Vista Protected Processes Bypassed 221
Anonymous Hero writes "Security Researcher Alex Ionescu strikes again, this time with a proof of concept program that will arbitrarily enable and foremost disable the protection of so-called 'protected processes' in Windows Vista. Not only threatening Vista DRM and friends, it's also another step towards hardened and even more annoying malware. Normally, only specially signed processes made by special companies (decided by Microsoft) can be protected, but now the bad guys can protect any evil process they want, including the latest version of their own keylogger, spambot, or worm, as well as unprotect any 'good' one."
In related news (Score:5, Funny)
Re:In related news (Score:5, Insightful)
A spokesperson for Microsoft was quoted as saying :
This is only an issue if you're downloading and watching porn. You should be watching only wholesome media, like "What About Bob", instead.
People are modding this as flamebait, but I've seen far, FAR too many IT professionals take that stance with Spyware / Malware. I've seen a system get all sorts of nasty winlogon-enabled Spyware within minutes of being hooked up to a network, with no action on the user's part. Not only that, in a world where banner ad companies can get infected with trojans [out-law.com] the idea of people only getting infected if they're doing something "shady" on their machine is utterly absurd.
Re:In related news (Score:4, Informative)
It was a joke, just a joke and only a joke.
The link given is to Microsoft Bob, which Microsoft gave up on shortly after launching it and (according to Wikipedia) later admitted the product was their single largest failure in their company history.
You'd need to remember Bob in order to appreciate that Vista is well on its way to being "Bob 2".
I suppose any joke could be taken as flamebait lol, but really, its just a joke. Better put in
its funny, laugh.
Re:In related news (Score:5, Interesting)
Vista goes way ot of its way to reduce functionality for the user in order to make content providers happy. Think of what that really means. Company A sells something to Consumer A but that something is disabled in order to make Company B happy. Company B is happy because they can continue their old business model and maintain their dominance if and when they finally move into new business models when they feel ready. Meanwhile, companies C, D and E through M move to create, innovate and design new things only to be prevented by both Company A and Company B. Depending on how this is done and how much evidence can be produced, this is illegal behavior.
not trust activity.. its just "industry standard" (Score:2)
collusion happens all the time, and thanks to republican sellou.. i mean our fine pro market saviors, their activities are dismissed as "industry standards" and/or "the free market in action", and anyone who comes out calling a spade a spade is immediately plastered as a pinko communist.
examples include rediculously unreasonable eulas, the incorporation of broadcast flag-like rules in the QAM cable standards (lever
Re: (Score:3, Insightful)
Re: (Score:2)
I've seen that too many times to count. In fairness, though, the times I've seen it has not been with major ad companies, but rather more "shady" advertising companies. However, that doesn't mean that the user was doing anything "shady," and yes, the assertion that they must have been doing that is absurd.
I sugge
Re:In related news (Score:5, Interesting)
The parent is not necessarily too uptight to admit surfing porn.
Re:In related news (Score:5, Funny)
Re:In related news (Score:4, Insightful)
Do a significant proportion of porn sites have malware? Probably.
Is there a greater risk of getting infected by malware when surfing for porn than doing "wholesome" surfing? Perhaps.
Is a malware infection reason enough to presume that they got it from browsing porn and/or piracy-related sites? Not in the slightest in my experience. If you've got differing experiences that prove me wrong, by all means collate your data and present your findings because I and I'm sure many other people working in admin or IT roles would love some hard numbers on the nature of malware sources online. Until then I'll have to assume the "observations of thousands of admins" you speak of are in fact nothing more than your own pre-conceptions.
Re: (Score:3, Interesting)
I'll tell you, personally I think porn sites don't need malware. They KNOW what you're there for - they don't need to slap adware on your system to get you to come there. I've always had some spyware protection back when I was running mostly on Windows 2000 and XP, and I surfed porn sites frequently (albeit with Opera originally and later Firefox, more than IE, so my exposure to ActiveX was minimal) and I very rarely got any spyware according to my utilities.
Basically ANY sleazy commercial outfit will slap
Can we have Source? (Score:2, Interesting)
Why do they even bother? (Score:2, Insightful)
Re:Why do they even bother? (Score:5, Insightful)
Re:Why do they even bother? (Score:5, Funny)
Re: (Score:2)
Re:Why do they even bother? (Score:5, Insightful)
The problem with Microsoft is not so much one of bugs as it is a problem with their general design philosophy.
Such as providing mechanisms for your own developers to bypass the security of the entire system to make some friggin media clips play more smoothly. News flash, idiots: if you provide two paths through security, a strongly checked path and a weakly checked path, you incentivize attackers to take the weak path! And if you provide those hooks for your own developers to bypass security, then attackers can use them too!
