Abusing Symbolic Links Like It's 1999 54
An anonymous reader writes with this snippet from James Forshaw's recent post at Google's Project Zero, which begins For the past couple of years I've been researching Windows elevation of privilege attacks. This might be escaping sandboxing or gaining system privileges. One of the techniques I've used multiple times is abusing the symbolic link facilities of the Windows operating system to redirect privileged code to create files or registry keys to escape the restrictive execution context. Symbolic links in themselves are not vulnerabilities, instead they're useful primitives for exploiting different classes of vulnerabilities such as resource planting or time-of-check time-of-use. Click through that link to see examples of this abuse in action, but also information about how the underlying risks have been (or can be) mitigated.
we can fix this (Score:4, Funny)
it seems to me that we can stop shit commercial software from being published if governments set up a mandatory bug bounty systems. it's simple, you demo the exploit and get money based on the severity and the company making the software must pay it and has X days to fix it before paying the fine again. this would result in either better education on how to find exploits, better Q/A mechanism or companies going under. frankly, i don't care which happens as long as commercial software is held accountable for bad code.
Re: (Score:2)
Re:we can fix this (Score:5, Funny)
Hey! Our product line is created, maintained and supported by the finest professionals $1.75/hour can buy!
Re: (Score:3)
Because if it's gratis there is no implied warranty of merchantability. If it's proper Free software (not tivoized), anyone can fix the bug.
If it's proprietary, there are implied warranties on it and only the creator has the source needed to fix it.
Re: (Score:3)
Re: (Score:2)
If the jurisdiction is large enough, I doubt it. For example, Europe or North America.
Re:we can fix this (Score:4)
You will simply kill the proprietary software in this jurisdiction.
You say this as though it's a bad thing...
Re: (Score:2)
Cost of distributing free software (Score:2)
Applying implied warranties to all computer programs distributed for a fee makes it impractical to recover the cost of distributing free software on physical media.
Re: (Score:2)
No, because the only warranty applying to the distribution is on the media itself being a faithful and readable copy of the software. Distributing for a fee doesn't make you responsible for that which is distributed.
Re: (Score:2)
Then how wouldn't proprietary software be able to avail itself of the same loophole?
Re: (Score:2)
Simple test: If you don't care if I hand out copies of the software after I buy the disk from you, then you were legitimately charging me a fee for distribution of free software. If you object, you were actually licensing the software to me.
DMCA (Score:2)
Then make it lawful to copy but not to use. The legal structure needed to enable this has been in place since October 1998, when the U.S. Congress made it unlawful to decrypt a program's installer without permission from the program's copyright owner. So someone would have the encrypted bits but not the license code to use them.
Re: (Score:2)
And that still makes it not OK to pass around freely, so it's still a charge for a license and not for a distribution. It's should be wquite obvious by now, it's a bright line test and it does make things quite clear if there is a software licensing component to the fee or not.
Re:we can fix this (Score:5, Informative)
If it's proprietary, there are implied warranties on it
Since when?
Microsoft excludes all implied warranties and conditions, including those of merchantability, fitness for a particular purpose, and non-infringement.
Bolded in the eula itself.
--
BMO
Re: (Score:3)
https://www.microsoft.com/en-u... [microsoft.com]
Forgot to put in the web page.
--
BMO
Re: (Score:2)
We are entitled to disallow that disclaimer by law should that be desired.
Re: (Score:2)
I think it depends on where you are and what is being done [ca.gov]. Some places have restrictions on what companies can deny responsibility for, so there is usually (not bothering to look it up this time) a clause in the EULA saying the if part of it is invalidated, the rest still applies.
"There should be a law" is, perhaps, a better starting point. I've thought on this topic for a while and have some ideas about what should happen and how and when, but I am sure I'm missing some important issues and my wording nee
Re: (Score:1)
If your local law allows you to recover damages from Microsoft even though this agreement does not, you cannot recover more than you paid for the software (or up to $50 USD if you acquired the software for no charge).
From country where I come from (Slovenia) I have checked and i can confirm that software is #1 product that is least regulated product. One is by law unable to get refund on open CD and costumer protective laws does not apply for software. I think that is legally allowed to sell software on blank CD without any data. Software is single product on market that is 100% unregulated.
Re:we can fix this (Score:5, Insightful)
The end of your post combined with your signature is comedy gold, mate.
Re: (Score:1, Funny)
Your ideas are just like the ideas for fixing spam. I am sure my fellow slashdoters can help fix up the list...
Your post advocates a
( ) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it wonâ(TM)t work.
