GOLAND AUTO FORMAT WINDOWS
Windows ME/XP) to discover UPnP compatible devices and automatically configure them. SSDP v1 was designed to support the SOHO (small office/home office) market. To understand the flaws it helps to understand the Simple Service Discovery Protocol ( v1-03) which is UPnP's discovery mechanism. In the end the compromise that was reached is that the spec would identify the bug (which it did) but would not specify a solution. But there was a fairly long and heated argument between the product group and the architecture group as to how serious this hole was. I had even written up a nice way to deal with it.
So the first two problems were out of my remit. All implementation related issues were to be handled by the product group.
As a member of the architecture group I was only supposed to work on the spec design. Although it makes me sad to be associated with a product that suffered from such security holes the reality is that the architecture group and the product group had a (strong enforced) separation. The first two holes, which I'll go into more below, were implementation flaws. Not checking for excessive network announcements that leaves UPnP machines open to be used for DDOS attacks.Performing a HTTP GET without checking how much information has been downloaded which allows an attacker to cause the machine to run out of memory.A buffer overflow that allows a remote machine to take over the UPnP machine.The three holes that have been found so far are: I worked in the network architecture group at Microsoft that owned UPnP and led the design effort on SSDP. What really focused my attention was when I found out that the flaw was in a system called Universal Plug and Play. I first heard about the problem with UPnP on NPR. When I heard that UPnP, a sub system of Windows XP I helped to architect when I had worked at Microsoft in the 1990s, had a major security hole you can imagine I was more than a little curious.
0 kommentar(er)
