DimitryGH followed up on the earlier news that the MacBook Air lost CanSecWest by noting that "Last year's winner of the CanSecWest hacking contest has won the Vista laptop in this year's competition. According to the sponsor TippingPoint's blog, Shane Macaulay used a new 0day exploit against Adobe Flash in order to secure his win. At the end of the day, the only laptop (of OS X, Vista, and Ubuntu) that remained unharmed was the one running Ubuntu. How's that for fueling religious platform wars?"
What's the betting that the Linux and MacOS versions of Flash are also vulnerable to this 0day? It's rare for a Flash issue to affect only one platform (the same is true of the Acrobat reader and other typical cross-platform browser plug-ins.) Let's wait for the Adobe advisory before jumping to conclusions, shall we? (Disclaimer, I'm a Linux user.)
I am not a software engineer or hacker, but from what I understand, while it may be likely the vulnerability exists across platforms, typically it is the Microsoft box that often allows elevated access, once the Flash exploit has been used. This isn't so easy to manage for a hacker, with the *nixes, (which includes OSX).
So by not using Windows, users are made more secure by not being such a targeted pool in the first place, (as influenced by marketshare). But the design of the OS helps too.
"What's the betting that the Linux and MacOS versions of Flash are also vulnerable to this 0day? It's rare for a Flash issue to affect only one platform (the same is true of the Acrobat reader and other typical cross-platform browser plug-ins.) Let's wait for the Adobe advisory before jumping to conclusions, shall we? (Disclaimer, I'm a Linux user.)"
It depends upon what you mean by "Flash issue." If you mean a bug in the rendering or stream processing, or GUI etc. then yes it is likely that the same bug would be found on all three platforms.
The question isn't "Is Flash vulnerable?", but rather does a vulnerability at the application layer allow you to hack into the OS. It is entirely besides the point if Flash is flawed in the same way, thought there is a reasonable likelihood that it is not in this case. There are significant differences in code compiled for the various platforms. We Software Engineers call that "conditional compilation."
Actually, IE on Vista runs with fewer permissions then a normal User account by default. It runs as a low-integrity process. This means that it loses access to most of the user's files (it has access to things like the temp directory for storing cookies, cache, etc.). See MSDN [microsoft.com] for details.
Well on Windows, sandboxing of permissions is different. There might still be the exploit but the level of vulnerability would most likely be higher on a Windows system as a result of IE running at a SYSTEM level permission rather than a USER level like in Mac or Linux. Change to a different browser like Firefox on Windows and you will be safer.
IE does not, and never has, run as SYSTEM. Prior to Vista it runs as the user who starts it. In Vista it runs with privileges lower than a regular user.
I realise Slashdot is as anti-Microsoft as they come, but it's still surprising to see the same FUD about IE still being spewed 10+ years after it was shown to be false.
So, prior to Vista, when it ran as the user who starts it, given that over 90% of the cases the default user has complete and unlimited access to the system files, how is running as user different from running as SYSTEM? (And, yes, I pull that "90%" figure out of my arse---but I'll bet it's higher.)
Firstly, because SYSTEM and Administrator have different privilege levels.
Secondly, because there is a vast gulf of difference between the statements "IE runs as SYSTEM" and "IE runs as the user, which is sometimes Administrator, and I think that Administrator and SYSTEM are the same". One is a (serious) architectural problem, the other is an end-user configuration problem. Trying to say they are equivalent is at best ignorance and at worst lying.
Finally, while most home systems would certainly be running users as Administrator, most managed corporate systems would not. 90% is a ridiculous over-estimate of how many XP systems only have "Administrator" users.
by Anonymous Coward
on Saturday March 29 2008, @10:08AM (#22904900)
A 0-day exploit in Flash. What does Flash do? It paints to the screen. It has no need to communicate with other applications or write anywhere on the system except perhaps in a single configuration file. Why is this software not bullet proof? The thing is only a couple hundred kbytes small, for heaven's sake!
Errr. know of any site using Flash for something useful?*
*Useful to me; not to advertisers or corporate web designers who think interrupting the flow of my surfing and irritating the hell out of me are good ways to earn my shopping dollars
I don't see how a script kiddy running 0day exploits on a box is in any way related to the total end point security, or security of the OS. Seems all he did was take inventory of the box -- realize flash was vulnerable and exploited it. Could've happened to any OS -- Ubuntu included -- that provides its end users with insecure software. Seems like trivial marketing fluff -- setup to spur stupid religious wars.
Haven't you heard, there is a new tool for scriptkiddies. It is called sub8 and it's got a "get 0days" mode. I'm running it all day. I am now targeting 127.0.0.1 and I think it is going to be done any min[CARRIER LOST]
I don't see how a script kiddy running 0day exploits on a box is in any way related to the total end point security, or security of the OS. Seems all he did was take inventory of the box -- realize flash was vulnerable and exploited it. Could've happened to any OS -- Ubuntu included -- that provides its end users with insecure software. Seems like trivial marketing fluff -- setup to spur stupid religious wars.