(One or more of the following may apply to your particular idea, and it may
have other flaws which used to vary from state to state before a bad federal
law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mail
Re: (Score:1)
Re: MS is still 20 years behind. This will remain (Score:1)
And under John Thompson, they're getting even farther behind. The man just doesn't get why good QA is important. After what he did to Symmantec, I can't believe any one would give him a job, much less make him head of Microsoft.
Re: (Score:3, Insightful)
Why have paid QA when your customers have proven over and over again that they'll still buy your software no matter how buggy it is? Thompson isn't that bright, and got his job just because of his race, but he isn't stupid.
You want me to what now? (Score:5, Funny)
"Click through that link to see examples of this abuse in action"
o_O
(And yes, i'm aware that URL links are not the same as symbolic links, but the phrasing is still amusing.)
.
Windows uses a unix file hierarchy (Score:3, Informative)
I never realized that Windows uses a unix-like file hierarchy.
According to the article, drive C: is actually a symbolic link to \Device\HarddiskVolume4, COM3 is \Device\Serial0 and so on.
I'm surprised, frankly. My exposure to Windows is pretty much nil (and I like it that way) but I always assumed that the the C: drive and COM: stuff was a completely different way of accessing the devices and whatnot than what Unix uses. Apparently, it's actually quite similar once you get under the hood.
Learn something new every day....
Re: (Score:1)
I knew about that, but I've always wondered what the namespace was for things like S-1-5-21-nnnnnnnn-nnnnnnnnn..." [microsoft.com] that I see in $RECYCLE.BIN and elsehwere whenever I poke under the hood. Neat.
Re: (Score:2)
I never realized that Windows uses a unix-like file hierarchy.
According to the article, drive C: is actually a symbolic link to \Device\HarddiskVolume4, COM3 is \Device\Serial0 and so on.
I'm surprised, frankly. My exposure to Windows is pretty much nil (and I like it that way) but I always assumed that the the C: drive and COM: stuff was a completely different way of accessing the devices and whatnot than what Unix uses. Apparently, it's actually quite similar once you get under the hood.
Learn something new every day....
The NT object manager, doesn't that have more in common with VMS than UNIX?
Linux's sysfs is similar, in ways, but neither of these are unix-like unless... um, all hierarchies of objects are unix-like?
If you're sincerely interested in OS internals, you should expose yourself to other systems without prejudice. Otherwise, everything "tastes like chicken".
Just like systemd and /etc/resolv.conf? (Score:1, Informative)
It's a symlink into a systemd managed ntwork configuration repository, until the user breaks the link deliberately or accidentally with a text editor or configuration tool like puppet, cfengine, Chef, BladeLogic, Tuttle, or anyone else's homebrew server configuration tools, and then it *stays* broken permanently. See https://wiki.archlinux.org/ind... [archlinux.org]
Once gain, Mr. Pottering fails to understand the File System Hierarchy and why you don't dink with other people's stable tools.
Re: (Score:3)
systemd is responsible for that mess?
Before learning about this, I merely *disliked* systemd.
But now...?
KILL IT WITH FIRE!!!
As the old saying goes... (Score:5, Insightful)
On proper time Windows has added symlinks, a (somehow) worthwhile command line, non-graphic environment, the ability to remotely manage, declarative-based configuration management...
It's only they are reinventing all these things on their own, forgetting about how did they came to be and, of course, not caring about the way those facilities have been used and abused in the past.
I think it was Henry Spencer the one that said "Those who do not understand Unix are condemned to reinvent it, poorly."
Re:As the old saying goes... (Score:5, Funny)
On proper time systemd has added symlinks, a (somehow) worthwhile command line, non-graphic environment, the ability to remotely manage, declarative-based configuration management...
It's only they are reinventing all these things on their own, forgetting about how did they came to be and, of course, not caring about the way those facilities have been used and abused in the past.
I think it was Henry Spencer the one that said "Those who do not understand Unix are condemned to reinvent it, poorly."
Hehe
Re: (Score:2)
"Your comment is almost completely irrelevant."
So you think.
"Also, it's more than a little arrogant to suggest that Unix is the penultimate OS"
On one hand, it is not me, but Henry Spencer, the one saying that. On the other hand, some OS has to be the penultimate one.
"Linux, for one, suggests that it is not."
Linux is not a Unix reinvention but a Unix rewriting; if anything, it suggests the opposite of your position.
"Like it's 1999"? (Score:1)
Re: (Score:1)
Wait, Windows has symbolic links? (Score:2)
Since when has Windows had symbolic links? Shortcuts, sure, but they're not the same. And neither is as good as hard links if you're on the same filesystem.