https://bugs.chromium.org/p/project-zero/issues/detail?id=18...
Edit: it's unclear: https://twitter.com/taviso/status/1161297483139407873
I'm not surprised, seeing how deep this reaches and the scope of the issues.
And the toolset Tavis used is also released (linked in the blog):
Is it actually reasonable to disclose this just for missing the deadline given that it has already been exploitable for twenty years? I know nothing about security but I just feel so bad for people who have to scramble to fix this legacy system which they probably had nothing to do with. I don't think I have ever seen a good secure system understood, redesigned and reimplemented in less than a quarter. The exploit author himself seems to have spent months on this without coming up with a fix either.
Second, these things are a lot more correlated than you think. Look at Spectre recently: those bugs have been in there in various ways for what, 20+ years? Yet something like 3 different research groups all came across variants of it simultaneously. There are pervasive correlations leading to https://en.wikipedia.org/wiki/Multiple_discovery - people use similar tools like fuzzers, they follow similar research topics and gossip, certain things become 'obvious' to everyone simultaneously, and so on. OP might not think that anyone else is working along similar lines, but how could they know that? How should anyone interested in Spectre have known that there were (at least) that many other groups finding similar problems?
https://bugs.chromium.org/p/project-zero/issues/detail?id=18...
Old versions will get 'fixes' which simply patch the specific flaws found, but there will be always more to find in a complex legacy protocol like this.
Wouldn't it be simpler to drop in a CTF replacement unless the ability to read/write to any window, from any other session is generic to Windows.
The protocol in question is entirely internal. They could rip it out and replace it with something totally different, apps shouldn't notice.
The CTF server can also be made to validate its inputs much better, again, no compat impact.
This is another case where Google seems to just take delight in screwing Microsoft and its users here. The 90 day deadline is meant for vendors who don't take security seriously, but Microsoft do. I'm not sure what is gained by releasing this before it's fixed.
Microsoft dropped the ball for the first 75 days.
> I hope you agree that I adequately communicated this attack to you, it seems like some wires got crossed at Microsoft and it didn't get clearly passed along to the engineering team. We're at day 75 now, I think the solutions I can think of for this attack would require a lot of compat testing with IMEs, so I'm hoping you can expedite this now that we're all on the same page.[1]
[1] https://bugs.chromium.org/p/project-zero/issues/detail?id=18...
edit: For clarity, the context of my quote is talking specifically about the session attack, not all issues raised.
No, we don't know that. Companies that were deemed serious have been caught dragging and taking their time with no proof of progress whatsoever (just like in this case?). And think of the message it would send to other (supposedly non-serious) companies: "you've given more time to MS, why not me ? It's only fair".
Just like democracy, the P0 policy is the worst form of disclosure, except for all the others.
Also, please don't conflate this with EternalBlue, there's no remote component here.
You mean where the US government decided to not notify Microsoft for 5 years?
Or you mean where Microsoft decided to publicly announce the vulnerability despite not having provided patches for millions of unsupported systems?
These organization the "take security seriously sure make Project Zero look very responsible by comparison.
> for what?
To let people whose security has been compromised for over a decade do what they can to mitigate
The only fixes here come from MS. Until then, the more people that know, the worse it is.
If no third parties have access to it, this sounds promising for a fix. I suspect that third party keyboards and assistive devices probably talk this protocol though...
I think ForceASLR should improve process randomization across restarts? Not sure. Assuming it does that makes the repeated exploit attempts for one of the attacks harder.
They can start authenticating the API calls to prevent lying about what process/thread you are.
I think these are probably not crazy difficult things for MS to take on. There's a lot more to the attacks here, but seems like those are the places to start. Or just rip this system out and replace it idk.