Microsoft Aims For Greater Script Execution Control On Linux

[piotrj3]

If they've chosen Windows then security wasn't one of their priorities. Good to see M$ helping with security on Linux, though. They can't do anything about it on Windows, because it's broken by design.

Oh, you can say goodbye to your 'security' layers on Windows:

https://www.theregister.com/2023/03/01/blacklotus_malware_eset/

Remind me for what reasons Linux was banned?

Some malware doing something that isn't even working properly on linux doesn't matter in this context.

What is important that Linux now lacks many security features that Windows actually has. I remembered watching stream of Adam Zabrocki - creator of LKRG and one of main reasons he did so, is because Linux kernel nowadays lacks a ton of anti-exploit features that simply exist in Windows.

[QwertyChouskie]

This couldn't be further from the truth - Windows is making security improvements in strides, and we shouldn't ignore that. It has many, many planned secure-by-default features coming for Windows 11. If you haven't seen this excellent talk, I'd recommend checking it out as it details their plans to make their OS far more secure. https://www.youtube.com/watch?v=8T6ClX-y2AE

Microsoft is rewriting parts of their OS in Rust already, including in the kernel, and rolling those changes out to customers. They're not sitting idly by while Linux eats their lunch.

Let me know when they fix UAC being trivially bypassable (a.k.a. admin privilege escalation, would be considered a severe vulnerability in any other OS). Until they fix the obvious gaping holes, the other security features are little more than a placebo.

https://tryhackme.com/room/bypassinguac

[dylanmtaylor]

Let me know when they fix UAC being trivially bypassable (a.k.a. admin privilege escalation, would be considered a severe vulnerability in any other OS). Until they fix the obvious gaping holes, the other security features are little more than a placebo.

https://tryhackme.com/room/bypassinguac

I'm not sure if you actually watched what I linked, but between their adminless default behavior (8 minutes in) and mandatory app signing (around 29 minutes in), I think it'd be extraordinarily hard to continue to abuse UAC bypass methods.

[QwertyChouskie]

I'm not sure if you actually watched what I linked, but between their adminless default behavior (8 minutes in) and mandatory app signing (around 29 minutes in), I think it'd be extraordinarily hard to continue to abuse UAC bypass methods.

If they actually fix UAC bypassing, then that's good, but it's frankly embarrassing that it's taken, what, 17+ years after the introduction of UAC? An admin/root privilege escalation exploit, especially ones as easy to perform as the UAC exploits, would be considered a high-priority CVE in any other OS and fixed within months at most.

[rogerx]

Hey great idea Microsoft!

When you get done, can likely call it systemd!

[HEL88]

the other security features are little more than a placebo.

In serious companies and institutions, employees work with user accounts, not local administrator so the UAC problem does not exist.

Instead, there is a problem with malware invisible to the system - invisible to Linux. And with HVCL you can be sure that all running components are signed. Linux does not provide that.

[oiaohm]

Instead, there is a problem with malware invisible to the system - invisible to Linux. And with HVCL you can be sure that all running components are signed. Linux does not provide that.

https://www.redhat.com/en/blog/how-use-linux-kernels-integrity-measurement-architecture

The Integrity Measurement Architecture (IMA) is responsible for collecting file hashes, placing them in kernel memory (where userland applications cannot access/modify it) and allows local and remote parties to verify the measured values. The Extended Verification Module (EVM) detects offline tampering (this could help mitigate evil-maid attacks) of the security extended attributes.

There is a difference here. Linux high security systems don't in fact depend on signing. Integrity Measurement Architecture has your company running server with approved list of files this covers kernel modules. Greater Script Execution control would close up a weakness.

Yes whitelist model for approved software at play here.

https://github.com/heki-linux Yes heki on Linux what will be Linux equal to HVCL will be different because use of the IMA system will be option with heki instead of signed.

HEL88 lot of the attacks against windows and EFI have malware using exploitable parts that are signed. IMA system parts can be blacklisted without need to revoke signatures. Please note coreboot can use IMA system supporting connecting to company approved server for list of approved UEFI parts.

IMA is another way to do the is this file approved logic.

[HEL88]

There is a difference here. Linux high security systems don't in fact depend on signing. Integrity Measurement Architecture has your company running server with approved list of files this covers kernel modules. Greater Script Execution control would close up a weakness.

Yes whitelist model for approved software at play here.

https://github.com/heki-linux Yes heki on Linux what will be Linux equal to HVCL will be different because use of the IMA system will be option with heki instead of signed.

HEL88 lot of the attacks against windows and EFI have malware using exploitable parts that are signed. IMA system parts can be blacklisted without need to revoke signatures. Please note coreboot can use IMA system supporting connecting to company approved server for list of approved UEFI parts.

IMA is another way to do the is this file approved logic.

EVM is a kernel module. If the kernel is compromised the EVM can no longer be trusted.


HVCL runs on higher privileges than the kernel therefore it is able to 100% check kernel integrations. If the kernel is compromised HVCL is able to detect this.


You are comparing two completely different things (files integrity vs kernel runtime integrity).

Linux, even with EVM, has no way to check its own integrity. And confirm whether it is clean or infected.

Besides, are you using EVM with IMA? Do you know companies that do this??? Because already millions of users and companies are using HVCL without problems and in Windows 11 it is enabled by default. Do you see the difference?

[oiaohm]

HVCL runs on higher privileges than the kernel therefore it is able to 100% check kernel integrations. If the kernel is compromised HVCL is able to detect this.

https://static.sched.com/hosted_files/lssna2023/b6/2023-05-11%20LSS%20-%20Heki.pdf

A hypervisor still need a kernel of some form like it or not.

You are comparing two completely different things (files integrity vs kernel runtime integrity).

Signed is really file integrity.

Linux, even with EVM, has no way to check its own integrity. And confirm whether it is clean or infected.

https://www.gnu.org/software/grub/manual/grub/html_node/Measured-Boot.html

IMA setups the core kernel does not need to validate its own integrity as that should have been either checked by the firmware or by the boot loader. Yes of course boot loader

Remember HVCL you still have the problem that the HVCL cannot check it own integrity either.

https://www.linuxboot.org/

Its also simple to forget that linux kernel happen to firmware in many servers. HEL88 you find IMA/EVA from firmware all the way up in different companies server setups. Of course those companies are using Linuxboot as the motherboard firmware validate by motherboard key unique to company..

HEL88 what safer at the bottom some vendor made UEFI solution or a Linux kernel. Do note the early Linux kernel in firmware does not stay running it kexec it self out of running after it validated what it loading.

Basically there is a different solution for Linux systems out there.

Heki is Linux kernel has the hypervisor doing the HVCL things. Linuxboot Linux kernel as the firmware validating all the boot loaders and loaded kernels...

HEL88 yes Linux all the way down.
1) Linux firmware that protected by motherboard chipset.
2) Linux hypervisor validated by Linux firmware.
3) Guest OS validate by Linux hypervisor.
This stack there does not need to be a bootloader in the mix.

[lowflyer]

A substantial portion of Windows security bugs can be fixed by rewriting it in Rust.

Anything can be improved by rewriting it in rust. The broken moped of my son runs again since I've rewritten it in rust. Even the stale fatty xmas cookies from aunt margaret taste better now.