Hackers Exploited Windows 0-day for 6 Months After Microsoft Knew of It (arstechnica.com) 46
Hackers backed by the North Korean government gained a major win when Microsoft left a Windows zero-day unpatched for six months after learning it was under active exploitation. From a report: Even after Microsoft patched the vulnerability last month, the company made no mention that the North Korean threat group Lazarus had been using the vulnerability since at least August to install a stealthy rootkit on vulnerable computers. The vulnerability provided an easy and stealthy means for malware that had already gained administrative system rights to interact with the Windows kernel. Lazarus used the vulnerability for just that. Even so, Microsoft has long said that such admin-to-kernel elevations don't represent the crossing of a security boundary, a possible explanation for the time Microsoft took to fix the vulnerability.
"When it comes to Windows security, there is a thin line between admin and kernel," Jan Vojtesek, a researcher with security firm Avast, explained last week. "Microsoft's security servicing criteria have long asserted that '[a]dministrator-to-kernel is not a security boundary,' meaning that Microsoft reserves the right to patch admin-to-kernel vulnerabilities at its own discretion. As a result, the Windows security model does not guarantee that it will prevent an admin-level attacker from directly accessing the kernel." The Microsoft policy proved to be a boon to Lazarus in installing "FudModule," a custom rootkit that Avast said was exceptionally stealthy and advanced. Rootkits are pieces of malware that have the ability to hide their files, processes, and other inner workings from the operating system itself and at the same time control the deepest levels of the operating system. To work, they must first gain administrative privileges -- a major accomplishment for any malware infecting a modern OS. Then, they must clear yet another hurdle: directly interacting with the kernel, the innermost recess of an OS reserved for the most sensitive functions.
"When it comes to Windows security, there is a thin line between admin and kernel," Jan Vojtesek, a researcher with security firm Avast, explained last week. "Microsoft's security servicing criteria have long asserted that '[a]dministrator-to-kernel is not a security boundary,' meaning that Microsoft reserves the right to patch admin-to-kernel vulnerabilities at its own discretion. As a result, the Windows security model does not guarantee that it will prevent an admin-level attacker from directly accessing the kernel." The Microsoft policy proved to be a boon to Lazarus in installing "FudModule," a custom rootkit that Avast said was exceptionally stealthy and advanced. Rootkits are pieces of malware that have the ability to hide their files, processes, and other inner workings from the operating system itself and at the same time control the deepest levels of the operating system. To work, they must first gain administrative privileges -- a major accomplishment for any malware infecting a modern OS. Then, they must clear yet another hurdle: directly interacting with the kernel, the innermost recess of an OS reserved for the most sensitive functions.
Thank goodness (Score:2)
Thank goodness no Bad Actors took advantage of this.
What's that you say? Tens of thousands of deployments to unsuspecting users?
Not to worry, friend, I'm sure that Microsoft will do whatever it takes to make it right, such as issuing a press release that downplays the severity and damage of their negiligence.
Re: (Score:2)
Late Stage capitalism.
With striking similarities to Late Stage cancer...
Re: (Score:1)
Re: (Score:2)
Capitalism is at odds with a free market as a free market negatively affects profits.
Re: (Score:1)
Capitalism is at odds with a free market
Not as much as Communism, but I take your meaning and I tend to agree for my own reasons. I think capitalism with giant oligarchs turns to fascism pretty quick.
as a free market negatively affects profits.
Well sure. If you cannot stomp out your competition, get the government to "license" any newcomers (thus thinning them out), and dominate the consumers with the MSM, you'll end up losing profits to upstarts and competitors. The consumers win and so do businesses that add real value, but the monoliths who simply use the force of government to keep the
Re: (Score:2)
Yes, buying government is often one of the cheapest ways to maintain/enhance profits. Without government, they still strive for monopoly and will lie and cheat in pursuit of profit.
Microsoft has a point (Score:5, Insightful)
Re:Microsoft has a point (Score:4, Insightful)
That attitude might come as a surprise to the Digital Rights Management, we gotta have secure boot crowd.
However I agree is admin->Kernel is NOT a security boundary ordinary users should even want. As a practical mater its probably "anti" security in that it just means its more difficult to actually audit anything that is happening in kernel land.
Re: (Score:2)
Agreed. I'm going to gave to agree with Microsoft's position on this. Now the floor feels chilly...
Re: (Score:2)
That attitude might come as a surprise to the Digital Rights Management, we gotta have secure boot crowd.
Totally agree.
Re: (Score:2)
And ... in the non-corporate world nearly everybody with Windows 10 or later probably has admin access. That's how Windows insists on setting up computers. All you get when installing something is a box asking if you want to make changes - yes or no - no special password or other authentication required. With the typical reaction to such a question for most people being "Yes" Bob's Your Uncle for the malware installers.
Re:Microsoft has a point (Score:5, Insightful)
Re: (Score:3)
If someone already has admin level privileges then the game is pretty much over. There are likely millions of ways to modify the kernel at that point so patching one way is pointless.
As hard as it is to agree with Microsoft in general, you're absolutely right. I see other posters talking about how this is downplaying the severity, and all is woe..but that's just not the case. If the threat actor already has persistent administrator-level access to your server, it's game over. Upgrading to kernel just gives them a little extra wiggle room to do things like defeat kernel-level antivirus and achieve greater persistence. By design, admin-level users need to be able to apply kernel patc
Re: (Score:3)
Re: (Score:2)
Let's say you're right. What's the potential mitigation here? Just never allow admins to install drivers just in case they're vulnerable?
