Attack Code Found For Recent Windows Bug

CWmike writes "Just a day after downplaying the vulnerability that caused it to issue an out-of-cycle patch last week, Microsoft warned customers late yesterday that exploit code had gone public and was being used in additional attacks. 'We've identified the public availability of exploit code that now shows code execution for the vulnerability addressed by MS08-067,' said Mike Reavey, operations manager of Microsoft's Security Response Center, in a post to the MSRC blog. 'This exploit code has been shown to result in remote code execution on Windows Server 2003, Windows XP, and Windows 2000.'"

Hotpatching

For those interested, there was a really cool hack [nynaeve.net] of hotpatching the files and services that are affected by this exploit. The Microsoft patch isn't designed to be hotpatched, instead requiring a reboot to replace the needed files. However, by using a binary diff and DLL injection you can apply the patch on the fly without rebooting.

I wish Microsoft would put more effort into making the official patches not require a reboot. Consumer operating systems are one thing, but rebooting Windows servers gets annoying really fast.

Re:Hotpatching

However, by using a binary diff and DLL injection you can apply the patch on the fly without rebooting.

Is that something you would want to do on a production server?
And if you were MS, is that something you would want to support?

Re:Hotpatching

>And if you were MS, is that something you would want to support?

If you were MS, and wanted to brag about 5 Nines uptime, wouldn't you design the patch so you didn't have to reboot production servers once a month?

Glad I spent all weekend patching, now that the exploit has escaped.

Re:Hotpatching

If you were MS, and wanted to brag about 5 Nines uptime, wouldn't you design the patch so you didn't have to reboot production servers once a month?

5 nines is ~5.3 minutes downtime per year

You don't acheive that with a single Linux box either, unless you simply aren't keeping it up to date, even if you manage to avoid 'rebooting it' you are still going to have serious trouble reliably preventing 'unavailability of services' from reaching 5.3 minutes over a year.

It takes either a mainframe or a cluster to reach 5 9's with any reliability. Windows doesn't run on a mainframe, and if you have cluster, a few scheduled reboots now and then don't result in any downtime, since you don't have to bring the entire cluster down.

So your argument really doesn't apply.

Re:Hotpatching

No, I've managed to have a single Linux box reach 99.999%

"Managed to have"? You are talking about 5 9's as something that you can reach. People who demand 5 9's consider that the minimum they will accept. They don't want systems that can reach 5 9's they want systems guaranteed not to be less than 5 9's. That's a HUGE difference.

So if we sign an SLA, how certain should I be that you can deliver 5 9's? ... From one box? Not very.

That fact that you might 'manage it' simply isn't good enough. What happens when a piece of hardware fails? or if an update doesn't go smoothly? With a single box you have no contingency and 5 minutes to resolve any problems and perform any updates that might be needed for the entire year.

My point stands: anyone serious about delivering 5 9's simply isn't using a single box, because you simply can't depend on it. MAYBE you'll get 5 9's out of it, but getting 5 9's from a single box is like winning a prize from a scratch and win. Its not exactly a miracle, but its hardly something you can rely on.

Hell, even promising 4 9's from a single box is taking on some heavy risk. It's not hard to envision an unexpected hour of downtime on a box over the course of a year.

Re:Hotpatching

My current longest uptime:

$ uptime ; uname -r
00:49:19 up 1222 days, 14:09, 1 user, load average: 0.00, 0.00, 0.00
2.6.11-hardened-r14

Yeah, it doesn't actually do much. Just lets me win willy-waving matches.

Re:Hotpatching

Oh yeah? Well, uh, nyah.

$ uptime ; uname -r 00:40:23 up 1222 days, 14:10, 1 user, load average: 0.00, 0.00, 0.00 2.6.11-hardened-r14

You made that post 51 minutes after he did.