Hmm, I disagree.
First, this wasn't some script kiddie applying a known exploit. It was a new exploit that the winning team came up with. It isn't trivial to do.
Second, no, this "could have happened to any OS" is wrong. A well-crafted browser (in this case, the browser is part of the OS) can in theory prevent browser plugins from accessing anything of importance. However I don't think any existing browsers do that - but they should.
Second, and perhaps more important, the existence of 3rd party software on different OSes isn't the same. For example, most Windows users use Adobe Acrobat to view PDFs, whereas many Linux users use FOSS PDF viewers (Evince, KPDF). It might be the case - and I am guessing that it is - that Acrobat has far more exploits against it, both because it has far more code (what with all the functionality 99% of users don't need), and that it isn't open source. In general Windows users tend to have lots of 3rd party apps that are closed source and of dubious quality. That isn't the case on Linux.
Furthermore, even if two OSes run the same app - Flash, say - that doesn't mean they are equally vulnerable. Flash isn't identical between the platforms; if I am not mistaken on Linux Flash uses Alsa for sound (or some other Linux sound system). So if Alsa is more secure than Windows' sound system, that would be one difference.
I'm not saying this competition is a great test of OS security. It isn't; it's an anecdote. But it isn't worthless either. In fact the results are pretty much what I would have expected from the beginning: OS X is a great OS but security has never been a top priority (there wasn't as much of a need for it, so why bother). Windows has focused on security recently but is hobbled by having lots of closed-source 3rd party apps. Linux was always security-focused (starting as a server OS), and has the advantage of most of its software being FOSS and arriving from a repo under the control of the distro (in this case Ubuntu).
Second, no, this "could have happened to any OS" is wrong. A well-crafted browser (in this case, the browser is part of the OS) can in theory prevent browser plugins from accessing anything of importance. However I don't think any existing browsers do that - but they should.
Irony alert: IE7 is the only browser on the block that does this. I imagine that the vulnerability was accessed through the open-source alternative: Firefox.
And no, it's not because IE7 is part of the operating system. It's because IE7 uses Microsoft's secure API to achieve sandbox mode. Firefox really needs to start taking advantage of this API. Otherwise their "most secure way to surf" bullshit is going to be called into question real soon.
To be honest I think this says less about the security of various platforms (after all we have to be slightly impressed Windows lasted so long), but more about the security of open source versus closed source. The operating systems themselves didn't seem to be at fault as much as extra apps (although Safari may be an exception here).
Users follow the normal path of least resistance established by the platform. Users' first tendency is to use the apps that are installed by default, which means mostly open-source apps on Linux and closed-source apps on Windows. When an appropriate application isn't installed, consumer-targeted Linux distributions help steer users toward good open-source applications. Under Windows, you usually end up installing a closed-source application suggested by a web site. Windows application security depends not just on closed-source software but on users' ability to evaluate the credibility of web sites and spot spoofed web sites (like the ones used for phishing, but used for distributing malware instead). Under Linux, those skills are still important, but since the normal method of installing software is to download packages maintained by the distribution, users will be more likely to pay special attention when installing software from other sources.
In sum, what this means is that Windows systems depend heavily on closed-source software and the judgment of individual users, both of which are less secure than the community-oriented "more eyes" approach taken by open-source Linux distributions.
1. The contest did not require someone to 'own' the box to win. They just had to read the contents of some specific file somewhere in the OS. Unfortunately, they didnt publish where that file was, or what the file-system ACLs on it were.
2. The guy who took down the Vista box claimed in the article that it would only take them a few more hours of work to make the Flash vuln effective on OSX and Linux as well.
If the person on the Vista laptop was running IE 7 with the default configuration (protected mode [msdn.com] / UAC on), this should not have happened.
Flash, like all other plugins, run within the security context of the low-rights user used by protected mode. Even if the flash plugin had an obvious buffer overflow or other exploit, it would only be able to access the data accessible by that low rights user, NOT the user running IE. That's the point of protected mode.
For a flash plugin to allow for a hacker to access personal files of the user it would not only have to have a buffer overflow (or some other exploit) in flash itself, but also take advantage of a privledge elevation exploit in Windows simultaneously.
I didn't see them specify in the article what browser than were using. Since they said it was an issue with flash, and not Windows, they couldn't have been using IE. My guess is that it was Firefox, since they said they loaded "popular" 3rd party apps.
Futhermore, the file in question must have been accessible to the user running Firefox (or whatever non-IE browser) since that would also require a privledge elevation in Windows.
So I'm not really sure how you can blame this on Vista or even Microsoft. If they had been using IE, it wouldn't have happened, regardless of the flaws in Flash. This says absolutely nothing about Vista security. The exact same thing would happen on every other OS. If you have an app with an exploit, and that app is running as User A, the hacker using that exploit has the same rights as User A.