The sole difference in this case is that the driver in question is bundled with the OS, so the vector exists on all copies of Windows. Sure, that's not ideal, but if you find a vulnerability in a ubiquitous, signed, 3rd-party driver the result is exactly the same. Realtek audio? Intel nic? Those drivers are on hundreds of millions of machines already, so no need to install
What's 6 months? (Score:2)
On a geologic scale, that's but an instant - nothing at all!
is that really a "zero-day"? (Score:4, Insightful)
I thought "zero-day" meant it was a new, previously unknown vulnerability? Once it's been discovered and reported to microsoft, doesn't that make it NOT a zero-day anymore?
Sure, it WAS a "zero-day", but so is every other vulnerability - until it's noticed and reported.
Calling a vulnerability that was reported six months ago a "zero-day" seems to fall somewhere between click-bait and outright dishonest reporting.
I don't think we have a tidy name for a vulnerability that's been languishing for months waiting for a patch though - and that's exactly what this is. Just a vendor dragging their feet about patching a reported hole in their system. (and in this case, trying to down-play the severity)
I also think the down-play is pretty disappointing - don't most Windows users run as admins? So for example. this would affect 98% of users that were sent an attachment? I don't buy "this only affects 98% of our users, so its not urgent"?
Re: (Score:2)
A 0-Day traditionally referred to the number of days administrators/operators have had to apply a patch or official workaround.
a vulnerability is a 0-day until there is a known fix.
Re: is that really a "zero-day"? (Score:2)
It originally referred to the number of days between public disclosure or active exploitation in the wild, and the patch. If one defined it as defined the number of days between private discovery and the patch, then every vulnerability is a zero-day vulnerability and the term becomes useless.
Re: (Score:2)
Re: (Score:2)
Zero day is a temporary status. Vulnerability is discovered by a bad actor and exploited. The victims are the victims of a zero day. Vendor releases a patch a week later, the vulnerability loses it's zero day status. Anyone exploited in the mean while was the victim of a zero day. Someone gets hit after the patch came out. They are NOT victims of a zero day.
Re: (Score:2)
Maybe it's a 180-day exploit in this case.
Re: (Score:2)
In my opinion, "zero-day" should be reserved for security holes that the Bad Guys found first and are actively exploiting, that the developers have just been informed about and are rushing to develop, test, and release a patch for, but haven't had enough tiime yet, leaving a *short* window of opportunity for the bad actors to take advantage of the opening before it gets closed on them. The "zero" in "zero-day" was intended to represent the amount of NOTICE a developer has gotten that the hole exits, highli
Re: (Score:2)
Zero-day sounds way more "cool" than just "vulnerability." It makes it seem somehow more urgent, like the movie scenes with the good hackers trying to type faster than the bad hackers, with screens full of random lists popping up everywhere, in a race to save the entire city from a computer meltdown. Compared to all that urgency, a "vulnerability" is very, very boring!
Re: (Score:2)
that's why I said it smells like "click-bait"
could not pick a better name (Score:2)
Re: (Score:2)
Everytime M/S says the new Windows will be the most secure, like Lazarus, a new zero day comes back. Glad to see M/S is very consistent.
Using the words "microsoft" and "security" in the same breath much less sentence just makes me laugh.
The details (Score:5, Informative)
Summary: a kernel ioctl takes a call back function allowing, under the right constraints, execution of an arbitrary kernel function. A second callback provides control of data to the first. So it is a Bring Your Own Vulnerable Device (BYOVD) situation where one feeds crafted data to a vulnerable kernel function.
This is one of Window's biggest security problems: all the ancient cruft it ships with, much written by third parties for devices most people have never heard of but are sitting on the hard drive "just in case".
I Wonder (Score:2)
I wonder who at MS will be held accountable by the government for the treasonous act? Bwahaha LOL
Is M$ serious? (Score:1)
How can anyone at Microsoft actually say that and keep a straight face? Can we say "negligence", children? Can we say "laziness", children? Can we say "incompetence", children? Good, I knew you could.
Re:Is M$ serious? (Score:4, Insightful)
Re: (Score:2)
It is accurate. Anybody that is admin already has everything, including the crown jewels. The problem is not that anybody with admin access has won. The problem is that it is far too easy to get admin access on Windows. Toy-level security.
The Lazarus Group (Score:2)
This lot were the subject of a coue of series of BBC podcasts, due to the mayhem they were wrecking.
They were linked to a massive Sony hack, a billion dollar bank heist, a scam involving a vast number of people using fake ATM cards, the Heartbleed attack, amongst others.
They're also apparently linked to a quasi-legal casino in China.
They're a particularly nasty lot, and giving them any kind of assistance is a Bad Thing.
Windows is used heavily by the US government. Not a group you want the North Koreans pwni
Re: (Score:2)
Re: (Score:2)
Good point.
Microshit 2024 (Score:1)
They still do not get it. The never will. Anybody using their crap for anything critical is asking to get hacked.
Re: (Score:1)
Re: (Score:2)
You seem to have me confused with somebody else. Or maybe you are just stupid. Or both?
Re: (Score:1)
Re: (Score:2)
I have never once argued for Socialism or Communism. You are deeply confused. Maybe the difference is that I actually know what "Socialism" and "Communism" means. I also know that both systems are deeply flawed, same as unregulated capitalism.
Re: (Score:1)
You are deeply confused.
Nope, you are deeply gaslighting, badly.
Remove Windows Now (Score:2)
Things like this is why no organization should use Windows in their environment.