So close, but forever in his shadow :-)

Re:Hotpatching

Come on, it's dead simple and it's safe. Just install a page fault handler and mark all the pages of the DLL as being unavailable, examine the current thread state of all processes and mark them if they are currently executing in the unavaiable pages, and if so simply return success from the page fault handler until the thread leaves the locked region (essentially single step through the DLL until it finally returns to the caller). If a thread was not originally executing in the protected pages and enters it, just stall it. Once all threads are stalled or not accessing the locked pages, patch the DLL and mark the pages available and uninstall the page fault handler.

What could possibly go wrong? Only if the data structures that the DLL uses internally are modified will this be difficult, in which case the patched DLL will just have to convert its own data during the patch time. If changes to user data structures are required, then the patched DLL would have to burn some space in each new data structure to identify it as a patched version and treat it appropriately, while detecting the old data structures reliably. That might be a little harder than the general case, but not impossible.

Is getting 0wned something you would want to happen on a production server that can't have downtime?

That's it! I'm switching to a Linux Desktop

Slashdot's unbiased coverage of an exploit for a patch that was released last week has finally convinced me to stop using MS products. I'm also beginning to think this MS might be evil as well.

Clarification

Just in case the /. entry seemed as ambiguous to you as it did to me, the linked article states "Our investigation has shown that it does not affect customers who have installed the update."

But not everyone has installed the update.

This is added incentive to complete YOUR testing of this patch ASAP.

Remember, only incompetent admins apply patches without testing them.

In our environment, the patch would have been put into testing the day after it was released (no sense getting caught by a brown paper bag bug) and then into production NEXT Sunday.

With a known exploit out there, we'd be getting more people to test the test systems TODAY. With the goal of putting the patch into production TOMORROW evening.

Re:But not everyone has installed the update.

Remember, only incompetent admins apply patches without testing them.

Cool.

Sounds like your part of an internal IT department of a big corporation. Well, I'm not. I admin several small businesses network which contain 5 to 20 users. Each company has one server which runs Windows SBS. So, testing isn't an option. Should there be a problem, I have no choice but to pull it out via the Add/Remove program list.

So, do you think I'm an incompetent admin given what I have to work with?

Re:But not everyone has installed the update.

Sure. You don't have a test network to at least smoke patches on or you would've said something

A fifteen user network all running off a cable modem, router/firewall, and Windows 2003 SBS. Sure, let me pitch the sale for them to purchase another SBS box (for testing purposes only) and the billable time required for each test required per monthly patch cycle...

What happens when your SBS box barfs

Rebuild it, add PCs back to the domain, and restore user data and exchange data. I've done it before and it's a lot cheaper alternative to the one above. Funny isn't? Sometimes it's cheaper to let a server crash and burn than spend money on preventive maintenance. It's all in how much the customer wants to spend.

the droning *gong* of microsoft cracks

This is like a droning gong.

*Gong* Bring out your dead *Gong* Windows is insecure *Gong* Bring out your dead *Gong*

It seems to me there is a fatigue that sets in regarding unpleasant information. How many times does one have to hear a thing, especially an unpleasant thing they don't want to hear, before that person stop listening to it? This happens to me at least. We see this (as a parallel) in politics all the time, when we're told this guy or that person broke the law. Its like a background din you have to tune out to get through the day.

It's made worse because there is no solution.

For the user of windows, there is nothing they can do about the fundamental insecurity that leads to repeated, consistent, and regular security updates like this. The only option is to change OS, which if you're the average computer user, that is not an option without significant expense. It's unpleasant to hear that crackers are breaking into computers and turning them into zombie swarms of attacking botnets. Hear the same bad thing enough times, eventually people stop listening.