I suppose one could argue that various defensive techniques like ASLR [msdn.com] should have stopped this, but without knowing the details, that's impossible to say. A buffer overflow can just as easily be used to call APIs exposed by the exploited application as it can to call OS APIs, and since ASLR only applies to Windows APIs (indeed, many of these techniques only apply at the OS level), this wouldn't be a fair characterization either.
Indeed, I find it strange that they didn't mention mitigating factors. I realize they're trying to be responsible as far as reporting, but telling people that users running IE on Vista aren't affected isn't exactly giving anything away... aside from the fact that Vista did its job as best it could.
Flash, like all other plugins, run within the security context of the low-rights user used by protected mode. Even if the flash plugin had an obvious buffer overflow or other exploit, it would only be able to access the data accessible by that low rights user, NOT the user running IE. That's the point of protected mode.
You are right that plugins by default runs under the special low-rights "ieuser" account. Unless the plugin uses tricks to circumvent this security for some reason.
And that is exactly what flash does. It uses a special "broker process" which runs as a daemon/service. The restricted plugin then talks to this brokerprocess and thus breaks out of the sandbox.
The flash API indeed has methods for creating/deleting/reading files and even executing applications (Would you believe that?). Although Adobe/Macromedia have tried to ensure that flash actionscripts can only use these in a "safe" way; I believe it is probable that the exploit was somehove connected to a vuln in the broker process; quite possibly in some of these API functions. Using a broker process to break out of the sandbox can circumvent any security precautions taken by the browser.
Given that Flash vulns are often cross-platform I think it is quite likely that this also is a problem on Linux. Now, if the special file which the contestants had to retrieve required *admin rights* the yet another level of security had been broken (UAC). But at this time we can't really determine.
That is not correct. Protected Mode's low rights user has virtually no access to the system.
Unless that file was specfically marked readable by the low rights user (which would be obvious cheating), or unless it was placed in a directory accessible by that user (temp directory, for instance), they could not have been using IE.
No. The low rights user has access to a limited number of registry entries, isolated storage (temp directory a few others under the user's profile), but has absolutely no access to virtualy anything else... especially the user's documents.
A broker service is used when reading or writing to user files (such as when they save a file to their desktop, or upload a document to a web site). This isolates the potentially dangerous code into a very small (~10k lines) application that is far easier to audit. This application runs as the normal user, and essentially accepts requests from the low rights IE process when actions need to be performed on user files.
Except that... get this... FLASH HAS A BROKER PROCESS. Protected mode cannot stop Flash doing stupid stuff because Adobe in their infinite wisdom decided they really needed that unfettered system access and created a Flash Broker. And to top it off, the Flash installer adds the Flash Broker as a "Don't prompt me again for allowing this application outside protected mode to be called" program.
I don't even know why Microsoft bothers trying to secure stuff when morons like Adobe just go and fuck it up.
Also, your conclusions about UAC are completely wrong. I refer you to several blog posts I've written on the subject. UAC is a solution to a problem that only exists on Windows.
See the following: background info [robertdowney.com], and most of this post [robertdowney.com] deals with UAC.
I'm only pointing out that it is irrelevant whether the vulnerability was in Flash or in Windows, or even in Firefox, since the problem is the same: Windows is still carrying the baggage of a single-user system and as long as that is the case it will be easier to exploit. UAC does raise the barrier, but addresses a problem that only exists on Windows, since that OS still does not properly compartmentalize users the way other OSs do.
What the hell? Do you only read highly moderated Slashdot comments for all your information on Windows or what? One exploit in Firefox or Flash on Linux(default config on all major distros) can completely and silently wipe away all your user files or ftp them to Nigeria. All your smug talk about proper compartmentalization in "other OSes" won't help shit to stop that. Can you tell us what exactly on Linux would prevent the same hole in flash(or in Firefox) from shitting all over your user directory?
UAC does raise the barrier, but addresses a problem that only exists on Windows, since that OS still does not properly compartmentalize users the way other OSs do.
UAC is basically sudo and like the root password prompts that come up under GUI in Linux, except that MS didn't think that it would make sense to prompt a user already designated as a admin to enter the password because the vast majority of their users run in a single user environment. If the user is not an admin, then the admin password is prompted for. Can your provide some references for how windows not properly com
Contrast that to IE7 on Vista. Read this [msdn.com]. It's in part a implemtation of the Biba security model [wikipedia.org]. So a similar vulnerability in IE7 or any of its plugins(including Flash) will only be able work in sandbox that prevents access to anything but low risk files like temporary internet files.
From the linked article:
Internet-facing applications such as browsers are inherently at a higher security risk than other applications because they can download untrustworthy content from unknown sources. IE7s Protected Mode leverage's Windows Vistas UAC, MIC and UIPI features to boost browser security. In IE7s Protected Modewhich is the default in other than the Trusted security zonethe IE process runs with Low rights, even if the logged-in user is an administrator. Since add-ins to IE such as ActiveX controls and toolbars run within the IE process, those add-ins run Low as well. The idea behind Protected Mode IE is that even if an attacker somehow defeated every defense mechanism and gained control of the IE process and got it to run some arbitrary code, that code would be severely limited in what it could do. Almost all of the file system and registry would be off-limits to it for writing, reducing the ability of an exploit to modify the system or harm user files. The code wouldn't have enough privileges to install software, put files in the user's Startup folder, hijack browser settings, or other nastiness.
