Software developer at a big library, cyclist, photographer, hiker, reader. Email: chris@improbable.org
24076 stories
·
214 followers

Biden moves to protect public lands with sweeping conservation rule - The Washington Post

1 Share

For decades, the federal government has prioritized oil and gas drilling, hardrock mining and livestock grazing on public lands across the country. That could soon change under a far-reaching Interior Department rule that puts conservation, recreation and renewable energy development on equal footing with resource extraction.

The final rule released Thursday represents a seismic shift in the management of roughly 245 million acres of public property — about one-tenth of the nation’s land mass. It is expected to draw praise from conservationists and legal challenges from fossil fuel industry groups and Republican officials, some of whom have lambasted the move as a “land grab.”

Interior’s Bureau of Land Management, known as the nation’s largest landlord, has long offered leases to oil and gas companies, mining firms and ranchers. Now, for the first time, the nearly 80-year-old agency will auction off “restoration leases” and “mitigation leases” to entities with plans to restore or conserve public lands.

“Today’s final rule helps restore balance to our public lands as we continue using the best-available science to restore habitats, guide strategic and responsible development, and sustain our public lands for generations to come,” Interior Secretary Deb Haaland said in a statement.

Under President Biden, the BLM has put a greater emphasis on protecting public lands from the twin threats of climate change and development. Tracy Stone-Manning, the bureau’s director, has warned that hotter, drier climates are driving longer and more intense wildfires and drought across the American West. At the same time, development has fragmented and destroyed wildlife habitat and migratory corridors.

“We oversee 245 million acres, and every land manager will tell you that climate change is already happening. It’s already impacting our public lands,” Stone-Manning said during a Washington Post Live event last year. “We see it in pretty obvious ways, through unprecedented wildfires.”

The fossil fuel industry, a frequent foe of the Biden administration, has chafed at the BLM’s approach. It has called the public lands rule an example of regulatory overreach that will stifle domestic energy production, even as the United States pumps more oil than any nation in history.

Kathleen Sgamma, president of the Western Energy Alliance, which represents oil and gas companies, said the group plans to challenge the BLM rule in court. She said the policy appears to violate the Federal Land Policy and Management Act, the 1976 law that tasked the bureau with overseeing “multiple uses” of public lands for current and future generations.

“We have no choice but to litigate,” Sgamma said. “These conservation leases seem to be designed to preclude energy development on federal lands.”

The BLM’s proposed rule released last year sparked especially intense outrage in Wyoming, an energy powerhouse that accounts for nearly one-tenth of U.S. fossil fuel production. Some Wyoming Republicans have claimed that the BLM is colluding with liberal environmental groups to put millions of acres off-limits to development.

Sen. John Barrasso (R-Wyo.) said Thursday he plans to introduce legislation to repeal the BLM rule using the Congressional Review Act, which allows lawmakers to overturn regulations by a simple majority vote. “With this rule, President Biden is allowing federal bureaucrats to destroy our way of life,” Barrasso said in a statement.

Aaron Weiss, deputy director of the Center for Western Priorities, an advocacy group, said some Republican officials have spread “disinformation and conspiracy theories” about the rule. He noted that during a House Natural Resources Committee hearing last year, South Dakota Gov. Kristi L. Noem (R) claimed the draft rule would allow Chinese citizens to purchase leases on U.S. lands.

Unlike the proposed rule, the final rule clarifies that “leases cannot be held by foreign persons.” It also offers “restoration leases” and “mitigation leases” rather than “conservation leases” — a linguistic tweak that seems designed to skirt the politicization of the word “conservation,” Weiss said.

Mitigation leases will allow lease holders to offset the impact of their activities. For example, a rancher whose cattle grazing is degrading the land could be required to purchase a mitigation lease during the permitting process. The rancher could then work with a local conservation group to restore nearby habitat for the greater sage grouse, an imperiled bird of the West.

Renewable energy developers won’t be immune from the rule. They could buy mitigation leases if their wind or solar farms are affecting wildlife or watersheds, said Danielle Murray, vice president of conservation policy at the Conservation Lands Foundation.

