Beta

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

MS Virtual PC Flaw Defeats Windows Defenses

kdawson posted more than 4 years ago | from the around-the-maginot-line dept.

Bug 141

Coop's Troops writes "An exploit writer at Core Security Technologies has discovered a serious vulnerability that exposes users of Microsoft's Virtual PC virtualization software to malicious hacker attacks. The vulnerability, which is unpatched, essentially allows an attacker to bypass several major security mitigations — DEP, SafeSEH and ASLR — to exploit the Windows operating system. As a result, some applications with bugs that are not exploitable when running in a not-virtualized operating system are rendered exploitable if running within a guest OS in Virtual PC."

cancel ×

141 comments

Sorry! There are no comments related to the filter you selected.

Which only goes to show, it's always something (2, Insightful)

koko (66015) | more than 4 years ago | (#31502748)

If you want security, unplug the 'net. You ain't gonna get it any other way.

Re:Which only goes to show, it's always something (4, Funny)

WrongSizeGlass (838941) | more than 4 years ago | (#31503016)

So Virtual PC is virtually as secure (or insecure) as a real PC? If you wanted the security of a real PC then they should have, um, well ... never mind.

Re:Which only goes to show, it's always something (-1, Flamebait)

Anonymous Coward | more than 4 years ago | (#31506012)

I wonder why Slashdot doesn't point out that all the Windows security features that have been 'defeated' have either no analogue in Linux/Mac OSX or a piss-poor imitation that doesn't actually secure anything.

Linux (-1, Offtopic)

dawilcox (1409483) | more than 4 years ago | (#31502754)

Every time I read an article like this, it gives me a smug face wondering why more people don't switch.

Mac OS X (-1, Troll)

Anonymous Coward | more than 4 years ago | (#31502874)

Yes. I've always wondered why more people don't switch to a better OS.

Re:Mac OS X (-1, Troll)

Anonymous Coward | more than 4 years ago | (#31503124)

Because some of us aren't men who have hot, hairy, mustachioed, sweaty, musky, anal, oral, scrotum-on-scrotum flapping, Elton John listening, gay bar dancing, San Francisco living, West Hollywood visiting, Hillcrest dining, lisping, cowboy-walking, nipple-piercing, Palm Springs vacationing, pride parade attending,

sex with other men.

Re:Mac OS X (0)

Anonymous Coward | more than 4 years ago | (#31503362)

Mod up this EPIC LULZ!

Re:Mac OS X (2, Funny)

PopeRatzo (965947) | more than 4 years ago | (#31503834)

sex with other men.

Not all of us can afford Macs.

Re:Linux (5, Insightful)

customizedmischief (692916) | more than 4 years ago | (#31502882)

Every time I read an article like this, it gives me a smug face wondering why more people don't switch.

Swtch to what, VMware or Parallels?

Re:Linux (5, Informative)

Hamsterdan (815291) | more than 4 years ago | (#31503122)

Virtualbox.

Re:Linux (1)

FragHARD (640825) | more than 4 years ago | (#31504478)

Ain't that the truth.......I like to get things done not try to get things done.

Disclaimer: This post made on OSX 10.5.8 running VirtualBox 3.1.2

Re:Linux (1)

rdnetto (955205) | more than 4 years ago | (#31505494)

Seriously, why is the parent modded funny? I switched to VirtualBox after MS bastardized Virtual PC for Win7, and haven't looked back. Admittedly, having all the media registered in a central database is annoying compared to the XML and path based approach of VirtualPC, but apart from that it's a solid product.

Re:Linux (1)

anss123 (985305) | more than 4 years ago | (#31505844)

VirtualBox is great, only drawback is that some of it's features (USB for instance) have had BSODy issues in the past. I also recommend using VT/AMDV mode all the time when running XP in a VM, VirtualBox hardlocks the host after about a month running XP without VT on my system.

The central database for media is a little annoying but only until you get the media you usually use in it and then you can pretty much forget about it. Have actually come in handy sometimes when I need to figure out on what disk and folder a CD image is stored.

Oh, and never run Virtual PC and VirtualBox at the same time unless you make sure only one of em uses the VT feature.

Re:Linux (-1, Troll)

Stormwatch (703920) | more than 4 years ago | (#31502900)

Maybe people are so used to a buggy, bloated, vulnerable operating system that they assume other systems will be just as awful.

Re:Linux (5, Insightful)

snowraver1 (1052510) | more than 4 years ago | (#31502924)

Answer: Because their apps run on windows. That's all there is to it.

Re:Linux (1)

Tanktalus (794810) | more than 4 years ago | (#31504426)

I know, I know. And yet, I'm not entirely convinced that it's better to have the apps you want/need while helping to send spam, and have your personal information sold to not just the highest bidder but to all bidders, running Windows, than it is to be secure on Linux, and be forced to make do with either no app, or simply a different app (not always worse) and have to learn something different.

It's a matter of priorities. Do I want to a) fight Windows security and have the apps I want, b) ignore security and have the apps I want, or c) have security, but have to learn some other app, or maybe do without that app.