So in order for the exploit on Flash to work on Vista SP1, it must have been run on Firefox/Opera/Safari/ OR it must have been run on IE7 and broken through the sandbox(quite possible, but the news shouldn't be about not only a exploit in Flash, but another one in Windows as well). THAT is the point of your parent post. And no, this is not an assumption. It's a fact even if you bury your head in sand.
My own logic is sound. But I suggest that next time you feel like discussing such things, you rely on facts and leave assumptions at the door.
I don't know what is worse, your lack of basic knowledge of what you're talking about or your smug self-superiority and overconfidence in the OS that you chose and your 'M$ sucks' zealotry.
Are you suggesting that software bugs are in some way a phenomenon unique to Microsoft ?
Not at all. What I'm suggesting is that when someone says that X is not possible because it isn't supposed to happen, it doesn't mean that it can't happen or won't happen. The Titanic was supposed to be unsinkable. AACS was supposed to be unbreakable. The four-minute mile was supposed to be unachievable.
I'm not foolish enough to claim that *nix cannot be rooted or cracked. Just that because of its design it is inherently more secure and more difficult to crack than a system that still allows apps to run in rootspace.
What "baggage" ?
The baggage of supporting legacy apps that require(d) administrator access. Because Windows had been designed for so long to be run by a single user-administrator, there are plenty of apps that simply won't run without admin-level privileges.
No, it addresses the same problem that exists on all multiuser OSes, which is why all multiuser OSes address it (with varying degrees of user friendliness). Windows "compartmentalises users" at least as well as other platforms (and possibly better, depending on exactly what those OSes are, due to extensive use of ACLs and the lack of a superuser).
Not exactly. When an OS is designed from the ground up as a multiuser system (such as *nix), it is very easy to restrict access to system resources. If I want to install a piece of software on Linux, for example, I cannot make the installation system-wide (by writing to/usr/bin, for example) without admin privileges. I cannot install libraries to/lib,/usr/lib, etc. I cannot write settings to/etc. Even when installed and executed, that program will only have a restricted set of rights based on the user/group that executes it. I can, however, compile and run executables as a user without needing admin access and without write access to system files and/or directories. I can put whatever libraries, modules, settings etc are required in my home directory without needing access to restricted areas.
Yes, I do run the risk of hosing my/home/user directory and everything inside of it, but I cannot touch any other user's files, and cannot touch system files.
Windows, on the other hand, has a hybrid model where a multi user model is tacked onto a single user-admin model, or rather support for a single user-admin model is bolted onto a basic multiuser model. Basic, because a true multi-user system would never have a single repository for all settings, like the Windows registry.
Your logic is worthless.
Please explain.
You are saying that because an (apparently ignorant) Exchange Administrator misconfigured her server, there might be bugs in Windows.
No. What I'm saying is that the my sysadmin's argument is very similar to the OP's argument. The OP said that because IE7 isn't supposed to allow a system level exploit via something like Flash, then therefore it isn't possible. My sysadmin said that because she configured Exchange to block autoforwarding to public webmail then it isn't possible. It is clearly possible to to autoforward my mail to gmail, and I did it and showed her to prove a point. She seems to think I manually forwarded the messages and somehow spoofed the reply-to field, and that autoforwarding is impossible because it shouldn't happen.
It's the same point I'm making now, and am running out of ways to say: Just because something shouldn't happen doesn't mean it won't or can't.
More on topic, if an app has elevated rights, then exploiting a vulnerability in that app will give the exploit/exploiter elevated rights. There are very few apps on *nix (none that I can think of) that run or need to run with elevated rights. There are a lot of apps on Windows that expect to have admin rights, regardless of whether or not such access is needed. This is why the problem is structural, and why I used the example of the incomplete wall.
Really? What I hear is Vista security sucks in the real world. Seems to me that that's what most/.ers would like it to say. After all, OSes don't exist so we can admire their austere beauty, they exist so we can get things done with application programs.
... but it certainly confirms my strong aversion to putting anything Adobe on my machines. Seriously, who hasn't noticed how invasive and hoggish Adobe's stuff is? I cringe when I click a link to a PDF in a website, causing Adobe reader to launch inside the browser. It brings any machine to its knees as it consumes every available resource while rendering a simple document. And Adobe Elements (that's their "lightweight" photo product) takes the better part of a minute to start up on my dual core, 2GB box (non-RAIDed SATA drive). I guess it shouldn't surprise me that they have security problems as well... slow software is usually sloppy software, and sloppy software is usually insecure software.
It comes with $20,000, $10,000, or $5,000, depending on what day you hacked it. The guy who cracked the Mac got $10,000 and the Vista machine came with $5,000 since it was cracked later. And you can always install *nix.
