Hacker News Reader

Comment by Rygian | Hacker News Reader

> As a person who is novice to the driver exploitation scene, I was in a search for a driver which is very-easy to exploit. While on the search, I encountered Souhail Hammou’s really well written blogpost about how he exploited MalwareFox AntiMalware’s driver (zam64.sys) to escalate privileges.

Using an anti-malware piece of software as a stepping stone to get Ring0 is beyond irony.

I wish for a world where the general public were able to consider all software as malware by default, unless it has been proven "moreless safe" by at least three independent security audits paid with public money.

View on HN

> I wish for a world where the general public were able to consider all software as malware by default, unless it has been proven "moreless safe" by at least three independent security audits paid with public money.

Yes, what we need is more roadblocks in there, to ensure software that has captured large segments of their respective markets remain entrenched and make it harder for new developers and projects to dethrone them while giving the government (of which country?) control over what software people can run - no way this will be abused at all X-P.

The average user has to trust somebody, eh?

I can literally dope silicon and make my own chips, but even I have to trust "the system" to buy food and shelter, etc.

You can draw a line from the invention of the transistor to the eventual necessity of solving the ultimate human problem: how do we get along with each other?

> I can literally dope silicon and make my own chips

How so? The best usable homemade transistor project that I’m aware of, consisted of something on the order of 100 amplifiers/transistors on a chip. And even then, the author had access to professionally made silicon wafers, and likely a whole lot of expensive/dangerous chemicals and equipment. This is very far outside the realm of a casual hacker.

Making even the simplest 6502 equivalent by yourself is impossible, forget more complex projects. I feel like this should be urgently addressed, given how important computing is.

You got me. That was more of a rhetorical flourish than something I've actually done, or would do. "I haven't done this recently. Or in the past."

Sam Zeloof is doing great things: http://sam.zeloof.xyz/

> Making even the simplest 6502 equivalent by yourself is impossible, forget more complex projects. I feel like this should be urgently addressed, given how important computing is.

I've thought about this, more in the context of post-apocalyptic computing rather than trust, FWIW.

If I were really going to make my own computers from scratch I think clockwork (Clock of the Long Now) or fluidics would probably be the way to go. Maybe electro-mechanical (relays, etc.) or vacuum tubes? We did pretty well with the abacus and the slide rule, eh?

Sam Zeloof’s project is the exact one I had in mind when writing my comment. His work is extremely impressive, but it’s almost shameful that for over 40 years (collective) we as hobbyists have not had the ability to manufacture even something as simple as a 4004. May Sam’s work progress, and may we all build on his success.

> I've thought about this, more in the context of post-apocalyptic computing rather than trust, FWIW.

Post-apocalyptic computing is one possible motivation to look at this, but other reduced-tech settings like a fully independent Mars colony also simply cannot function without a way to fab simple IC logic. That, or we’re happy to go back to early Apollo era tech levels.

RE: computers from scratch in the absence of IC fabrication. I think our best chance is vacuum tubes. Mechanical relay computers seem to have been phased out in favour of vacuum tube solutions pretty quickly, so I guess there must have been some compelling reasons to do so (my guess - speed and failure rate of individual switching components). Couple that with old-school electromechanical tech for IO/industrial sequencing, several K of delay line/core/Williams Tube memory, and you’re golden.

Food for thought: That's how cars are put on the market nowadays. Not saying you're wrong, though.

It's also part of the story how we ended up with a duopoly of airplane manufacturers.

I think there's room for regulation and forced audits. The important part is that the compliance costs are small compared to development and production costs. That's true in the car industry unless you have really low volume, while airplanes are pushed over the threshold by much lower volume and much higher regulation.

On the other hand, not everything really needs to be a free market, there are tradeoffs. It might be worth having a airplane duopoly if it ensures airlines arnt trying to buy airplanes that are shoddy with a few corners cut risks be damned (of course, if the reality is that the duopoly gets to make shoddy airplanes anyway, this doesn't apply). Some things are just very, very safety critical in a way that's more important than maximal money saved

737 Max comes to mind, when talking about safety.

Boeing took engineering shortcuts of using software to make the plane appear to fly like older 737s to avoid a new type certification and the necessary retraining costs. I think FAA failed here by continuing to allow that to fly without a new type certification.

