might know that they're backed into a corner here. Their only hope is to minimize the problem through propaganda, assuming (correctly) that most users won't understand the problem.
But the Admins in the field certainly will understand that all their hard work to secure their desktops can be un-done by a user within minutes.
I would not want a job at the Microsoft Security Response Center about now.
Second, it relies on sh*tty programming by application vendors, not MS - there's no good reason for a app to expose LocalSystem-privileged functionality to a user with Guest privileges, and several good reasons not to. Patch McAfee's VirusScan to fix this retarded practice, and this problem goes away...
Third, it requires some level of access to the desktop, at least a guest account - if you're running 2K or XP and you haven't disabled the guest account, consider yourself on probationary staus pending a decision about whether you should be removed from the gene pool... :P
DOS had its own unique problems, mostly due to its history and legacy of being a single-user O/S. Microsoft's bread & butter has been Windows. And if Microsoft had put even half the effort/innovation into improving the product that it's devoted to maintaining its monopoly, it wouldn't be as disliked as it is today.
.. the same people that give MS tons of feces for their problems are ALSO complaining about the intention to end downward compatibility. It's solid proof that some people just hate MS and the company will never get their approval and the company shouldn't expend any effort trying to win that approval.
MS consistently shows that it doesn't need approval. WinME, WPA, Licensing 6.0 are all examples that MS doesn't CARE what its customers think; it's gonna do its own thing anyway, the critics be damned. It's an attitude thing, like a little puppy which was never appropriately disciplined for its messes and continues to mess. Now it's big enough that it cannot be tamed; it has taken over the house.
The MS hecklers can (and have) been a source for good in the Windows world..
Remember that it took until W95 OSR2 before MS got a clue and began encrypting passwords sent over the network.. even if they can't think ahead, they can (or at least DID) listen...
.. but when you start demanding they address the unfixable you become irrelevant and whiny.
Agreed... and I think that just indicates a misunderstanding of this problem.
The system default message handler for a textedit control will accept messages to adjust the box's maximum capacity, store the contents of the box to a specified address, and execute code at a specified address. Unless the application captures these messages and does not pass them through to the default handler, any application which uses one or more textedit controls may be taken over.
No, I still think this is a programmer's problem, not an OS problem - no service or software requiring or allowing user interaction should be running with greater privileges than the current user. If you have a program that requires such, it should be running as a non-interactive service in the first place.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.