Full details on CVE-2015-0096 and the failed MS10-046 Stuxnet fix | Hacker News Reader

Full details on CVE-2015-0096 and the failed MS10-046 Stuxnet fix

h30499.www3.hp.com

82 pointsmikebo16 comments

Out of curiosity, does anyone understand why it was a good idea in the first place to have icons pointing to a DLL instead of having a static icon name or icon id?

Well, the reason for having it was for Control Panel items. In such cases, you'd want the icon in sync with the Control Panel item's. Windows, in general, likes to keep its icons in one place and then reference them from somewhere.

This reminds me of how "hacking a computer" is depicted in a movie or in tv-series.

"All we need to do is attach this usb stick and we can download all the files from their computer"

Well, almost, at least.

So Windows can run code simply by browsing to a directory with the default shell?

I have no words...

Windows has a bug which was likely a design decision made in Windows 95 development (maybe earlier, Windows 3.1 had CPL applets also). Security wasn't taken as seriously in that era.

While evidently their bug fix was a little hacky, I guess re-designing how Control Panel applet icons are rendered was considered too big of a change for what was essentially a security patch.

Hopefully they kill classic Control Panel completely at some stage in the next few years. Windows 8, 8.1, and now 10 are going down that road but there are a lot of legacy Control Panel applets by third parties which they have to deal with somehow.

Windows needed to kill the legacy control panel for a long time. They've put some new (worse)) front ends to it over time but once you click down to it there's some ancient non-resizable textarea to read something important in.

They should rebuild it in something powershell can poke so every single windows setting can be done from the command line, slap a gui on top of that and manage it all with DSC. Much like how all the new server orientated features have gone.

I agree on powershell. But I am less enthusiastic about their "metro" style which look extremely oversimplified from the samples I have seen (and all full screen, which replaces the frustration of the non-resizable grey boxes with another!).

UI aside I am referring to applications like the new server manager that are literally a front end to PS cmdlets.

Full screen only metro is gone as of W10 it seems. It's just a flatter art style and I think the metro stuff something else again, it's not some powershell driving layer.

It probably wasn't an intentional design decision. Storing icons in DLLs and referencing them is completely normal in Windows. I assume the error was that they somehow allowed the DLL to execute.

Look up CplApplet.

I think it dates all the way back to Win3.0.

I know, almost as scary as shellshock...

https://en.wikipedia.org/wiki/Exploit_%28computer_security%2...

I am assuming that the code being run is the DllMain which is normally called during LoadLibrary. The proper fix would have been to just map the DLL into memory without running DllMain, since that is not necessary to read the icons.

Its still so surprising to me that human error is still occurring in security. Surely, companies/organisations should provide training to stop them form being insecure.

I think the problem with something like Windows is that it is too big to be secure.

Reply on news.ycombinator.com