6 ms·

0patching a 0-day: Windows gdi32.dll memory disclosure

108 points by dielel 10y ago

deleted 10y ago
[deleted]
sst8 10y ago
Live patching is gaining the momentum - see Ksplice, Kpatch, kGraft, XEN and similar
- guipsp 10y ago
  This is not live patching.
  - j_s 10y ago
    A 0patch employee stopped by to explain that they live patch user mode only at this point on Windows, kernel mode is a future goal. https://news.ycombinator.com/item?id=13782830 https://news.ycombinator.com/item?id=13782830
- Dylan16807 10y ago
  Except with microsoft where they have stopped using their live patching code and just force reboots on the user.
  - Quppa 10y ago
    Indeed - hotpatching support was removed in Windows 8. Apparently it was only ever used in a few updates, and some unscrupulous folks took advantage of the capability: https://arstechnica.com/security/2016/04/hacking-group-platinum-used-windows-own-patching-system-against-it/ https://arstechnica.com/security/2016/04/hacking-group-plati...
johnsmith21006 10y ago
Why does Microsoft not find and instead Google? MS is not a startup and it is their code. Seems weird that Google has to fine their issues. What does this say about using Google software versus software from Microsoft? Or am I missing something obvious?
- devopsproject 10y ago
  You are expecting Microsoft to test a nearly infinite number of variables to find every flaw. This is not a reasonable position.
  - davidgerard 10y ago
    However, the question is "if Google can find this, why couldn't Microsoft?" Which is an entirely reasonable question. Your statement would also make it unreasonable for Google to be able to find this stuff, but we have existence proof that that's not the case.
    - deleted 10y ago
      [deleted]
    - trentmb 10y ago
      Maybe a better way to frame it is that Google happened to find it.
      - Navarr 10y ago
        The biggest threat to security by obscurity: Google happening to find things.
    - devopsproject 10y ago
      > However, the question is "if Google can find this, why couldn't Microsoft?" Which is an entirely reasonable question. His position is absurd. Microsoft could have found it. The thing stopping them is the incredible number of tests you would need to perform to find them all.
moontear 10y ago
An interesting effort - but the idea of a bug bounty program for 0patching won't work, at least not paid by the companies affected. Patching 0-day issues usually is not hard in itself. Usually it is just little errors like missing checks for buffer overflows, or some input not sanitized. What is hard is making sure that everything still works after the patch. And "everything" is quite a lot in the case of this issue (gdi32.dll). You have to make sure that all still supported software depending on gdi32.dll is still working as it should, that includes multiple Windows versions, multiple Office versions, multiple Internet Explorer versions, multiple ... you get the idea. Microsoft has a lot of products. Not saying that I don't admire this, but I don't know if any company would be willing to install "some patch" by "someone" with no guarantee that it won't break other things or open other holes. I would always want to install an official patch by an official vendor because I have support and warranty. If we're talking about some legacy software with no support and no vendor taking care of updates - this is something I could get behind and I think is useful.
- sst8 10y ago
  What about getting vendors into changing their patching habbits? Instead of packing some hundred mega patches just provide micro ones when needed? As you said 0day issues are usually (not allways) easy to fix. Probably you alone are skilled enough to check this couple of code instructions by yourself - which is not the case with full-blown patch Tuesday packages. I am pretty sure that process could be much cheaper for MS.
  - com2kid 10y ago
    > What about getting vendors into changing their patching habbits? Instead of packing some hundred mega patches just provide micro ones when needed? This was how things worked previously in the industry. There are a number of disadvantages to companies releasing multiple small patches throughout the month: 1. Users may have to reboot their computers multiple times a week. 2. Large corporations (with their own back-compat worries) do their own extensive validation of patches. Multiple small patches puts a large seriously burden on IT departments. The industry has moved towards larger update bundles for good reason.
pcwalton 10y ago
WMF/EMF has had an infamous history of security problems—most famously, RCE in 2005: https://en.wikipedia.org/wiki/Windows_Metafile_vulnerability https://en.wikipedia.org/wiki/Windows_Metafile_vulnerability
- koyote 10y ago
  It is truly an awful format. Surprisingly it is still the only supported vector format in Office...
  - fenwick67 10y ago
    Hmmm, apparently 2016 and 365 support SVG finally? https://support.office.com/en-us/article/Insert-SVG-images-in-Microsoft-Office-69f29d39-194a-4072-8c35-dbe5e7ea528c https://support.office.com/en-us/article/Insert-SVG-images-i... Only 17 years after the spec was established.
    - eon1 10y ago
      ..? I made a bunch of EPS for a coworker's Excel dashboard a while back, worked fine on 2013 and 2007.
    - koyote 10y ago
      Heh, thanks for pointing that out. Looks like it's a brand new feature only available since this year and only for Office 365 customers (for now, I hope), given that it's not supported on my Office 2016 build.