Cars are a bit different, considering they are physical objects that can easily kill people and you can't exactly manufacture a car in your room with a $50 computer - entry prices are a tiny bit higher there.

Meanwhile, i don't think i should have to ask permission from the government to make something like, e.g. a map editing tool for a 90s fps, like i did yesterday[0] (the tool, not requesting permission) or a sprite editor[1] or a quick-and-dirty wiki server to take notes in games[2]. Or really anything that doesn't have to do with areas where lives are at stake (which AFAIK is already being done anyway with programs needing to pass conformance tests - something i'm perfectly fine with, at least in theory, as i don't know in practice if these tests really work or are designed to help existing actors stay entrenched).

[0] http://runtimeterror.com/tools/chasmfe/

[1] http://runtimeterror.com/tools/mseditor/

[2] http://runtimeterror.com/tools/cppwiki/

What about megacorps writing operating systems for 99% of the device-owner population of the world?

And again, the original comment above is not "ask permission from the government" but instead "pass independent security audits by neutral auditors before exposing your software to the general public."

It was

> independent security audits paid with public money

The "with public money" part means they are funded and thus controlled by the government.

Not that i think a privately owned megacorp is much better, after all i do not like the scare boxes you see on unsigned (and "lesser signed") programs in Windows and macOS unless you pay the certificate mafia protection money - but at least those do not block you completely.

My opinionated "This Is The Way" stance, as a work in progress:

Daily fines proportional to installed user base, on the basis of confirmed and not yet fixed CVEs. Amount inversely proportional to price of per-user software license (ie. the cheaper the gadget, the heavier the fines). Exception for AGPL-compatible licenses.

Incentives and credits for smaller companies' training and audits. Funded by fines above.

Incentives and credits for companies fixing CVEs on AGPL-compatible software. Funded also by fines above. Amount of incentives proportional to installed user base and severity of CVE.

Audit practices defined by group of international bodies.

> Exception for AGPL-compatible licenses.

What have OpenBSD developers done to you? :-P

Judging from the score of my comment... they've downvoted me :-)

> Using an anti-malware piece of software as a stepping stone to get Ring0 is beyond irony.

If you think about it: not really. "Anti-malware" software often uses rootkit technologies to do "its job". In turn it gets handed the keys to the kingdom to do "everything".

It works quite well, a lot of "anti-malware" is invasive malware by design.

That is what OS sandboxes are for, but they tend not to be liked by HN crowd.

I think generally people are okay with the idea of sandboxes. It's issues around how sandboxes break existing workflows and make it difficult to customize to your needs, coupled with devs who are unresponsiven (or even hostile) to user needs. Flatpak felt like a nightmare until Flatseal. Now it's still a nightmare, but I don't cry myself to sleep after using it anymore.

Pledge and Unveil are proper sandboxing.

> I wish for a world where the general public were able to consider all software as malware by default

If I could wish a world into existence, I would choose one where all criminals disappeared in a puff of smoke, letting the rest of us enjoy a key-less password-less worry-free life.

You mean like an app store where an app has to pass a rigorous review process first?

I assume the MalwareFox driver already got through automated reviews to be signed by Microsoft?

> by at least three independent security audits paid with public money

Clearly not

This is a company so shitty that their website does not even have a privacy policy: https://www.malwarefox.com/privacy-policy/

The exploit suddenly looks much less impressive if it relies on the user having installed something like that.

Does it have to be installed though? Can’t you just load the driver, if it’s signed and not on the driver block list now on 22H2?

You have to be a local administrator to load a driver.

Even a "local admin to Ring0 without reboot"-exploit might have some uses in malware.

But that already exists. There are thousands of signed drivers; many around are bound to be exploitable. But it's not Windows' fault that you installed one.

The truth of the matter is that if you are local admin you can already ruin the system in many ways. Once you are admin the game is already over.

Imagine you're my clueless family relative and you end up installing one of those signed-yet-exploitable drivers.

Whose fault is it?

If I operate machinery or any kind of device that I'm clueless about and I screw up it definitely is my fault, yes.

The driver was chosen because there was an existing, easy-to-follow PoC exploit for the vulnerability, though. There are bound to be other drivers that are vulnerable and the VBA would change only where the vulnerability in the driver differed. Being able to do this from a document file is still plenty concerning.

Reply on news.ycombinator.com