The laptop isn't insecure, the attacks are taking place against the operating system (and in all three cases, against specific applications - none of the three were hackable without the user taking certain actions).
The really fun thing about absolute statements is that one counter-example disproves them. I use Linux on desktop. See? You're wrong.:-)
Of course, so does my wife (who majored in fashion merchandising), and my 88 year old father, and the exchange student who stayed in my house last year, and roughly half of the thousand people at PyCon two weeks ago (just from snooping screens during the plenaries), and about 4% of the desktop users world-wide. True, that's small compared to Windows' 85% share and a bit below Mac's 8%, but it's certainly not "nobody".
And note that the market share leader Windows survived the Mac by a day (though, my friend the Mac-fan said that only proves the Mac was so much more desirable than the other two laptops - touché!:-)
I realize this is slashdot, so for those who didn't read TFA the contest was to in a 30 minute attack slot, read the contents of a specific file, in a specific folder. each day different exploits could be tested, but only popular software that is normally installed counted.
day one were pure network attacks nobody got in on day one. day 2 was email and url based attacks. only the mac got won on day 2. on day 3 you could add non default but popular software from a list (couldn't find the list anywhere on the net, sigh) and adobe flash was vulnerable, so the vista machine got taken.
Ubuntu held up for all 3 days, but because only popular and default software could be added, this could bring a false sense of security. there are many ways to 'design' a supposedly open source software package on say, sourceforge.net but to have a compromised binary that was made with slightly altered source code... to get a trojan on a linux system. repositories tend to be fairly well monitored, but there have been times where applications that are trojans have gotten into widely used repositories. as far as i can tell, sourceforge has no real method for testing if software contains trojans or not, so it's purely up to the community that uses sourceforge to report bad software, etc. i imagine that freshmeat is the same, and many many linux users use sourceforge or freshmeat to find specific linux applications they need or want...
maybe there aren't enough linux users yet to make this a huge issue, but with Microsoft's brand image going south (kinda the way IBMs did in the 90s) linux is sure to be finding more and more people who would rather deal with OSS than with bill gates.
well, firefox updating the day before a hacking contest would indeed make the ubuntu platform (the only one where firefox is default) the most secure, but one would think that if firefox is going to play that way, that Microsoft would release any patches they had in development the day before too, to be on the same playing field.
the fact that apple got cracked first, and presumably in a safari exploit shows that apple does not have the kind of security resources of either firefox (supported by aol, and google) or Microsoft can bring to a competition. Since the Microsoft vista system was taken out by an adobe vulnerability, and I often hear of adobe products having security holes, they might be in the same kind of boat as apple when it comes to releasing security patches.
Popcorn anyone? (Score:5, Funny)
Re:Popcorn anyone? (Score:5, Funny)
What kind ?
And if you say a light North American lager I'm going to smite you in the name of the almighty beer lord!
Parent
Re:Popcorn anyone? (Score:5, Funny)
Parent
Re:Popcorn anyone? (Score:4, Informative)
The Monty Python joke goes along the lines of, "This lager is like making love in a canoe - it's fucking close to water"
Parent
Re:Popcorn anyone? (Score:5, Insightful)
Parent
Re:Popcorn anyone? (Score:4, Insightful)
So by not using Windows, users are made more secure by not being such a targeted pool in the first place, (as influenced by marketshare). But the design of the OS helps too.
Parent
Re:Popcorn anyone? (Score:5, Informative)
The question isn't "Is Flash vulnerable?", but rather does a vulnerability at the application layer allow you to hack into the OS. It is entirely besides the point if Flash is flawed in the same way, thought there is a reasonable likelihood that it is not in this case. There are significant differences in code compiled for the various platforms. We Software Engineers call that "conditional compilation."
Parent
Re:Popcorn anyone? (Score:5, Informative)
Parent
Re:Popcorn anyone? (Score:5, Funny)
This thread IS for religious wars, isn't it?
Parent
Re:Popcorn anyone? (Score:5, Informative)
Well on Windows, sandboxing of permissions is different. There might still be the exploit but the level of vulnerability would most likely be higher on a Windows system as a result of IE running at a SYSTEM level permission rather than a USER level like in Mac or Linux. Change to a different browser like Firefox on Windows and you will be safer.
IE does not, and never has, run as SYSTEM. Prior to Vista it runs as the user who starts it. In Vista it runs with privileges lower than a regular user.
I realise Slashdot is as anti-Microsoft as they come, but it's still surprising to see the same FUD about IE still being spewed 10+ years after it was shown to be false.
Parent
Re:Popcorn anyone? (Score:5, Informative)
So, prior to Vista, when it ran as the user who starts it, given that over 90% of the cases the default user has complete and unlimited access to the system files, how is running as user different from running as SYSTEM? (And, yes, I pull that "90%" figure out of my arse---but I'll bet it's higher.)
Firstly, because SYSTEM and Administrator have different privilege levels.