They were probably praying that no one would ever figure out that those hooks were there... and security by obscurity is very, very poor design.
My inclinations against myself or my family running vista just got a +1 Justification.
Re: (Score:3, Insightful)
Microsoft needs to be put out of business. Now. They have all the brains and social conscience of Enron.
Highly amusing! (Score:2)
The bottom line is that no matter what OS, competent system administration is essentlial. However MS makes system administration a lot harder, than it is on other systems.
Didn't we see this before... (Score:3, Informative)
I clearly remember being called to help a friend with a spyware/malware problem, discoverng he had ME, and going out to buy a copy of XP to replace it.
Re:Didn't we see this before... (Score:5, Funny)
Re: (Score:2)
this is just an another step (Score:4, Funny)
Wait, wait... (Score:5, Interesting)
Most likely I am missing the point here, and can't understand TFA accordingly. Somebody please set me straight.
Re:Wait, wait... (Score:4, Informative)
It's not like they can just create a pointer and address the other memory space but using the API they can achieve the same thing.
This is what allows programs like xfire to inject into your game process or (as they mention in TFA) allows Warden to peek inside all processes to see if they are evil.
Re: (Score:2)
Interesting.
This seems very non-secure to me. Any idea if this is standard on other OSes than Windows?
Re: (Score:2, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
If the ability for the admin to manipulate the memory of any process is a poor/insecure design, then most operating systems I know of are poorly designed and insecure. Do you want processes on your computer that you cannot manipulate, and that only obey Microsoft?
Debugging.. (Score:2)
No, debuggers can't have special privileges (Score:3, Interesting)
When you make a Windows API call to something like CreateRemoteThread [microsoft.com], you need a handle to the process you're interested in. If the right security bits aren't set (and they get set by the call to CreateProcess), CreateRemoteThread returns unsuccessfully.
Anyway, what could you do to give debuggers special privilege
Re: (Score:2)
This is obvious, you give them the permisson but run them as protected. This prevents other apps from mdifying them.
Re: (Score:3, Insightful)
Only make programs 'unprotected' if they are started by a debugger. For example, run them in VM in the debugger address space. This way you can't hijack already running programs.
But yeah, I am aware that there always is an 'outside' to a thread, program, kernel or computer. From the outside you could read values directly. Ex: a computer that is not running could have it's kernel changed so it gives
Re: (Score:3, Interesting)
How do you think trainers work? (Score:2)
What is not supposed to happen in "normal" circumstances, is that one process "accidently" accesses a part of memory not assinged to it. However plenty of programs work by doing this on purpose and as long as they behave, there is nothing wrong with it. It just so happens that trainers are a common example.
However typically with trainers, the user level is the same. There is no real problem with a trainer I run, modifying the memory of a program I am also running. It becomes more of a problem if user level
Re: (Score:2)
kinkie@loki:~$ll
-rw------- 1 kinkie kinkie 0 Apr 7 22:02
kinkie@loki:~$echo $$
6296
see? I can alter my own processes' memory, no problem.
Ever since DOS (Score:5, Insightful)
Re: (Score:2, Insightful)
It's awesome. I type commands, it obeys them. It never patronises me. The security works FOR me, not against me.
Now THAT is user-friendliness.
Re: (Score:2)
Re: (Score:2)
Re:Ever since DOS (Score:5, Funny)
I miss the days when I gave my computer commands not suggestions.
You are becoming nostalgic, Deny or Allow?
Re: (Score:2)
I much prefer the Windows XP auto-update dialog. "(blahblahblah) Would you like to reboot now?" with exactly one button: "OK". Where's my "No it's NOT fucking ok!"
Re: (Score:2)
It's really Melinda's fault (Score:5, Funny)
So get off your old, tired, 20th Century horse and get with the new paradigm.
Just a suggestion of course.
Re: (Score:2)
And if Microsoft has its way, just like women, the OS will have the option of deciding to stop working with you, then walk off, taking half your assets a
Re:Ever since DOS (Score:4, Funny)
Re: (Score:2)
biting the hand that feeds you (Score:5, Funny)
He [Alex Ionescu] is also a Microsoft Student Ambassador and is representing the company on campus as a Technical Rep.
not for long, I bet.
New Meaning for "Genuine Advantage" (Score:3, Funny)
possible silver lining (Score:4, Interesting)
Re: (Score:2)
Surprising really? (Score:4, Funny)
Re: (Score:2)
Hah! Shows what you know. I don't have to paint my excrement to get it that pink color...
