這次換 HP 裝 Spyware 啦~

討論的頗熱烈的,像是「HP is installing spyware on its machines disguised as an "analytics client"」、「HP stealthily installs new spyware called HP Touchpoint Analytics Client」。

這個軟體會被注意到是因為吃太多資源,而且使用者沒有同意安裝這個軟體 (目前看是起來是透過自動更新機制裝進去的):「Didn't Install HP TouchpointAnalyticsClient and It's Causing CPU 95-98 Red」(先備份一份在這邊,以免被砍...)。

然後這軟體很明顯會傳資料回 HP:

The HP Touchpoint Manager technology is now being delivered as a part of HP Device as a Service (DaaS) Analytics and Proactive Management capabilities. Therefore, HP is discontinuing the self-managed HP Touchpoint Manager solution.

先前聯想因為類似的行為賠了 350 萬美金,這次 HP 搞這包不知道會怎麼樣...

Savitech (盛微) 的 USB 音效驅動程式會安裝 Root CA (被發了 CVE-2017-9758)

Hacker News 上看到 CERT 的「Savitech USB audio drivers install a new root CA certificate」提到 Savitech USB audio driver 會安裝自己的 Root CA:

Savitech provides USB audio drivers for a number of specialized audio products. Some versions of the Savitech driver package silently install a root CA certificate into the Windows trusted root certificate store.

出自「Inaudible Subversion - Did your Hi-Fi just subvert your PC? (原網站已經無法訪問,參考備份連結 https://archive.is/K6REr)」,CVE 編號是 CVE-2017-9758,最初是由 n3kt0n 提出的:「某單位 drivers silently install certificate in trusted root certificate authorities store [CVE-2017-9758]」:

Mitre assigned this exposure the identifier CVE-2017-9758, but was initially tracked by HITCON ZeroDay project as ZD-2017-00386.

有兩把 CA public key 被塞進去。雖然目前還沒有徵兆 private key 有外洩,但還是建議儘快移除:

There is currently no evidence that the Savitech private key is compromised. However, users are encouraged to remove the certificate out of caution. The two known certificates are:

SaviAudio root certificate #1
‎Validity: Thursday, ‎May ‎31, ‎2012 - ‎Tuesday, ‎December ‎30, ‎2036
Serial number: 579885da6f791eb24de819bb2c0eeff0
Thumbprint: cb34ebad73791c1399cb62bda51c91072ac5b050

SaviAudio root certificate #2
Validity: ‎Thursday, ‎December ‎31, ‎2015 - ‎Tuesday, ‎December ‎30, ‎2036
Serial number: ‎972ed9bce72451bb4bd78bfc0d8b343c
Thumbprint: 23e50cd42214d6252d65052c2a1a591173daace5

另外 Savitech 也放出了新版的 driver,不包含 Root CA:

Savitech has released a new driver package to address the issue. Savitech drivers version 2.8.0.3 or later do not install the root CA certificate. Users still must remove any previously installed certificate manually.

看了一下說明,看起來是當時為了支援 Windows XP 而做的,但微軟已經不提供驅動程式的數位簽章了,所以就只好這樣搞...

Windows 將引入 TruePlay,推出作弊偵測的 API

在「Windows now includes gaming cheat detection at the system level」這邊看到微軟將會引入 TruePlay (然後跟 Sonostrueplay 衝名 XDDD) 作弊偵測機制。

很明顯的會有隱私問題,而也很明顯的微軟說不會有隱私問題:

As Microsoft notes, "to protect customer privacy, no data is shared or transmitted until permission is granted," and no information is sent until "processing has determined cheating is likely to have occurred."

這不是把人當傻子嗎,遊戲一開始就會要求你同意才能玩啊,所以資料一定會送出的啊... 而且 TruePlay 變成作業系統的標準配備後,作弊程式就會找 workaround 才會推出 :o

Amazon Lightsail 支援 Windows 了

Amazon Lightsail 決定支援 Windows 了,算是其他目前幾家領頭的 VPS 還沒進入的領域:「Amazon Lightsail Update – Launch and Manage Windows Virtual Private Servers」。

由於多了 Windows 的授權費用,價錢貴了不少:

不過還是提供一個月免費的額度:

You can try out a 512 MB server for one month (up to 750 hours) at no charge.