Personally, I run XP inside VirtualBox on Linux, and only the apps I *must* run on Windows are in the virtual machine, everything else I do on Linux, even if it's not quite as polished as the Windows alternative, because when you combine the polish of the drivers with the security of the OS, I still think the Linux side comes out ahead. And I run git drivers for my ATI video card - not exactly the most stable way to go.

Re:Linux (2, Insightful)

Mr2001 (90979) | more than 4 years ago | (#31504724)

It's a matter of priorities. Do I want to a) fight Windows security and have the apps I want, b) ignore security and have the apps I want, or c) have security, but have to learn some other app, or maybe do without that app.

The whole point of having a computer is to run the programs you want to run. If you're going to have to "do without", you might as well unplug the damn thing (thereby achieving perfect security).

Re:Linux (1)

somersault (912633) | more than 4 years ago | (#31506094)

Could run his VM without a network interface. Unless he is using the VM for Outlook of course.

Re:Linux (0)

Anonymous Coward | more than 4 years ago | (#31504966)

And yet, I'm not entirely convinced that it's better to have the apps you want/need while helping to send spam, and have your personal information sold to not just the highest bidder but to all bidders, running Windows, than it is to be secure on Linux, and be forced to make do with either no app, or simply a different app (not always worse) and have to learn something different.

Personally, I run XP inside VirtualBox on Linux,

A pirated version no doubt.

because when you combine the polish of the drivers

What polish? Except for some piece of hardware that might be 15+ years old, most of the OSS drivers provide suboptimal features and performance compared to the proprietary or Windows equivalent drivers.

And I run git drivers for my ATI video card - not exactly the most stable way to go.

Which goes to show that you're trolling.

Re:Linux (0)

Anonymous Coward | more than 4 years ago | (#31505840)

Do I want to a) fight Windows security and have the apps I want, b) ignore security and have the apps I want, or c) have security, but have to learn some other app, or maybe do without that app.

I put forward an alternative use Windows because it has the apps you want and stop being such an asshat thus not worrying about security.

I've used Windows since the DOS/3.1 days when I didn't know much all the way up to Windows 7 now and I have never once been hacked, infected by a virus or had any banking information used fradulently. The most I've ever done is use an anti-virus/malware app (currently MS Security Essentials) and not stupidly clicked links in dodgy emails/websites. In my eyes that is not fighting Windows that's doing what I want when I want and getting along just fine.

Re:Linux (1, Redundant)

Lunix Nutcase (1092239) | more than 4 years ago | (#31502958)

Because Linux doesn't have the apps they want? They don't want to have to relearn years of knowledge built up using Windows? That it's not as simple to switch an entire OS and migrate all your programs and data as people like you would have people believe?

Re:Linux (0, Troll)

Mike Buddha (10734) | more than 4 years ago | (#31502994)

Ahh yes, come one, come all to Debian Island where all the computers are free and none of them work quite right.

Re:Linux (0)

Anonymous Coward | more than 4 years ago | (#31503412)

Wow, there sure are a lot of butthurt winfags in this thread.

When are you going to get tired of paying to be screwed?

Re:Linux (0)

Anonymous Coward | more than 4 years ago | (#31503914)

When are you going to get tired of paying to be screwed?

Apparently you haven't met my ex-wife, or you'd already know the answer to that.

Re:Linux (0)

Anonymous Coward | more than 4 years ago | (#31504566)

So you're still paying for earlier screwings years after the fact, eh?

Re:Linux (-1, Troll)

Anonymous Coward | more than 4 years ago | (#31503946)

I get my copy of Windows from MSDN through an account my company purchases. I don't pay anything and I get something better than a busted POS like Loonix.

Re:Linux (0)

Anonymous Coward | more than 4 years ago | (#31504344)

They're paying so that their shit actually works, as opposed to running broken copies of Windows.

Re:Linux (1)

icannotthinkofaname (1480543) | more than 4 years ago | (#31504582)

When are you going to get tired of paying to be screwed?

I don't think we can get an estimate on that. Given The Oldest Profession, and given that I'm fairly certain that prostitutes still exist in some parts of the world, I'd say we've been happy to pay to be screwed for a very long time, with no data ever suggesting that we'd grow tired of it.

Re:Linux (0)

Anonymous Coward | more than 4 years ago | (#31504170)

Ahh yes, come one, come all to Debian Island where all the computers are free and none of them work quite right.

At least the computers are free. That's more than you can say with Windows.

Re:Linux (-1, Flamebait)

Anonymous Coward | more than 4 years ago | (#31503228)

Well, if you are a linux user, didn't you already have a smug face?

Re:Linux (0)

Anonymous Coward | more than 4 years ago | (#31503278)

So apparently smug isn't isolated to just macfags and prius drivers.

Re:Linux (-1, Troll)

Anonymous Coward | more than 4 years ago | (#31503310)

Are you modding this guy troll because he's upset people insist on using this piece of sh* called Windholes?

Is that what /. has come to now?

Maybe malcontents should pack things and look for a Linux site to whine about M$, eh?

Re:Linux (-1, Troll)

Anonymous Coward | more than 4 years ago | (#31503406)

Because they don't want to use your busted POS OS? Because a bug that will effect far less than 1% of all Windows users isn't a cause to change OSes? Because you suck more dicks than a gay bathhouse full of Mac users?