Secondly, because there is a vast gulf of difference between the statements "IE runs as SYSTEM" and "IE runs as the user, which is sometimes Administrator, and I think that Administrator and SYSTEM are the same". One is a (serious) architectural problem, the other is an end-user configuration problem. Trying to say they are equivalent is at best ignorance and at worst lying.
Finally, while most home systems would certainly be running users as Administrator, most managed corporate systems would not. 90% is a ridiculous over-estimate of how many XP systems only have "Administrator" users.
Parent
Re:Popcorn anyone? (Score:5, Funny)
Parent
Re:Popcorn anyone? (Score:5, Funny)
Parent
Software sucks. (Score:5, Interesting)
Hey! (Score:5, Funny)
Re:Hey! (Score:5, Informative)
Parent
Re:Hey! (Score:5, Insightful)
*Useful to me; not to advertisers or corporate web designers who think interrupting the flow of my surfing and irritating the hell out of me are good ways to earn my shopping dollars
Parent
Newsworthy? (Score:4, Insightful)
Re:Newsworthy? (Score:5, Insightful)
Parent
Re:Newsworthy? (Score:5, Funny)
Parent
Re:Newsworthy? (Score:4, Informative)
Parent
Re:Newsworthy? (Score:5, Informative)
First, this wasn't some script kiddie applying a known exploit. It was a new exploit that the winning team came up with. It isn't trivial to do.
Second, no, this "could have happened to any OS" is wrong. A well-crafted browser (in this case, the browser is part of the OS) can in theory prevent browser plugins from accessing anything of importance. However I don't think any existing browsers do that - but they should.
Second, and perhaps more important, the existence of 3rd party software on different OSes isn't the same. For example, most Windows users use Adobe Acrobat to view PDFs, whereas many Linux users use FOSS PDF viewers (Evince, KPDF). It might be the case - and I am guessing that it is - that Acrobat has far more exploits against it, both because it has far more code (what with all the functionality 99% of users don't need), and that it isn't open source. In general Windows users tend to have lots of 3rd party apps that are closed source and of dubious quality. That isn't the case on Linux.
Furthermore, even if two OSes run the same app - Flash, say - that doesn't mean they are equally vulnerable. Flash isn't identical between the platforms; if I am not mistaken on Linux Flash uses Alsa for sound (or some other Linux sound system). So if Alsa is more secure than Windows' sound system, that would be one difference.
I'm not saying this competition is a great test of OS security. It isn't; it's an anecdote. But it isn't worthless either. In fact the results are pretty much what I would have expected from the beginning: OS X is a great OS but security has never been a top priority (there wasn't as much of a need for it, so why bother). Windows has focused on security recently but is hobbled by having lots of closed-source 3rd party apps. Linux was always security-focused (starting as a server OS), and has the advantage of most of its software being FOSS and arriving from a repo under the control of the distro (in this case Ubuntu).
Parent
Re:Newsworthy? (Score:5, Funny)
Parent
Re:Newsworthy? (Score:5, Interesting)
And no, it's not because IE7 is part of the operating system. It's because IE7 uses Microsoft's secure API to achieve sandbox mode. Firefox really needs to start taking advantage of this API. Otherwise their "most secure way to surf" bullshit is going to be called into question real soon.
Parent
Re:Newsworthy? (Score:5, Insightful)
In sum, what this means is that Windows systems depend heavily on closed-source software and the judgment of individual users, both of which are less secure than the community-oriented "more eyes" approach taken by open-source Linux distributions.
Parent
What did you expect? (Score:4, Insightful)
Re:What did you expect? (Score:5, Informative)
1. The contest did not require someone to 'own' the box to win. They just had to read the contents of some specific file somewhere in the OS. Unfortunately, they didnt publish where that file was, or what the file-system ACLs on it were.
2. The guy who took down the Vista box claimed in the article that it would only take them a few more hours of work to make the Flash vuln effective on OSX and Linux as well.
Parent
I think it is most fitting... (Score:4, Funny)
Something is Fishy (Score:5, Informative)
Flash, like all other plugins, run within the security context of the low-rights user used by protected mode. Even if the flash plugin had an obvious buffer overflow or other exploit, it would only be able to access the data accessible by that low rights user, NOT the user running IE. That's the point of protected mode.
For a flash plugin to allow for a hacker to access personal files of the user it would not only have to have a buffer overflow (or some other exploit) in flash itself, but also take advantage of a privledge elevation exploit in Windows simultaneously.
I didn't see them specify in the article what browser than were using. Since they said it was an issue with flash, and not Windows, they couldn't have been using IE. My guess is that it was Firefox, since they said they loaded "popular" 3rd party apps.
Futhermore, the file in question must have been accessible to the user running Firefox (or whatever non-IE browser) since that would also require a privledge elevation in Windows.
So I'm not really sure how you can blame this on Vista or even Microsoft. If they had been using IE, it wouldn't have happened, regardless of the flaws in Flash. This says absolutely nothing about Vista security. The exact same thing would happen on every other OS. If you have an app with an exploit, and that app is running as User A, the hacker using that exploit has the same rights as User A.
