Unix forever!

DSR enhanced security and "formal verification" course

This is the analysis of CVE-2024-30078:

A former bad design decision within Microsoft long ago with huge impact!

Only a few of us remember the discussions and decisions about software architecture in the late 80's early 90's at Microsoft which now, 30 years later, have huge impact on our german economy and foreign politics.

It is about ONE single Microsoft bug: CVE-2024-30078: You open your Microsoft notebook, you activate WiFi, your machine automatically searches for available hotspots and your machine then suddenly is owned by a hacker. How can that be?

That goes back to a dispute between the former chief designer of Windows NT David Cutler and Microsoft CEO Bill Gates about how a secure operating systems has to be designed. Here a 3h10m interview with him: https://youtube.com/watch?v=xi1Lq79mLeE&t=42m0s

The designers of Microprocessors here had the general strategy to divide all processes up into privileged and unprivileged. Privileged is the kernel with its process scheduler and rights system. To allow or deny fine grained access to further attached hardware in general and especially to the contents on the file systems carrying sensitive data.

The keywords to search for in Google and old Usenet archives here is:

https://www.google.com/search?q=ring+0+david+cutler+windows+nt

"Ring 0" is a term used in context with Intel processors to run privileged and thus not vulnerable "kernelspace" processes, while "ring 1-3" here stands for processes that typically are vulnerable, the so called "userspace". That means that everything a malicious process does, it can easily be reversed and that it does not affect the overall integrity of the operating system and the configuration of hardware itself.

Here I have two Google catches for you to remind you the former ideas and design decisions behind in detail:

https://lobste.rs/s/ewo3df/windows_nt_peeking_into_cradle

https://groups.google.com/g/comp.os.ms-windows.programmer.nt.kernel-mode/c/UxpwTwHYkuk

David Cutler did lead the software group around Windows NT. While Windows NT 3.0 and 3.5 had a well designed and secure architecture, there were economical (lack of speed and memory, hardware - especially fast SRAM memory - was ultra expensive back then) reasons to abandon that path of virtue.

Those former bad design decisions now have a huge impact on security of the whole Microsoft Windows and Azure infrastructure - recently renamed to Microsoft365. They're so deeply anchored in the billions of lines of code that they cannot be reversed.

What did they do wrong? Beginning with Windows NT 4.0 they weakened the strict barrier that once had existed in Windows NT 3.0 until 3.5 between low privileged userspace and high privileged kernelspace processes. The low privileged Windows graphical user interface with keyboard, mouse, digitizer, camera, scanner, printer, mobile syncing ... with its drivers on one side, and the higher "unbreakable" privileged processes on the other side. With well defined and well secured interfaces in-between.

And here the CVE-30078 security bug begins to play an important role. The (mouse klick) activation of Wifi certainly is a userspace thing but it also needs some cooperation with the Wifi hardware chip to inform the user, what hotspots are available and he can connect.

Unluckily, Microsoft did move both parts into kernelspace to lower the consumption of ressources and also for practical reasons: Things are much easier to program when you don't have any barriers between userspace and kernelspace processes. That was long time very welcomed by all the certified Microsoft programmers around the world writing application software and hardware drivers, making tons of money with it.

If Microsoft would correct that formerly taken bad design decision now, everything would immediately break apart.

Given the billions of lines of code that are making the Microsoft365 ecosystem, there os not a single software package that is not seriously affected with hundreds of hours having to be invested to correct or to adapt to that then "corrected and proper designed software architecture".

A meme illustrates the problem Microsoft is facing: https://xkcd.com/2347/

xkcd 2347

That bug certainly exists longer than Windows 10 exists. It goes back to that time where Windows NT 4.0 was published. And even if not the Chinese Kunlun Cyber Labs from Beijing would have published it, it is still a true nightmare for Microsoft: Because it allowes attackers to easily bypass firewalls by directing them to buildings from far away with so-called Wifi-Guns: https://youtube.com/results?search_query=Wifi+gun

Realistically we have to assume, that they're within all of our networks now, especially those of Wall Street, our banking systems and all of our military systems, such as Pentagon, NATO-OTAN HQ in Bruxelles, the military-industrial complex in special and even all US Centcoms around the world and even ships and Aircraft carriers on the seas. Any war would be automatically lost.

Microsoft is doomed! It's finished. Game over!

Back to last lesson - https://rentry.co/DSRsecuritycoursepart4 Next lesson: https://rentry.co/DSRsecuritycoursepart6

Edit
Pub: 27 Jun 2024 09:07 UTC
Edit: 24 Jul 2024 13:45 UTC
Views: 202