Re:Linux (0, Flamebait)

smash (1351) | more than 4 years ago | (#31503494)

Because a large proporrtion of the userbase are smug, albeit clueless assholes?

Re:Linux (2, Insightful)

RMS Eats Toejam (1693864) | more than 4 years ago | (#31504800)

Slashdot: Where the truth is flammable.

Are VMware, Parallels, and VB also vulnerable? (1)

postbigbang (761081) | more than 4 years ago | (#31502762)

Makes one wonder if the disabling of these crack-thwarting mechanisms are also killed in other desktop hypervisors. Bad news.

Re:Are VMware, Parallels, and VB also vulnerable? (3, Interesting)

cbhacking (979169) | more than 4 years ago | (#31503170)

It's probably just a bug in the way VirtualPC handles the virtual TLBs or some such. It's not even present on Hyper-V, also from Microsoft, so I think the danger here is pretty low.

It's not like this actually makes the host OS vulnerable, either. I doubt it can even crash the VM software, although it could certainly lead to crashing the virtualized OS.

Re:Are VMware, Parallels, and VB also vulnerable? (2, Interesting)

postbigbang (761081) | more than 4 years ago | (#31503224)

That's what I'm wondering. Does randomized address still occur on VPC7's competitors? And if VPC is this way, then does Hyper-V thwart host address randomization, and so on? What's the difference in architecture that allows VPC to thwart this, and others go merrily on their way-- with whatever memory ring permitting the randomization of kernel access? Hmmmmm.

Re:Are VMware, Parallels, and VB also vulnerable? (1)

sjames (1099) | more than 4 years ago | (#31504872)

So as long as it's just the guests providing the critical services that get crashed or subverted, it's OK since the mere container for those guests is OK?

That doesn't make a lot of sense.

Re:Are VMware, Parallels, and VB also vulnerable? (-1, Flamebait)

icebike (68054) | more than 4 years ago | (#31503528)

Makes me wonder why a company with the name of "Core Security Technologies" has an exploit writer on staff.

Re:Are VMware, Parallels, and VB also vulnerable? (1)

palegray.net (1195047) | more than 4 years ago | (#31505480)

Are you aware that the majority of security vendors employ such personnel? The most effective means of finding vulnerabilities like these is, oh I don't know, to attempt to exploit systems. Reference Internet Security Systems [iss.net] (now owned by IBM), several key members of which I used to have coffee with once or twice a week.

Re:Are VMware, Parallels, and VB also vulnerable? (0)

Anonymous Coward | more than 4 years ago | (#31505012)

There was an undisclosed proof-of-concept a while back I saw which allowed code in a VM to be executed on the host. The demonstration video opened Windows Calculator on a Vista host from an XP VM, and claimed that it worked on Player, Workstation and Fusion.

This gets me every time (4, Insightful)

Ben4jammin (1233084) | more than 4 years ago | (#31502824)

Arce said Core reported the flaw to Microsoft last August... Microsoft officials declined to comment until they had a chance to review Core’s advisory on the issue

So how many months do you need to review once you are told about it???

Re:This gets me every time (4, Interesting)

ircmaxell (1117387) | more than 4 years ago | (#31502910)

So how many months do you need to review once you are told about it?

Simple. How many months will you give them before you go public?

At the possibility of being flamebait here, how the heck does MS keep publishing products full of security holes? I know Linux and Mac have had their share of holes, but it seems as if every week there's a new announcement about some MS product that has either a 0 day flaw, or another MAJOR flaw? And even worse is their failure to deal with them in a reasonable amount of time! I mean 6 months to COMMENT on an advisory? That's ridiculous... Sure, they may have a lot of notices to work through, but if that's the case, hire more developers to deal with the security issues! They are out spreading the message that you can depend on MS products, and then leave gaping holes open for months... Not to long ago (within the month), they delayed a patch --well, wanted to anyway before they were called out on it-- for a 0-day in IE by 3 weeks, so that they could put it in a "planned update to IE"... If this was a popular open source project trying to pull this stuff, how quickly would a fork surface? Then again, it's all about placating the sheeple, right?

Re:This gets me every time (2, Insightful)

Anonymous Coward | more than 4 years ago | (#31502986)

The moment they put out a patch that breaks anything, or makes things worse the uproar will be greater. Its also amazing how it will work find in say, the spanish version, but not on the chinese versions. So many things and so many different products.

Re:This gets me every time (1)

Nikker (749551) | more than 4 years ago | (#31503934)

I understand in programming there is always a possibility of a bug creeping up but common, Microsoft is one of the largest companies in the world, they have been working on the operating system for 20+ years now. They higher the worlds top PHD's to engineer the whole thing and pay them accordingly. Even the code monkeys are MIT grads with specialties in these core systems. When as a company you do one thing and get as much money as they do to do it there is an expectation of them and when you claim to be the best that expectation should be even greater. For so many similar problems to keep cropping up all directed at taking over your computer you have to admit this is becoming a bit ridiculous. It's just like the idea of the dam that springs a leak and each time you plug one another sprouts, but this has been happening since network connectivity began.