Again? (Score:3, Interesting)
Bill Gates wants more cheap labor [infoworld.com] to waste of useless software [theinquirer.net]. What a waste of human intellect and talent. How about making the computer RUN faster, be more intuitive, and reliable?
Re: (Score:2)
Of course, I guess that's better than something like Word, where it takes 3 times as long to get anything done as it should because of all the unpredictable and illogical "helpful" stuff that the progr
Good, now MS cant dictate software advantage (Score:4, Insightful)
by doing that they give incumbents an advantage over others and are using their OS to exapand monopoly interests into other sectors.
Good idea, bad implementation. (Score:5, Insightful)
"Protected processes" are a reasonable idea. They're certainly better than putting video and audio processing in the kernel as part of the DRM system. But apparently Microsoft botched the implementation.
Microsoft has for some years allowed processes to do too much to other processes. Things like "injecting" a DLL or thread into a running process from the outside, or "hooking" system calls, are inherently security problems. In the Windows world, normal processes can do that to each other. This tends to be overdone, with too much "hooking" of system calls and such, a tradition from the DOS era. The UNIX/Linux world doesn't have that tradition. Fortunately.
In the Linux world, the things you can't do to a Microsoft "protected process" are roughly equivalent to the functions of the PTRACE [linuxgazette.net] call. In SElinux, the mandatory security system controls which processes can use PTRACE on which other processes. [12.110.110.204] So SELinux already has "protected processes", but with a better security model.
If we have to have DRM, protected processes aren't a bad idea. But what you want is for them to be compartmented, not privileged. They should be running in a compartment which prevents other processes from attaching to them, but they don't need the privilege of attaching to other processes. So the video decoder can be protected, but doesn't have enough privileges to act as an aimbot for some game. The security system for a game should be able to lock the game processes into a compartment which other processes cannot enter, preventing cheats. Enforce separation, not privilege.
Re: (Score:2)
youre kidding right? securing the computer's processes against its own owner without any option for override is reasonable?
how about i do that to your house, and make you pay me rent on top of your mortgage for the "right" to use those extra bedrooms, kitchen cabinets, and garage space?
Re:Good idea, bad implementation. (Score:4, Informative)
Re: (Score:2)
Counterstrike.
WHat the heck? Windows processes are WEIRD (Score:2, Insightful)
Protected processes have additional security restrictions, but apparently in vista, they are strange beasts. Parent processes can always obtain a handle to a child process. So, you can't have a child process become a true daemon?
Processes can "inject threads" into other processes? Buhuh?
Here's apparently more of what processes can't do to Protected Processes do in Windows:
Inject a thread into a protected process
Access the virtual memory of a prot
Apparently you haven't heard of ptrace() (Score:2)
Windows processes have access control lists like files do; you can't inject a DLL into winlogon.exe without LocalSystem ("root") access. Linux and OS X go by the associated UID; if the requesting UID is unequal and is not zero (root), the attempt is denied.
As for SELinux, many systems can get around the ptrace() lockout. Pipe a connection to gdb and have it do the dir
This is how it's done (Score:5, Informative)
Re: (Score:2)
The Philosophy of Protection (Score:4, Insightful)
So what do you do? Well, one thing you don't do is provide special security rights to only certain approved software.
The only true answer is open software and education. People who don't know how to use their computers will be attacked. They will be compromised. If you can't control yourself on the internet and local networks, you will lose the right to control your computer because someone will take it from you. If you run unknown and untrusted programs, you face the risks. Your online habits help determine your exposure. If you absolutely must visit 'free porn', warez, social networks like MySpace, etc websites, then do so with caution tempered by proper education on how to isolate your important, sensitive data, from the rest of the crap you are willing to lose. You are better off simply not visiting sites of that nature. But if you are going to, at least understand how to keep yourself safe. Because no software written today is going to be able to do it for you. There will always be software out there capable of getting around it.
In the end, to the wolves go the slowest, weakest sheep. It's natural. Don't be one of them.
Looks like 32-bit (Score:4, Interesting)
32-bit allows unsigned code in kernel mode for legacy reasons so its much more easier to inject into 32-bit processes.
which version (Score:2)
"We made it way harder for guys to do exploits," said Mr. Gates. "The number
[of exploits] will be way less because we've done some dramatic things
[to improve security] in the code base."
http://www.toptechnews.com/story.xhtml?story_id=4
Annoying? (Score:2)
ignore malware, now i can use ext2 drivers (Score:2)
Job protection for this guy. (Score:2)
Re:Other OSes (Score:4, Funny)
Re:Other OSes (Score:5, Insightful)
Re:Other OSes (Score:5, Informative)
Re:Can't beat em, join em? (Score:5, Insightful)
Re: (Score:2, Insightful)
Microsoft can.
