News for hackers. Stuff that matters.

A comment on Microsoft finds privilege escalation vulnerability in Huawei driver. Parent comment

Re:Microsoft finds privilege escalation vulnerability in Hua... by codeinstyle on Wednesday April 03, 2019 @07:15PM (#19568036)
From Microsoft’s blog post:

Inspecting MateBookService.exe!main revealed a “startup mode” that revived the service if it’s stopped – some sort of watchdog mechanism meant to keep the Huawei PC Manager main service running.

I agree that it’s hard to prove malice, but why should any PC management software go out of their way to ensure that it never gets shut down?

[ Parent | on HN ]
Re:Microsoft finds privilege escalation vulnerability in Hua... by monocasa on Wednesday April 03, 2019 @07:18PM (#19568048)
...because it's the hardware management service and if it goes down you're no longer managing the hardware?

Like this stuff is usually designed by EEs and they love their watchdogs at all levels. Having a watchdog is very standard for this stuff.

[ Parent | on HN ]
Re:Microsoft finds privilege escalation vulnerability in Hua... by codeinstyle on Wednesday April 03, 2019 @07:59PM (#19568258)
>...because it’s the hardware management service and if it goes down you’re no longer managing the hardware?

I’m no expert on device drivers but to my knowledge, Windows already allows you to manage devices and install drivers through Device Managers.

Then if drivers are already installed for the various devices and hardware components, what exactly is the hardware management service managing on top of the individual drivers?

I am asking this as the only plausible reason to be doing this (at least for me) is if Windows isn’t providing enough tools for device management that needs coordination between the hardware components on the machine, so I would appreciate someone with more knowledge to shed some light on the subject.

[ Parent | on HN ]
Re:Microsoft finds privilege escalation vulnerability in Hua... by monocasa on Wednesday April 03, 2019 @08:13PM (#19568329)
Device Manager only handles kernel drivers. Best practice is to put as much as possible into a highly privileged, but still user mode process so it can crash without bluescreening your system. If you assume that this code can crash (hence why it was delegated to user mode in the first place) it makes sense to code in a resurrection capability.
[ Parent | on HN ]
Re:Microsoft finds privilege escalation vulnerability in Hua... by zaphirplane on Thursday April 04, 2019 @01:58AM (#19569681)
Windows services have a restart if I crash mode, why wouldn’t that be used instead. This seems about making sure the user can’t stop it from starting
[ Parent | on HN ]
Re:Microsoft finds privilege escalation vulnerability in Hua... by monocasa on Thursday April 04, 2019 @12:09PM (#19573976)
It's a huge pain on the ass to setup right. Soft faults where the process is still running but is deadlocked don't get restarted for instance.
[ Parent | on HN ]
Re:Microsoft finds privilege escalation vulnerability in Hua... by zaphirplane on Friday April 05, 2019 @05:34AM (#19580999)
Same problem if you write your own supervisor except you are writing a process supervisor
[ Parent | on HN ]
Re:Microsoft finds privilege escalation vulnerability in Hua... by monocasa on Sunday April 07, 2019 @12:36PM (#19597924)
Well, no, because you can write your supervisor in a way that does protect against that. In fact that's hat they're doing here.
[ Parent | on HN ]
Re:Microsoft finds privilege escalation vulnerability in Hua... by mehrdadn on Wednesday April 03, 2019 @07:34PM (#19568129)
Not commenting any way on the particular issue at hand, but to respond to your general question:

> why should any PC management software go out of their way to ensure that it never gets shut down?

The Windows 10 kernel itself goes out of its way to make sure the Windows update service isn't permanently shut down.

[ Parent | on HN ]