Re:This gets me every time (1)

MichaelSmith (789609) | more than 4 years ago | (#31504018)

I could make my wife's car theft proof by removing cables from the engine management system and bolting it to the garage floor but then she would never be able to drive it.

Re:This gets me every time (1)

Mister Whirly (964219) | more than 4 years ago | (#31503286)

Well, OS X has the luxury of knowing exactly what type of limited hardware set the system it will be running on is using, and not a lot of variety. Linux doesn't have to worry about breaking thousands of applications every time they update the core OS. Microsoft has neither of these luxuries. Microsoft is also king in the corporate desktop arena, and if a business application breaks, it will be far worse for them and the corporate application users compared to the way it currently is set up. And even with all of Microsoft's pre-testing on patches, smart admins always test them out in a non-production setting before green lighting them for the real thing.

Re:This gets me every time (2, Informative)

msuarezalvarez (667058) | more than 4 years ago | (#31503410)

I've upgraded "linux" (OS, libs, and what not) literally thousand of times in the ca. 15 years I've been using it, and I doubt there were 5 times where I has a real problem with the many apps I use stopping working...

Re:This gets me every time (1)

Rockoon (1252108) | more than 4 years ago | (#31503480)

So there were times when you upgraded Linux and software broke?

Thats his point. When Microsoft breaks things to fix something else, people are in in arms.

Re:This gets me every time (1)

ircmaxell (1117387) | more than 4 years ago | (#31504124)

In the past 5 years of managing both production linux boxes and Windows boxes, I can honestly say I've seen more Windows updates break things than Linux updates break things. Typically, it's due to some rogue program that was either misusing an API, or relied on string results returned from a particular API call (rather than using the proper API, or a constant)... Who do I blame for that? I don't blame MS. I blame the offending software vendor. It's typical practice (that I follow) to wait on all non-critical security patches for potentially a few months to see if there were any issues reported from it. After that point, a quick test in staging, and it's rolled out. Personally, I'd rather they break things from time to time than have my network compromised because they decided to take their sweet ass time creating a fix for it... Something breaks == me either rolling back the change, or spending a day or two trying to fix it. A compromise == a lot more of a headache (First there's detecting the intrusion, rolling backups, investigation, mitigation, etc etc etc)... So I'd MUCH rather them get me a SECURITY fix sooner than later...

Re:This gets me every time (1)

pinkushun (1467193) | more than 4 years ago | (#31505908)

True that. Renting an OS (yes you don't buy the OS from MS), you hold the owners accountable for bad shit happening. Open source plays less point-the-finger and more help-another.

Re:This gets me every time (5, Insightful)

obarthelemy (160321) | more than 4 years ago | (#31503462)

Let's play devil's advocate:

MS has quite a lot of competing agendas:
- keep backwards compatibility, v1. That means a bunch a old APIs, services, apps... Not only was security not much of a concern back when those were written, but any change in the environment risks unveiling new vulns. These pooor guys are actually supposed to maintain IE 6, IE7, and IE 8.
- keep backwards compatibility, v2. MS can't really change the security model or the way they expose it without, again, breaking apps. Since NT, Windows's security model is not bad. But MS can't really implement it fully (no apps changing system-wide ressources, no writing outside of a handful of approved dirs...) without, again, breaking apps.
- add features
- maintain an incredibly wide array of software. MS = Oracle + Linux+ php + Apache + OOo + Firefox + ...

So yes, I really hate the pain that managing MS systems is. I, and they, know they could make things better by breaking a lot of apps. They choose not to... prolly because their customers want them not to. I can understand that.

Re:This gets me every time (2, Interesting)

peragrin (659227) | more than 4 years ago | (#31503714)

then with windows vista why didn't MSFT include an XP mode, than ran in it's own self contained section while using the higher security of a modern OS?

MSFT is trying to maintain compatibly with single user OS's in a networked world and failing miserably. Apple simply included a backwards compatibility mode and with every release slowly stopped installing.

Re:This gets me every time (1)

Josh04 (1596071) | more than 4 years ago | (#31504690)

Actually, they're doing remarkably well on the compatibility one.

Re:This gets me every time (2, Insightful)

Mr2001 (90979) | more than 4 years ago | (#31504750)

then with windows vista why didn't MSFT include an XP mode, than ran in it's own self contained section while using the higher security of a modern OS?

Windows 7 Professional/Ultimate includes exactly that. But it's implemented using Virtual PC, which is where this flaw was discovered.

Priorities, priorities - oh, wait! Policy: (4, Informative)

symbolset (646467) | more than 4 years ago | (#31503892)

Re:Priorities, priorities - oh, wait! Policy: (1)

TRRosen (720617) | more than 4 years ago | (#31504774)

He said they NEEDED to... not that they WOULD.

Re:This gets me every time (2, Insightful)

ircmaxell (1117387) | more than 4 years ago | (#31504268)

Don't forget, you're talking about a monolith of a company. They have more than enough resources to pour into security. Yet they don't... I refuse to cut them any slack, when open source projects which are powered by volunteers (I know not all are, but a significant number are) can produce (and do produce) results SIGNIFICANTLY faster than MS typically does... If a bunch of volunteers with VERY limited resources can do it, why can't a company with practically unlimited resources handle it?