108 points by dielel 10y ago

deleted 10y ago

[deleted]

sst8 10y ago

Live patching is gaining the momentum - see Ksplice, Kpatch, kGraft, XEN and similar

guipsp 10y ago
This is not live patching.
- j_s 10y ago
  A 0patch employee stopped by to explain that they live patch user mode only at this point on Windows, kernel mode is a future goal. https://news.ycombinator.com/item?id=13782830 https://news.ycombinator.com/item?id=13782830
Dylan16807 10y ago
Except with microsoft where they have stopped using their live patching code and just force reboots on the user.
- Quppa 10y ago
  Indeed - hotpatching support was removed in Windows 8. Apparently it was only ever used in a few updates, and some unscrupulous folks took advantage of the capability: https://arstechnica.com/security/2016/04/hacking-group-platinum-used-windows-own-patching-system-against-it/ https://arstechnica.com/security/2016/04/hacking-group-plati...

johnsmith21006 10y ago

Why does Microsoft not find and instead Google? MS is not a startup and it is their code. Seems weird that Google has to fine their issues. What does this say about using Google software versus software from Microsoft? Or am I missing something obvious?

devopsproject 10y ago
You are expecting Microsoft to test a nearly infinite number of variables to find every flaw. This is not a reasonable position.
- davidgerard 10y ago
  However, the question is "if Google can find this, why couldn't Microsoft?" Which is an entirely reasonable question. Your statement would also make it unreasonable for Google to be able to find this stuff, but we have existence proof that that's not the case.
  - deleted 10y ago
    [deleted]
  - trentmb 10y ago
    Maybe a better way to frame it is that Google happened to find it.
    - Navarr 10y ago
      The biggest threat to security by obscurity: Google happening to find things.
  - devopsproject 10y ago
    > However, the question is "if Google can find this, why couldn't Microsoft?" Which is an entirely reasonable question. His position is absurd. Microsoft could have found it. The thing stopping them is the incredible number of tests you would need to perform to find them all.

moontear 10y ago

An interesting effort - but the idea of a bug bounty program for 0patching won't work, at least not paid by the companies affected. Patching 0-day issues usually is not hard in itself. Usually it is just little errors like missing checks for buffer overflows, or some input not sanitized. What is hard is making sure that everything still works after the patch. And "everything" is quite a lot in the case of this issue (gdi32.dll). You have to make sure that all still supported software depending on gdi32.dll is still working as it should, that includes multiple Windows versions, multiple Office versions, multiple Internet Explorer versions, multiple ... you get the idea. Microsoft has a lot of products. Not saying that I don't admire this, but I don't know if any company would be willing to install "some patch" by "someone" with no guarantee that it won't break other things or open other holes. I would always want to install an official patch by an official vendor because I have support and warranty. If we're talking about some legacy software with no support and no vendor taking care of updates - this is something I could get behind and I think is useful.

sst8 10y ago
What about getting vendors into changing their patching habbits? Instead of packing some hundred mega patches just provide micro ones when needed? As you said 0day issues are usually (not allways) easy to fix. Probably you alone are skilled enough to check this couple of code instructions by yourself - which is not the case with full-blown patch Tuesday packages. I am pretty sure that process could be much cheaper for MS.
- com2kid 10y ago
  > What about getting vendors into changing their patching habbits? Instead of packing some hundred mega patches just provide micro ones when needed? This was how things worked previously in the industry. There are a number of disadvantages to companies releasing multiple small patches throughout the month: 1. Users may have to reboot their computers multiple times a week. 2. Large corporations (with their own back-compat worries) do their own extensive validation of patches. Multiple small patches puts a large seriously burden on IT departments. The industry has moved towards larger update bundles for good reason.

pcwalton 10y ago

WMF/EMF has had an infamous history of security problems—most famously, RCE in 2005: https://en.wikipedia.org/wiki/Windows_Metafile_vulnerability https://en.wikipedia.org/wiki/Windows_Metafile_vulnerability

koyote 10y ago
It is truly an awful format. Surprisingly it is still the only supported vector format in Office...
- fenwick67 10y ago
  Hmmm, apparently 2016 and 365 support SVG finally? https://support.office.com/en-us/article/Insert-SVG-images-in-Microsoft-Office-69f29d39-194a-4072-8c35-dbe5e7ea528c https://support.office.com/en-us/article/Insert-SVG-images-i... Only 17 years after the spec was established.
  - eon1 10y ago
    ..? I made a bunch of EPS for a coworker's Excel dashboard a while back, worked fine on 2013 and 2007.
  - koyote 10y ago
    Heh, thanks for pointing that out. Looks like it's a brand new feature only available since this year and only for Office 365 customers (for now, I hope), given that it's not supported on my Office 2016 build.