I suppose one could argue that various defensive techniques like ASLR [msdn.com] should have stopped this, but without knowing the details, that's impossible to say. A buffer overflow can just as easily be used to call APIs exposed by the exploited application as it can to call OS APIs, and since ASLR only applies to Windows APIs (indeed, many of these techniques only apply at the OS level), this wouldn't be a fair characterization either.
Indeed, I find it strange that they didn't mention mitigating factors. I realize they're trying to be responsible as far as reporting, but telling people that users running IE on Vista aren't affected isn't exactly giving anything away... aside from the fact that Vista did its job as best it could.
Re:Something is Fishy (Score:5, Informative)
You are right that plugins by default runs under the special low-rights "ieuser" account. Unless the plugin uses tricks to circumvent this security for some reason.
And that is exactly what flash does. It uses a special "broker process" which runs as a daemon/service. The restricted plugin then talks to this brokerprocess and thus breaks out of the sandbox.
The flash API indeed has methods for creating/deleting/reading files and even executing applications (Would you believe that?). Although Adobe/Macromedia have tried to ensure that flash actionscripts can only use these in a "safe" way; I believe it is probable that the exploit was somehove connected to a vuln in the broker process; quite possibly in some of these API functions. Using a broker process to break out of the sandbox can circumvent any security precautions taken by the browser.
Given that Flash vulns are often cross-platform I think it is quite likely that this also is a problem on Linux. Now, if the special file which the contestants had to retrieve required *admin rights* the yet another level of security had been broken (UAC). But at this time we can't really determine.
Parent
Re:Something is Fishy (Score:4, Informative)
Parent
Re:Something is Fishy (Score:5, Interesting)
It is running as *me*, with my rights. Not for long now, though. Bye Flash.
Oh, and there's also an "Acrotray.exe" - from the same company. Guess what that does?
Parent
Re:Something is Fishy (Score:5, Informative)
Unless that file was specfically marked readable by the low rights user (which would be obvious cheating), or unless it was placed in a directory accessible by that user (temp directory, for instance), they could not have been using IE.
Parent
Re:Something is Fishy (Score:5, Informative)
A broker service is used when reading or writing to user files (such as when they save a file to their desktop, or upload a document to a web site). This isolates the potentially dangerous code into a very small (~10k lines) application that is far easier to audit. This application runs as the normal user, and essentially accepts requests from the low rights IE process when actions need to be performed on user files.
Parent
Re:Something is Fishy (Score:5, Informative)
I don't even know why Microsoft bothers trying to secure stuff when morons like Adobe just go and fuck it up.
Parent
Re:Something is Fishy (Score:5, Insightful)
See the following: background info [robertdowney.com], and most of this post [robertdowney.com] deals with UAC.
Parent
Re:Something is Fishy (Score:5, Insightful)
What the hell? Do you only read highly moderated Slashdot comments for all your information on Windows or what? One exploit in Firefox or Flash on Linux(default config on all major distros) can completely and silently wipe away all your user files or ftp them to Nigeria. All your smug talk about proper compartmentalization in "other OSes" won't help shit to stop that. Can you tell us what exactly on Linux would prevent the same hole in flash(or in Firefox) from shitting all over your user directory?
UAC is basically sudo and like the root password prompts that come up under GUI in Linux, except that MS didn't think that it would make sense to prompt a user already designated as a admin to enter the password because the vast majority of their users run in a single user environment. If the user is not an admin, then the admin password is prompted for. Can your provide some references for how windows not properly com
Contrast that to IE7 on Vista. Read this [msdn.com]. It's in part a implemtation of the Biba security model [wikipedia.org]. So a similar vulnerability in IE7 or any of its plugins(including Flash) will only be able work in sandbox that prevents access to anything but low risk files like temporary internet files.
From the linked article:So in order for the exploit on Flash to work on Vista SP1, it must have been run on Firefox/Opera/Safari/ OR it must have been run on IE7 and broken through the sandbox(quite possible, but the news shouldn't be about not only a exploit in Flash, but another one in Windows as well). THAT is the point of your parent post. And no, this is not an assumption. It's a fact even if you bury your head in sand.
Parent
Re:Something is Fishy (Score:5, Informative)
Not at all. What I'm suggesting is that when someone says that X is not possible because it isn't supposed to happen, it doesn't mean that it can't happen or won't happen. The Titanic was supposed to be unsinkable. AACS was supposed to be unbreakable. The four-minute mile was supposed to be unachievable.
I'm not foolish enough to claim that *nix cannot be rooted or cracked. Just that because of its design it is inherently more secure and more difficult to crack than a system that still allows apps to run in rootspace.
The baggage of supporting legacy apps that require(d) administrator access. Because Windows had been designed for so long to be run by a single user-administrator, there are plenty of apps that simply won't run without admin-level privileges.