Re:This gets me every time (1)

Anpheus (908711) | more than 4 years ago | (#31504606)

Mythical man month much?

Pouring more resources into security doesn't make it happen. Sorry.

Re:This gets me every time (2, Informative)

ircmaxell (1117387) | more than 4 years ago | (#31504694)

Pouring resources into one particular project doesn't work. But pouring resources into a pile of otherwise unrelated projects does. IF it's a problem of overload (where they have 1000 outstanding issues to investigate/fix, and less than 1000 people to work on it, you could gain something by adding resources... The "Mythical Man Month" is about adding resources to one project (where everyone's work depends on everyone else's)...

Re:This gets me every time (1)

Anpheus (908711) | more than 4 years ago | (#31505564)

It's not about fixing 1000 issues, if you tackle security like that, you'll be fixing 1000 issues every month until the end of time. And your problem will grow as your company and the amount of code you write grows. So theoretically you could eventually break even, but the worst security issues will be the ones you don't know about, the ones you can't measure in your tickets closed per month metric. So what if you closed 1000 bug tickets in a month? Anyone can do that, how about you go an entire month without a single bug ticket?

That's where we come to a mythical man month problem. There's only so much money and people you can throw at security before you come up against the fundamental problem that security is a group effort, and is defined by a process that leads to fewer vulnerabilities, fewer bugs overall.

I don't mean to be an apologist for Microsoft, they've been atrocious on the past and perhaps they are merely mediocre now. But the fact remains that you can't simply throw money at fixing vulnerabilities and have them go away. It doesn't matter how good your "vulnerability-checkers" are if they can't keep up with the hundred times larger number of coders you have writing bad code on a daily basis.

tl;dr: you don't want people who can close bug tickets, you want to hire very smart, very disciplined people and empower them to create a process whereby bug tickets and vulnerability cases are never opened. This is ultimately a more difficult problem than simply throwing time and money at fixing bugs. Doubling your investment will not halve your vulnerabilities.

Re:This gets me every time (0, Troll)

drsmithy (35869) | more than 4 years ago | (#31504980)

They have more than enough resources to pour into security. Yet they don't... I refuse to cut them any slack, when open source projects which are powered by volunteers (I know not all are, but a significant number are) can produce (and do produce) results SIGNIFICANTLY faster than MS typically does... If a bunch of volunteers with VERY limited resources can do it, why can't a company with practically unlimited resources handle it?

It's pretty easy to patch software quickly when your testing and QA process barely extends past "does it compile".

3 months before full disclosure (0)

Anonymous Coward | more than 4 years ago | (#31503962)

So how many months do you need to review once you are told about it?

Simple. How many months will you give them before you go public?

Three months (one quarter). Give them the benefit of the doubt for fixing things.

I'm all for full disclosure, but at least give people a fighting chance to patch their systems.

for a 0-day in IE by 3 weeks, so that they could put it in a "planned update to IE"

Which allows for large companies that depend on IE to do regression testing on one patch (or patch release cycle), instead of two or more.

If this was a popular open source project trying to pull this stuff, how quickly would a fork surface? Then again, it's all about placating the sheeple, right?

A popular open source project I think would also like a little breathing room to test things to make sure they got the fix right and that their code changes didn't break anything else.

Developers--who also work inside Microsoft--are people too, and making them sweat doesn't help anyone. Just because the suits are asshats doesn't mean you have to act like one too.

Re:3 months before full disclosure (1)

ircmaxell (1117387) | more than 4 years ago | (#31504214)

I'm all for full disclosure, but at least give people a fighting chance to patch their systems.

I agree 110%. But I also want a patch in a reasonable amount of time (and that time is dependent on the risk). If it's a true 0-Day, I want the fix today. Not 3 months from now. I want it today (I know I won't get it today, but that doesn't mean it shouldn't be an ASAP thing)...

Which allows for large companies that depend on IE to do regression testing on one patch (or patch release cycle), instead of two or more.

I fully understand that. However, we're talking about a 0-Day fix here. And not a academic example, one that was in the real world rapidly causing breaches in major corporations. In that particular case, I'd much rather 2 updates than one. Heck, you could even tell users that another non-security update is coming in a few weeks and let them decide. But don't punish those of us who care about the security of our networks for those that are too lazy to do things multiple times...

A popular open source project I think would also like a little breathing room to test things to make sure they got the fix right and that their code changes didn't break anything else.

I would give a LITTLE breathing room, but taking potentially years to issue major security fixes is completely inexcusable. And if a project made a habit of taking that long to deliver patches, I would bet a significant amount of $$$ that the community would not tolerate that (I have seen projects fail for exactly that reason)...

Developers--who also work inside Microsoft--are people too, and making them sweat doesn't help anyone. Just because the suits are asshats doesn't mean you have to act like one too.

I do understand they are people. I am more attacking the corporate culture and policy that I am the developers. If they really don't have the ability to produce the results, then either they should find a new job, or MS needs to hire more or better developers. If it's that they are just to busy, then that's on management. 99.5% of the blame IMHO falls onto the shoulders of management (all levels). Something needs to change (because the system they are using now isn't working IMHO), and it doesn't look like anything is changing (perception is reality)... So it's someone's fault...

