SoylentNews is people
SoylentNews
https://www.theregister.co.uk/2018/04/04/microsoft_windows_defender_rar_bug/
A remote-code execution vulnerability in Windows Defender – a flaw that can be exploited by malicious .rar files to run malware on PCs – has been traced back to an open-source archiving tool Microsoft adopted for its own use.
[...] Apparently, Microsoft forked that version of unrar and incorporated the component into its operating system's antivirus engine. That forked code was then modified so that all signed integer variables were converted to unsigned variables, causing knock-on problems with mathematical comparisons. This in turn left the software vulnerable to memory corruption errors, which can crash the antivirus package or allow malicious code to potentially execute.
(Score: 5, Informative) by Anonymous Coward on Monday April 09 2018, @06:32PM (25 children)
The TechRights staff had some comments in their quasi-daily news digest April 5 [techrights.org]
-- OriginalOwner_ [soylentnews.org]
(Score: 2) by turgid on Monday April 09 2018, @07:54PM (18 children)
I suppose you have to add value somehow. I mean, that "free love" long-haired hippy stuff is great and all but serious corporations with shareholders and PHBs and everything need a reason to keep selling new versions and fixes.
I refuse to engage in a battle of wits with an unarmed opponent [wikipedia.org].
(Score: 4, Insightful) by DannyB on Monday April 09 2018, @08:18PM (8 children)
Serious corporations can add value. They can satisfy shareholders, PHBs, and keep selling new versions and fixes -- along with services.
And they don't have to badmouth FOSS or create FUD to do so.
Red Hat is one example.
There are also plenty of big companies that incorporate FOSS code into their products. If they manage to create a security hole in the process . . .
. . . then they don't have to blame FOSS for being insecure, nor do they need to create FUD.
A serious corporation that wants to have credibility can simply say they forked up.
solar power is really hot right now
The lower I set my standards the more accomplishments I have.
(Score: 2) by turgid on Monday April 09 2018, @08:34PM (2 children)
This is Micro-"Linux is an Unamerican cancer"-Soft we're talking about here.
I refuse to engage in a battle of wits with an unarmed opponent [wikipedia.org].
(Score: 4, Informative) by DannyB on Monday April 09 2018, @08:53PM (1 child)
It was Ballmer (developers, Developers, DEVELOPERS!!!, I Love This Monopoly!!!) who said that Linux was a Cancer.
It was Jim Allchin (who was #4 at Microsoft, at that time, long before Vista) who said effectively that Open Source is un-American and we need to educate the legislators to the danger.
The lower I set my standards the more accomplishments I have.
(Score: 4, Informative) by boltronics on Tuesday April 10 2018, @11:13AM
The Halloween Documents exposed Microsoft's FUD tactics back in '98. That's long before XP. Long before Windows ME. That's even before Windows 98 SE was a thing.
http://catb.org/esr/halloween/ [catb.org]
https://en.wikipedia.org/wiki/Halloween_documents [wikipedia.org]
It's GNU/Linux dammit!
(Score: 2) by Bot on Monday April 09 2018, @10:19PM (4 children)
> Red Hat is one example.
Red Hat engineers, adding value after value, PC fans at full speed
too much matter always collapses on itself
welcome, systemd
Account abandoned.
(Score: 4, Touché) by All Your Lawn Are Belong To Us on Monday April 09 2018, @10:39PM (2 children)
Your words not strict form
Overflow memory blow
You let bad code in
This sig for rent.
(Score: 2) by Bot on Tuesday April 10 2018, @12:06PM (1 child)
You are just jealous:
unlike your haiku, mine brings
tears to the eye
Account abandoned.
(Score: 3, Informative) by All Your Lawn Are Belong To Us on Wednesday April 11 2018, @05:59PM
My head, shamed, contrite.
Even bad smelling roses
don't promote systemd
This sig for rent.
(Score: 3, Informative) by DannyB on Tuesday April 10 2018, @01:09PM
Only when the matter is made of four fundamental particles.
Electrons
Protons
Neutrons
Croutons
The lower I set my standards the more accomplishments I have.
(Score: 2, Insightful) by Anonymous Coward on Monday April 09 2018, @08:26PM (8 children)
Anyone who's been paying attention is aware of the number of times that anti-virus apps have been exploited.
That garbage just provides a larger attack surface.
The proper way to address exploitable code is to fix the security flaws in your code.
Pasting band-aids all over the outside of your crappy OS is just stupid.
Hint to OS designers:
-Start- with a security model; DON'T try to paste "security" onto the side of your thing later in the process.
N.B. UNIX had one of those in 1973, before MICROS~1 ever got into the OS business (in 1980).
...of course, that would mean that Redmond would have to start all over again.
...further meaning that there is a high probability that apps that folks have would not be compatible with MICROS~1's new thing.
-- OriginalOwner_ [soylentnews.org]
(Score: 3, Funny) by turgid on Monday April 09 2018, @08:33PM (4 children)
Maybe they could dust off the Xenix source code and start hacking? I'm sure someone somewhere must still have a drive that can read 5.25" 360k disks.
I refuse to engage in a battle of wits with an unarmed opponent [wikipedia.org].
(Score: 3, Insightful) by Anonymous Coward on Monday April 09 2018, @09:02PM
One of us is psycho^W psychic.
I've been thinking about Xenix too.
MSFT licensed that in 1978, so it's clear that they knew about proper security even before they bought QDOS from Tim Paterson (one T) and rebranded that.