不過不是所有 Amazon Lightsail 有開的區域都支援 Windows:

This feature is available today in the US East (Northern Virginia), US East (Ohio), US West (Oregon), EU (London), EU (Ireland), EU (Frankfurt), Asia Pacific (Singapore), Asia Pacific (Mumbai), Asia Pacific (Sydney), and Asia Pacific (Tokyo) Regions.

不過還是不知道 Amazon Lightsail 進入這塊市場的想法是什麼...

在 Linux 下引用 Windows 的 DLL 檔

作者為了在 Linux 下進行安全分析而弄出來的計畫:「Porting Windows Dynamic Link Libraries to Linux」。

作者對 Windows 的架構有不少抱怨 XDDD

Distributed, scalable fuzzing on Windows can be challenging and inefficient. This is especially true for endpoint security products, which use complex interconnected components that span across kernel and user space. This often requires spinning up an entire virtualized Windows environment to fuzz them or collect coverage data.

This is less of a problem on Linux, and I've found that porting components of Windows Antivirus products to Linux is often possible. This allows me to run the code I’m testing in minimal containers with very little overhead, and easily scale up testing.

This is just personal opinion, but I also think Linux has better tools. ¯\_(ツ)_/¯

而這個專案跟 WineHQ 完整模擬不一樣,這只是給 Linux 下原生的程式使用 Windows 下 DLL 內的功能:

This project does not replace Wine or Winelib.

Winelib is used to port Windows C++ projects to Linux, and Wine is intended to run full Windows applications. This project is intended to allow native Linux code to load simple Windows DLLs.

The closest analogy would be ndiswrapper but for userspace.

作者拿了 Windows Defender 當範例,示範在 Linux 下呼叫 Windows 的 DLL...

關閉與開啟 Windows 10 內一堆侵犯與增強隱私的設定

DuckDuckGo 前陣子整理了一篇關於如何調整 Windows 10 的文章,洋洋灑灑列了十五條方式供使用者調整:「How To Protect Privacy On Windows 10」。

像是可以將無線網路的 MAC address 隨機化的方式就頗不錯:

然後有一堆要把資料送回 Microsoft 的...

在 EC2 上 Windows 用的 EC2Rescue

看到「Amazon EC2Rescue is now available」這個,在「How can I use EC2Rescue to troubleshoot and fix common issues on my EC2 Windows instance?」這邊則解釋了用途。

拿來解 Windows 上常見的問題的工具,也可以單純拿來拉 log?不過要注意的是版本:

Note: EC2Rescue can only be run on Windows Server 2008 R2 or later, but it can also analyze the offline volumes of Windows Server 2008 or later.

像是 Windows 2003 這些古董是沒辦法跑的 XDDD

用 SessionGopher 拉出機器上各種密碼與 Key

同事在 Slack 上提到 fireeye/SessionGopher 這個工具,可以從機器上拉出各種敏感資訊:

SessionGopher is a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Desktop. It can be run remotely or locally.

方法是掃 registry 或是硬碟:

SessionGopher works by querying the HKEY_USERS hive for all users who have logged onto a domain-joined box at some point. It extracts PuTTY, WinSCP, SuperPuTTY, FileZilla, and RDP saved session information. It automatically extracts and decrypts WinSCP, FileZilla, and SuperPuTTY saved passwords. When run in Thorough mode, it also searches all drives for PuTTY private key files (.ppk) and extracts all relevant private key information, including the key itself, as well as for Remote Desktop (.rdp) and RSA (.sdtid) files.

是個... 好玩... 的... 東西...

將 Windows 10 侵犯隱私的程式都關光

alirobe/reclaimWindows10.ps1 這個 gist 提供了 script 將 Windows 10 侵犯隱私的程式都關閉:

"Reclaim Windows 10" turns off a bunch of unnecessary Windows 10 telemetery, removes bloatware, and privacy invasions. Review and tweak before running. Scripts for reversing are included and commented. Fork via https://github.com/Disassembler0 (different defaults)

翻了一次發現東西好多啊... 把 user 當作商品的感覺 @_@