Re:This gets me every time (1)

anss123 (985305) | more than 4 years ago | (#31505986)

At the possibility of being flamebait here, how the heck does MS keep publishing products full of security holes?

Because many security flaws are in old software - which they aren't "pushing" any more. Today's flaw is a exception but requires a user that use XP mode in such a way that an attacker can get at it (say - if you're running an old insecure version of Firefox in XP mode) which, you have to be honest here, is not all that likely since XP mode will be more used for old games and business apps.

As for the the "0day flaw" you mentioned, if it was an Open Source project you'd likely been asked to update to IE8 instead of whining about them pushing insecure software

Ugh, this isn't good. (4, Informative)

mlts (1038732) | more than 4 years ago | (#31502884)

The good news is that this doesn't affect the big iron (Hyper-V). However, for people who have Windows 7 and XP mode, using it for Web browsing, this will cause them a world of hurt.

Since this essentially doesn't affect servers, I'm going to recommend to people that they move to VMWare Workstation if they want commercial support, or VirtualBox if they desire an open source solution. Either one of these has as many features as VirtualPC (although VirtualPC has one nice advantage -- it drops changes to the undo disk fast compared to the 2-3 minutes VMWare does.)

A hole in a hypervisor is a really bad thing. A lot of people use VMs for honeypots, and this would cause unintended infections, or other damage, perhaps catastrophic.

Re:Ugh, this isn't good. (2, Funny)

WrongSizeGlass (838941) | more than 4 years ago | (#31503068)

Dude, like, stop being so reasonable - you're gonna park a cloud over our MS bashing and 'I told you so' evangelism. It's not everyday we get to trash MS over a security issue.

Re:Ugh, this isn't good. (0)

Anonymous Coward | more than 4 years ago | (#31503338)

Yeah, its every OTHER day we get to trash them for a security issue!

Re:Ugh, this isn't good. (1)

RulerOf (975607) | more than 4 years ago | (#31504028)

Yes, we're usually too busy trashing yesterday's security issue that today's tends to *whoosh* right over our heads.

Re:Ugh, this isn't good. (4, Informative)

Anonymous Coward | more than 4 years ago | (#31503088)

The hole is not in the hypervisor. The GUEST OS is the one that is compromised, not the OS running the VM.

Re:Ugh, this isn't good. (1)

julesh (229690) | more than 4 years ago | (#31505856)

The hole is not in the hypervisor. The GUEST OS is the one that is compromised, not the OS running the VM.

The hole is in the hypervisor; if the hypervisor worked correctly, the guest OS would behave identically whether or not it was running as a guest.

But, yes, it would appear that this flaw does not provide a way guest code can escape the virtual environment. Essentially: local privelege escalation bug restricted to virtual machine guests.

Re:Ugh, this isn't good. (5, Informative)

cbhacking (979169) | more than 4 years ago | (#31503138)

Honeypots are designed to get hit. This bug doesn't make the host system vulnerable, it just means that the client OS is easier to exploit.

If it worked on Hyper-V, this would be a big problem; that's a server-level technology where even the clients are expected to remain secure. On the other hand, Virtual PC isn't even a hypervisor; it requires a full OS onderneath it, running itself as just another Windows app. Up until 2007 didn't even require hardware support for virtualization.

Re:Ugh, this isn't good. (1)

The MAZZTer (911996) | more than 4 years ago | (#31503350)

2007 doesn't require hardware virtualization either, only the Windows 7-only version does.

Re:Ugh, this isn't good. (1)

RulerOf (975607) | more than 4 years ago | (#31504076)

2007 doesn't require hardware virtualization either, only the Windows 7-only version does.

There was a bit of upset about that point when XP mode got reviewed. Since it's based on VPC and not Hyper-V, it shouldn't require x64 and AMD-V or Intel-VT, but for some reason, it does. A lot of people considered that to be all sorts of bullshit because Intel uses their VT feature to differentiate product lines; I.E., moderately priced business desktops don't support XP mode. Of course, that bullshit is actually Intel's fault, so I tend to cast a more glaring eye at them when I think about it.

Re:Ugh, this isn't good. (3, Insightful)

Mr2001 (90979) | more than 4 years ago | (#31504790)

A lot of people considered that to be all sorts of bullshit because Intel uses their VT feature to differentiate product lines; I.E., moderately priced business desktops don't support XP mode.

Moral: if you're looking for something modestly priced, go with AMD processors. Not only are they cheaper, but nearly all the ones you can find today support virtualization.

Re:Ugh, this isn't good. (1)

KillShill (877105) | more than 4 years ago | (#31505234)

And you can feel good about not supporting a monopolist.

Re:Ugh, this isn't good. (3, Interesting)

cbhacking (979169) | more than 4 years ago | (#31505036)

I actually had a chance to talk with one of the guys behind Wirtual PC (including the one that powers Virtual XP Mode) a few months back. His answer was that when MS started work on the Windows Virtual PC (WVPC, the current version) 3 years ago (roughly when VPC2k7 shipped), they contacted Intel and AMD and asked if they were going to offer hardware virtualization on all models going forward. Both companies answered Yes, so to save development and testing costs, the (large block of tricky) code that enabled vitrualization on CPUs without hardware support was cut from WVPC. Skip forward a couple years to WVPC getting ready for release, and... still a lot of Intel CPUs without support for virtualization. At that point it was too late to add the feature without delaying shipping, so they didn't.