If MICROS~1 had used UNIX file permissions from the start, that would have taken their (literally and in fact) 2-bit file ATTRIBs up to 9 bits per file.
Not all that big a price to pay to cure 99 percent of their security problems from the start.
-- OriginalOwner_ [soylentnews.org]
(Score: 1) by anubi on Tuesday April 10 2018, @02:06AM (1 child)
Read 5.25 360K floppies? Yup. Surprisingly, I still can do that.
Still have several dozen disks as well. All old DOS stuff.
"Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
(Score: 0) by Anonymous Coward on Tuesday April 10 2018, @02:34PM
I can see how you may read 5 of those old disk. But how do you read a quarter disk? :-)
(Score: 0) by Anonymous Coward on Tuesday April 10 2018, @03:40AM
Not needed, the images are floating around the net, though somewhat corrupted. I hear there was some "NCommander" dude trying to restore them, though...
Restoring Xenix 386 2.2.3c, Part 1 [soylentnews.org]
Xenix 2.2.3c Restoration: No Tools, No Problem (Part 2) [soylentnews.org]
Xenix 2.2.3c Restoration: Damage Mapping (Part 3) [soylentnews.org]
Xenix 2.2.3c Restoration: Xrossing The X (Part 4) [soylentnews.org]
(Score: 1, Insightful) by Anonymous Coward on Tuesday April 10 2018, @07:37AM (1 child)
NT had a pretty good security model, in theory. The ACL model is a lot more flexible than the unix owner-group-other model. Unfortunately, this also makes it a lot harder to understand, with the result that any permission problem is solved by running everything as Administrator.
On top of that, NT was a lot closer to being a micro-kernel than any unix outside of Minix, but then they decided that graphics performance was more important than security and stability, and moved the graphics drivers into ring0. And we probably all know that graphics drivers are notoriously hard to get correct.
(Score: 0) by Anonymous Coward on Wednesday April 11 2018, @08:35AM
they decided that graphics performance was more important than security and stability
"They" being the salesmen who run the company. (It's obviously NOT engineers in charge there).
Yeah. Allowing user-supplied input into the realm where it can do maximum damage has to be the stupidest thing ever done by a software company.
Of course, I think we all know that M$ isn't so much a software company as it is an abuse company that sells software as a way of delivering abuse.
and moved the graphics drivers into ring0
Let's not gloss over the specific case of font rendering.
...and, just in time, here's El Reg's headline:
It's April 2018--and Patch Tuesday shows Windows security is still foiled by fiendish fonts [theregister.co.uk]
-- OriginalOwner_ [soylentnews.org]
(Score: 0) by Anonymous Coward on Tuesday April 10 2018, @06:54PM
The AV problem is actually very similar to the Halting Problem except that with the Halting Problem you get the full code and the inputs but with the AV problem you don't. And they say the Halting Problem is not solvable in general.
Perhaps you can solve the AV problem for specific/popular cases[1] but sandboxing is often a better way of securing stuff. Like "solving" the halting problem by ensuring that all programs halt within a max time limit whether they're written to or not.
[1] I do use AV as part of "defense in depth". But it's called virustotal and runs on someone else's servers...
(Score: 1, Funny) by Anonymous Coward on Monday April 09 2018, @08:31PM (5 children)
No, the real blame is that RAR was written by a Russian! Yes, Russians! It allowed Russia to hack Windows and tamper with the election making sure Trump won!
(Score: 1, Flamebait) by DannyB on Monday April 09 2018, @08:56PM (1 child)
Not Windows. It was Zuckerbooger's Facegrabber (like in Alien) that allowed the Russians to elect Trump.
The lower I set my standards the more accomplishments I have.
(Score: 3, Insightful) by Bot on Monday April 09 2018, @10:38PM
Why did they elect a friend of Israel enemy of Syria allied of themselves? Must be one of those russian loooong games. Let me sift through some historical surveillance logs...
- Sir, we are ready
- OK then, let's pick the next president
- Here, behold the candidates
- ....Wew ladski... can't we have Obama elected one more time?
- No sir, it's illegal in America
- I know, I was kidding.
- Oh, you got me, sir.
- So... any of them in bed with Israel?
- haha sir, I am not falling for it again, of course they are.
Account abandoned.
(Score: 2) by Thexalon on Tuesday April 10 2018, @01:45AM (2 children)
No, it's all a false flag by GNU, organized by Richard Stallman himself, to try to convince the public to ban RAR in favor of tar.bz2.
Fnord.
The only thing that stops a bad guy with a compiler is a good guy with a compiler.
(Score: 1) by anubi on Tuesday April 10 2018, @02:12AM
All this time, I thought old Phil Katz, originator of PKZIP, had by far the most elegant solution to file compression.
And thought this "DriveSpace" brought into DOS6.22 was pure unadulterated crap.
Sure would have liked to have seen DOS 6.22 had "ZipFolders" instead. So the filesystem would see a .ZIP file as a folder. With the tradeoff being opening the folder took RAM and time.
It would have taken file organization to a whole new level when an entire folder would have been neatly packaged as one file.
Yes, we have the equivalent now... but its something I sure could have used back then.
"Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
(Score: 2) by tangomargarine on Tuesday April 10 2018, @04:26PM
Nice try, but Bzip2 is BSD-licensed. Obviously RMS would advocate the use of gzip, which is GPL...and, y'know, part of that whole GNU project that is sort of his life's work.
Hand in your nerd card on the way out.
"Is that really true?" "I just spent the last hour telling you to think for yourself! Didn't you hear anything I said?"