I was fortunate: my windows laptop was stolen in 2004 and I made the switch, and now use Mac and Linux now exclusively. Not that Mac is any panacea - I still can't stand Finder, I think it is awful, and curse it every time I need to move a few files to some other folder on another drive (usually I just use "mv"). BUT at least I'm not forced to start ignoring serious security threats that I can't prevent or address effectively. (I don't consider a long series of "After the crack" patches effectively addressing the problem)

I'm not Microsoft lover, but

I'll give them credit for patching this quickly. This could have been Yet Another Windows Worm (TM) that brings all legitimate network traffic to a halt. And us Slashdotters have been after them for years for taking too long to patch things, so it would be completely hypocritical to get pissed at them for doing what we'd want them to do.

I'll hate them for having the exploit possible in the first place, I'll hate them for requiring reboots, I'll hate them for forcing crappy software down our throats, but every once in a while they do something right.

Microsoft didn't downplay this

Instead they issued an out-of-cycle patch and they gave it a very high severity rating in their bulletins. None of us are Microsoft lovers. But you don't have to lie to us just to be able to pat us on the back. It's disgusting, please stop it.

Metasploit

Be warned; this is already on metasploit. The intrepid can find this for themselves...

Testing it to see if it actually works though.

Re:Another out-of-cycle patch is coming, right?

No, this is the same exploit we talked about before.
If you patched on the 23rd, you should be fine.

Re:Hmmm...

I've run Ubuntu on a Dell Inspiron 9400 laptop for over a year without a single lockup.

Now, I also run VirtualBox and Windows XP under that. *That* has locked up several times. So if that's what you mean, I agree.

Re:Hmmm...

Who the fuck runs windows on a server? Context man, context!

There, fixed it for you.

Re:Hmmm...

Well, to be fair, their discussion took place on Wiki pages, so it was either Ubuntu 8.04 or HAHAHHAYOUSUCKCOCKS.

Re:Hmmm...

Well, to be fair, their discussion took place on Wiki pages, so it was either Ubuntu 8.04 or HAHAHHAYOUSUCKCOCKS.

Yeah, I can see that some 13 year old vandal might think that it was funny to replace "Red Hat Enterprise Linux 5.2" with something silly like, er... "Ubuntu 8.04" ;-)

BTW, HAHAHHAYOUSUCKCOCKS 2.06 is a fine server distro and I won't hear a word against it.

Re:Hmmm...

But it does make a damn fine server. The software is reasonably up to date, the administration is dead-simple, and I'm already familiar with it from my desktops.

I've got other things to concentrate on besides server administration -- like coding my project management and billing system, or working for my clients so I have something to bill them for. Ubuntu makes that easy for me.

I've recently vetted Slackware, Debian (stable), and Ubuntu Server 7.04, and settled on the latter because it strikes the balance I need between stability and up to date software. You may legitimately disagree with my choice, but I have my reasons and I'm sure you have yours. Most Linuxes make great servers, so it's really choosing your favorite incarnation of "awesome."

Re:Hmmm...

You may legitimately disagree with my choice, but I have my reasons and I'm sure you have yours. Most Linuxes make great servers, so it's really choosing your favorite incarnation of "awesome."

Damnit! Stop doing that. Your job on Slashdot is to perpetuate the holy OS wars. If you start to lose an argument based in 'nuh uh, yeah huh' then immediately question the person's choice of vi verses emacs.

Never EVER admit that something may come down to personal preference unless you are willing to follow it up by blatantly trashing said person's personal preference by calling them 'dumb' or 'retarded'. Finally, if you are totally and completely losing the argument, link to final irrefutable proof: like this [goatse.cx]

Re:Hmmm...

Why should anyone bother submitting a bug report? If it's a minor issue and I have a workaround - sure, I'll submit a bug report. But if a system is completely unusable with Ubuntu, I will better spend my time finding a working alternative. Having said that, as a Unix sysadmin I have nothing against Ubuntu, other than using it on a server is not the best idea: there are many far more stable alternatives. The problem with most Linux aficionados out there is that few of them worked in a real production environment of a big datacenter. These guys may know how to configure Apache and MySQL on their Ubuntu PC, but they don't see a difference between getting something to work and getting it to be fast and reliable under constant heavy load.