I asked whether they would add it in later, and he said they weren't planning to but might change their mainds if it became clear that this was a problem for enough of their customers. In the meantime, they were telling Intel to get its shit together the way it had said it would three years earlier, and he personally recommended going with AMD chips.

On a side note, I didn't hear anything at all about it requiring x64. According to http://www.microsoft.com/windows/virtual-pc/download.aspx [microsoft.com] , it works just fine on x86.

Re:Ugh, this isn't good. (1)

PingPongBoy (303994) | more than 4 years ago | (#31503360)

On the other hand, Virtual PC isn't even a hypervisor; it requires a full OS onderneath it, running itself as just another Windows app

So ... install Virtual PC in a Virtual PC virtual machine.

I haven't tried, as it is slow enough

Re:Ugh, this isn't good. (4, Insightful)

X0563511 (793323) | more than 4 years ago | (#31503918)

If someone is using VirtualPC for a honeypot, they are an idiot.

The idea of a honeypot is that it is indistinguishable from "the real thing."

That this flaw even exists means it is identifiable as a virtual machine.

Re:Ugh, this isn't good. (0)

Anonymous Coward | more than 4 years ago | (#31505666)

or just a machine w/ DEP off ....

Re:Ugh, this isn't good. (1)

NSIM (953498) | more than 4 years ago | (#31504194)

And what makes you think that other desktop hypervisors don't have similar vulnerabilities?

Re:Ugh, this isn't good. (1)

John Hasler (414242) | more than 4 years ago | (#31504664)

> VMWare Workstation if they want commercial support, or VirtualBox if they
> desire an open source solution.

You know very well that commercial support is available for Open Source.

Re:Ugh, this isn't good. (1)

PFAK (524350) | more than 4 years ago | (#31504896)

It's a good thing this vulnerability doesn't allow the host system to be compromised, otherwise we'd be in real trouble!

(AKA: Parent poster is wrong.)

Still can't exploit the host OS (5, Informative)

cbhacking (979169) | more than 4 years ago | (#31503090)

This is definitley a bug, but all it does is allow bypassing of security features in the virtualized system. In other words, you can exploit the VM client, but you still can't get at the host.

It's worth of a patch, but not of a panic. If you're virtualizing for security, you don't really care what happens to the virtual system (that's the point). If you're virtualizing so you can run an old OS, it's going to be full of holes anyhow. If you're virtualizing for any other reason, why the hell are you using consumer-grade virtualization software?

Re:Still can't exploit the host OS (1)

ub3r n3u7r4l1st (1388939) | more than 4 years ago | (#31503588)

Most people don't utilize the function of an "undo disk" in VPC, which allows you to restore a VM to a previous state when you turn off the VM.

So the infection will stay there, if somebody use it as a spam or phishing server, the FBI will be knocking on your door.

Re:Still can't exploit the host OS (1)

pinkushun (1467193) | more than 4 years ago | (#31505988)

Out of interest, I develop on two XP SP3 VPC's, against older systems that do not support XP+. It's a bit worrying, doing production work in these environments.

Credits (5, Informative)

aurelianito (684162) | more than 4 years ago | (#31503182)

From TFA:

An exploit writer at Core Security Technologies has discovered a serious vulnerability that exposes users of Microsoft's Virtual PC virtualization software to malicious hacker attacks.

I would like to add that the exploit writer at Core Security Technologies that discovered this vulnerability is Nicolás Economou [coresecurity.com] and congratulate him on the great work he has made.

Disclaimer: I also work at Core

Re:Credits (1)

pinkushun (1467193) | more than 4 years ago | (#31505846)

Thanks for the good work Nicolás :)

How many people even use VirtualPC/XP mode anyway? (5, Insightful)

jim_v2000 (818799) | more than 4 years ago | (#31503322)

I mean, talk about small targets. I highly doubt that any hacker would find it worth his time to attempt to exploit this. I mean, first you have to find someone running XP mode. Then you have to get them to open an executable (or exploit some other vulnerability to get onto the system) on the guest OS instead of the host OS. Then the person still has to have more than 2 gigs of RAM and be utilizing more than 2 gigs at once. Then, after all that, you only have access to the XP VM, which may or may not have anything of worth on it.

I'm not surprised that MS shrugged it off for now.

Re:How many people even use VirtualPC/XP mode anyw (3, Interesting)

Anonymous Coward | more than 4 years ago | (#31503884)

I mean, talk about small targets. I highly doubt that any hacker would find it worth his time to attempt to exploit this. I mean, first you have to find someone running XP mode. Then you have to get them to open an executable (or exploit some other vulnerability to get onto the system) on the guest OS instead of the host OS. Then the person still has to have more than 2 gigs of RAM and be utilizing more than 2 gigs at once. Then, after all that, you only have access to the XP VM, which may or may not have anything of worth on it.