Not exactly. When an OS is designed from the ground up as a multiuser system (such as *nix), it is very easy to restrict access to system resources. If I want to install a piece of software on Linux, for example, I cannot make the installation system-wide (by writing to /usr/bin, for example) without admin privileges. I cannot install libraries to /lib, /usr/lib, etc. I cannot write settings to /etc. Even when installed and executed, that program will only have a restricted set of rights based on the user/group that executes it. I can, however, compile and run executables as a user without needing admin access and without write access to system files and/or directories. I can put whatever libraries, modules, settings etc are required in my home directory without needing access to restricted areas.
Yes, I do run the risk of hosing my /home/user directory and everything inside of it, but I cannot touch any other user's files, and cannot touch system files.
Windows, on the other hand, has a hybrid model where a multi user model is tacked onto a single user-admin model, or rather support for a single user-admin model is bolted onto a basic multiuser model. Basic, because a true multi-user system would never have a single repository for all settings, like the Windows registry.
Please explain.
No. What I'm saying is that the my sysadmin's argument is very similar to the OP's argument. The OP said that because IE7 isn't supposed to allow a system level exploit via something like Flash, then therefore it isn't possible. My sysadmin said that because she configured Exchange to block autoforwarding to public webmail then it isn't possible. It is clearly possible to to autoforward my mail to gmail, and I did it and showed her to prove a point. She seems to think I manually forwarded the messages and somehow spoofed the reply-to field, and that autoforwarding is impossible because it shouldn't happen.
It's the same point I'm making now, and am running out of ways to say: Just because something shouldn't happen doesn't mean it won't or can't.
More on topic, if an app has elevated rights, then exploiting a vulnerability in that app will give the exploit/exploiter elevated rights. There are very few apps on *nix (none that I can think of) that run or need to run with elevated rights. There are a lot of apps on Windows that expect to have admin rights, regardless of whether or not such access is needed. This is why the problem is structural, and why I used the example of the incomplete wall.
Parent
Re:Something is Fishy (Score:4, Insightful)
Really? What I hear is Vista security sucks in the real world. Seems to me that that's what most /.ers would like it to say. After all, OSes don't exist so we can admire their austere beauty, they exist so we can get things done with application programs.
Parent
I don't know about a religious platform war .... (Score:5, Insightful)
Re:Let me get this straight (Score:4, Informative)
Parent
Re:Let me get this straight (Score:4, Insightful)
Parent
Re:Let me get this straight (Score:5, Funny)
Parent
Re:Let me get this straight (Score:4, Informative)
Parent
Re:Let me get this straight (Score:5, Funny)
Parent
Re:It is becoming more clear every day (Score:5, Funny)
Parent
Re:Know this: no one uses linux on desktop, no sof (Score:5, Insightful)
The really fun thing about absolute statements is that one counter-example disproves them. I use Linux on desktop. See? You're wrong. :-)
Of course, so does my wife (who majored in fashion merchandising), and my 88 year old father, and the exchange student who stayed in my house last year, and roughly half of the thousand people at PyCon two weeks ago (just from snooping screens during the plenaries), and about 4% of the desktop users world-wide. True, that's small compared to Windows' 85% share and a bit below Mac's 8%, but it's certainly not "nobody".
And note that the market share leader Windows survived the Mac by a day (though, my friend the Mac-fan said that only proves the Mac was so much more desirable than the other two laptops - touché! :-)
Well, anyway, sorry to have fed the troll.
Parent
Re:Know this: people use linux on desktop (Score:4, Informative)
Parent
Re:What kind of exploit? (Score:5, Informative)
day one were pure network attacks nobody got in on day one. day 2 was email and url based attacks. only the mac got won on day 2. on day 3 you could add non default but popular software from a list (couldn't find the list anywhere on the net, sigh) and adobe flash was vulnerable, so the vista machine got taken.
Ubuntu held up for all 3 days, but because only popular and default software could be added, this could bring a false sense of security. there are many ways to 'design' a supposedly open source software package on say, sourceforge.net but to have a compromised binary that was made with slightly altered source code... to get a trojan on a linux system. repositories tend to be fairly well monitored, but there have been times where applications that are trojans have gotten into widely used repositories. as far as i can tell, sourceforge has no real method for testing if software contains trojans or not, so it's purely up to the community that uses sourceforge to report bad software, etc. i imagine that freshmeat is the same, and many many linux users use sourceforge or freshmeat to find specific linux applications they need or want...
maybe there aren't enough linux users yet to make this a huge issue, but with Microsoft's brand image going south (kinda the way IBMs did in the 90s) linux is sure to be finding more and more people who would rather deal with OSS than with bill gates.
Parent
Re:What kind of exploit? (Score:4, Interesting)
the fact that apple got cracked first, and presumably in a safari exploit shows that apple does not have the kind of security resources of either firefox (supported by aol, and google) or Microsoft can bring to a competition. Since the Microsoft vista system was taken out by an adobe vulnerability, and I often hear of adobe products having security holes, they might be in the same kind of boat as apple when it comes to releasing security patches.
Parent