You think so? (Score:3, Insightful)
Re:You think so? (Score:4, Funny)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
What if they tried holding their programmers to higher standards in the security of the products they produce, and then paid the ones that made the cut twice as much?
Re: (Score:2)
Re:Can't beat em, join em? (Score:4, Insightful)
-matthew
Re:Can't beat em, join em? (Score:4, Funny)
Why would anyone bother putting in more backdoors to the OS equivalent of Goatse ?
Re:Can't beat em, join em? (Score:4, Interesting)
That's MS's big problem. A LOT of people WANT them to fail because they're MS. Because fundamentally, a computer and it's OS is supposed to do what the user wants, not what Bill Gates, the RIAA and the MPAA want it to do. There are enough people out there who know how to hack it up so it actually does do what they want. The more pragmatic ones WANT MS to fail because that's how to crack the content they want.
Once the hacking is accomplished, a significant number of people will then abuse that code to get other people's computers to do what THEY want rather than what Bill wants (doing what the user wants is simply not up for discussion).
The real beauty here is that the "bad guys" are turning the OS's own features against the creator (the other bad guys). The divine appropriatness of that is simply irresistable.
Re:DRM in Vista is misunderstood (Score:5, Insightful)
You're joking, right? (Score:3, Informative)
The ability to play some DRM'd files was also added to XP and Windows 2000. I assume you already knew that though...
Re: (Score:3, Insightful)
> Why can XP and Windows 2000 play encrypted files?
The ability to play some DRM'd files was also added to XP and Windows 2000. I assume you already knew that though...
Ok so your original quote that suggested Vista's DRM, which is clearly different when compared to XP's and 2000's DRM mechanisms, is somehow a good thing was wrong? Or were you trying to say that some type of DRM is necessary? If the latter, then I don't know yet if I disagree. I can't however understand why you would criticize Ionescu for enlightening us to the flaws in Vista's security/DRM strategy. Ionescu did not make Vista any less secure than it was a week ago. He's simply let some of us know tha
What criticism? (Score:2)
In which part of my post did I criticize Ionescu? I think his work is admirable, though I hardly find it surprising that a flaw was found in such a complex and new piece of software as Windows Vista. All complex software contains flaws.
I think that claiming that DRM is 'broken' is an overstatement. Its not broken, it still works fine. The security I accept needs more work, but t
Re: (Score:2)
> I can't however understand why you would criticize Ionescu for enlightening us to the flaws in Vista's security/DRM strategy.
In which part of my post did I criticize Ionescu? I think his work is admirable, though I hardly find it surprising that a flaw was found in such a complex and new piece of software as Windows Vista. All complex software contains flaws.
I think that claiming that DRM is 'broken' is an overstatement. Its not broken, it still works fine. The security I accept needs more work, but the DRM works. It is a misleading summary.
I think you misunderstood me.
I guess I did misunderstand you. I don't abhor DRM with every fiber of my being like some here do but I believe DRM needs to be non-intrusive and stable. It is rarely either right now.
Re: (Score:2)
Re: (Score:2)
There are plenty of ways to implement DRM, with or without OS support, with or without hardware support. Or you could turn off DRM altogether.
In fact, why doesn't Microsoft do that? They're certainly in more a position to deliver a big "fuck you" to the recording industry than Steve Jobs is.
Re: (Score:2)
DRM is there because if DRM wasn't there, you'd not be able to play DVDs, HDDVDs or BlueRay discs on Windows. The owners of those formats don't care about Windows, they're more interested in the consumer electronics manufacturers. And every single one of the consumer electronics vendors is more than happy to put what
Re: (Score:3, Funny)
Re:Source code (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
The boys in Redmond own this code, no one else. You don't know what his correspondence with them has been, personally I wouldn't let M$ off without a nice payout, aside from the fact that they will likely patch it on their own or write some software that does the same as lonescu's. What lonescu most likely gets out of this is nothing more than recognition and he deserves it. And tomorrow if you get some malware on your Vista box that simply can't be removed, you know where to get a tool that may help. On th
Re: (Score:2)
Disassemble it (Score:2, Insightful)
Re:Source code (Score:4, Informative)
Seems to contain a compressed buffer with a .sys driver that is decompressed with a call to RtlDecompressBuffer and hidden away by writing it to the alternate stream "%SystemRoot%\system32\drivers\crusoe.sys:drmkaud. sys", and then there's a registry update to load the driver.
Someone who cares should write out the compressed buffer and disassemble that.