I'm not surprised that MS shrugged it off for now.

Sorry, nice try, but you don't seem to understand the issue here. You don't need to "get them to open an executable" - the point is that this vulnerability makes it possible to exploit existing vulnerabilities by bypassing mitigation techniques such as SafeSEH, DEP, and ASLR. It also has nothing to do with the amount of physical RAM on the system or how much is being used - the mentions of memory accesses refer to a process's virtual address space.

I agree that this doesn't have nearly the same impact as if it affected Hyper-V or other business-critical virtualization platforms, but if you're going to downplay its significance, at least know what you're talking about. ;)

Re:How many people even use VirtualPC/XP mode anyw (2, Informative)

jim_v2000 (818799) | more than 4 years ago | (#31505744)

RTFA and re-read what I said:

Article: "It causes memory pages mapped above the 2GB level to be accessed with read or read/write privileges by user-space programs running in a Guest operating system."

Me: "Then you have to get them to open an executable (or exploit some other vulnerability to get onto the system)"

Re:How many people even use VirtualPC/XP mode anyw (1)

Antique Geekmeister (740220) | more than 4 years ago | (#31504434)

The target isn't that small. The fact that being virtualized breaks their security models is a big issue, and indicative of other big issues. (Using virtualization to break copy protection is one of my personal favorites.) And there are plenty of home and business users who have gotten Windows Vista machines foisted onto them who use and need to use Windows XP for software compatibility reasons, and who therefore run old games or critical applications in Windows XP under Virtual PC. I've done it myself for debugging purposes, when I've had spare licenses but not spare desktop systems.

No kidding (3, Interesting)

Sycraft-fu (314770) | more than 4 years ago | (#31504948)

To the extent we use it at work, it is for running stubborn old software that won't run in Windows 7 and/or 64-bit OSes. To date, we've discovered two applications like that. We also set them up to run seamless in the host OS (their window appears along any other window) where you don't see or play with the guest VM. It's easier for the user, and less potential trouble. They generally don't even know (or care) that the program is running in a VM.

So yes, it requires some fairly edge situations to exploit. Not many people use XP mode in the first place (most apps run natively in 7), if they do, reasonable bet they are just using it for compatibility for one or two old apps, not on a regular basis. So you have to convince them to get your exploit, and run it in their XP system. While I suppose you could craft it so that it doesn't run in 7, they may just say "Eh, do not want," and ignore it. If not they might wonder why a new app would have that problem. Either way you've got to get them to use it in XP mode and then... Well I guess you can own their XP VM. Wonderful, that does you a whole lot of nothing in general.

Also this isn't a case of "Bypasses any and all security," it just gets by some additional protections that can help in some cases. DEP, for example, doesn't do anything to stop malware, it doesn't check the "evil bit" and stop programs from running. All it does is prevent buffer overflows in some cases. You can't execute code in the data area of a program's memory. Ok, fine, however to even matter at all you have to have a program that is vulnerable to that kind of thing. If programs are checking their inputs and so on, then DEP never even comes in to play.

Don't get me wrong, I'm happy that MS has added some additional protections to make common problems harder to exploit, however they are not the first, last, and only line of defense. They are just things that cause additional problems for various sorts of exploits. Something has to find a way to try and get in to the system in the first place before they even matter.

I can't see this as any kind of big deal. I'm certainly not at all concerned with regards to the computers that use it at work.

Mooslims are a plague on society (-1, Offtopic)

Anonymous Coward | more than 4 years ago | (#31503506)

Allah is a lie. Mohammad was an opportunist.

Whats new... (1)

joocemann (1273720) | more than 4 years ago | (#31503814)

Its like they do this on purpose...

"security mitigations"? (1)

John Hasler (414242) | more than 4 years ago | (#31504654)

Aren't those called "exploits"?

Re:"security mitigations"? (2, Informative)

julesh (229690) | more than 4 years ago | (#31505900)

Aren't those called "exploits"?

No, you're misunderstanding the article. A "security mitigation" is something that stops exploits working without actually removing the hole that allows the exploit. Stuff like checking your stack is still intact before returning from a function in order to make stack overflow exploits fail: the stack can still be overflowed, but you can't (easily) exploit this any more.

Not a vulnerability (3, Informative)

poppycock (231161) | more than 4 years ago | (#31505392)

This is really a vulnerability in any meaningful sense of the word. Rather, this means that certain advanced protections that Windows uses are less effective in a Virtual PC. Microsoft is actually in a leading postion when it comes to memory protection features as compared to anyone this side of OpenBSD.

What isn't someone issuing an "advisory" that the MacOS implementation of things like GS, ALSR, early-heap-termination and SafeSEH are either weak or nonexistent?

ASLR could use more entropy. Stack coookies could be present in every function, instead of just some. Every defense can be improved, and I don't think Microsoft has ever claimed that ASLR or GS is a reason NOT to produce a patch.

IMHO, Microsoft is completely correct to not issue a bulletin for this since that is an indication of a severe issue. And Core is free to make the issue known publically as well, and people can decide for themselves. But the Slashdot title is midleading at best.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?
or Connect with...

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>