The final rule also directs the BLM to prioritize landscape health for the first time and to incorporate Indigenous knowledge into its decision-making. The latter is a top priority of Haaland, the first Native American to serve as a Cabinet secretary and lead a department that once oversaw the removal of Indigenous people from their land.

The Trump administration took a vastly different approach to managing public lands than Biden officials. President Donald Trump briefly moved the BLM’s headquarters from Washington to Grand Junction, Colo., a hot spot for natural gas production. More than 87 percent of the affected employees either resigned or retired rather than move to Colorado, depriving the agency of expertise and disrupting its operations.

To lead the BLM, Trump tapped William Perry Pendley, a conservative lawyer who had previously advocated for selling off public lands across the country. Pendley, who was never confirmed by the Senate, pushed the bureau to maximize oil, gas and mineral development.

Should Trump return to office, “the priority has to be oil and gas,” Pendley said in a recent interview.

Read the whole story
Share this story
Delete

2024 West Africa Submarine Cable Outage Report - Internet Society

1 Comment

On 14 March 2024, a suspected underwater rock slide off the coast of Cote d’Ivoire resulted in the following submarine cables being offline:

  • ACE – Africa Coast to Europe
  • SAT-3 – Submarine Atlantic 3/West Africa Submarine Cable
  • WACS – West Africa Cable System
  • MainOne

The outage did not directly impact Seacom, whose network spans the East African and South African coastlines. However, due to outages to its partner networks on the West Coast—WACS and MainOne—it had to reroute traffic to other links.

This report focuses on the 14 March 2024 outage, not the outage along the Red Sea that affected Seacom/TGN-EA, EIG, and AAE-1 submarine cables on 24 February 2024. According to an article from 2 April 2024, repairs were still ongoing. There are no reports of the fiber cut on 24 February 2024 causing outages in Africa.

The outage impacted 13 African countries located on the West African seaboard, causing either degraded services or near-total Internet outages.

The following map and table show the countries (shaded red in the map) that were directly affected by the outages on the four submarine cables.

Countries with submarine cable diversity could maintain a level of uptime, indicating resiliency. Cross-border terrestrial fiber links were crucial in facilitating connectivity to operational submarine fiber cables for landlocked countries.

This map shows that all four affected submarine cables converge along the coast of Cote d’Ivoire, where the rockslide is reported to have happened. This can be deemed to be a single point of failure for the four cables.

It is unclear if other single points of failure exist in other countries where the cables converge or whether the cable operators have built-in protection in different areas along their cables. Submarine cable providers do not provide details about their cable routes for what is believed to be security reasons.

It should be noted that cable outages occur occasionally — usually affecting individual cables. Estimates are that there are about 100 fiber cuts a year. This incident is unique because multiple cables were damaged due to their convergence at a single physical point.

Google’s Equiano cable does not terminate in Cote d’Ivoire and was vital to maintaining uptime for several affected countries.

Maroc Telecom West Africa or MoovAfrica’s cable terminates in Cote d’Ivoire but was not affected by the rockslide and remained operational. This shows that they likely used a different path for their fiber cable, which helped Cote d’Ivoire maintain connectivity.

More submarine and terrestrial cables and diverse cable landing points are needed to help improve redundancy and resiliency across Africa.

Several reports indicate that countries with access to Google’s Equiano cable and MTWA/MoovAfrica cables, unaffected by the reported rockslide, could maintain uptime during the outage.

Local operators used cross-border terrestrial fiber links in West Africa to reroute traffic to the Equiano cable, which saw a fourfold increase in traffic.

SEACOM South Africa also rerouted traffic to Google’s Equiano cable to provide traffic to networks that relied on its West African partner network via WACS and MainOne.

Microsoft reported outages of their services in the EMEA region on 14 March. Countries in Africa that were not directly affected by the submarine cable outage could not use services such as Microsoft Teams and Office365, among others. Microsoft services were restored later that day following a successful rerouting by Microsoft.

Niger, which still uses satellite connectivity, was able to maintain uptime over satellite and terrestrial fiber via Burkina Faso into Benin.

Cote d’Ivoire, the center of the outage, experienced a near-total Internet outage. The Moov Africa cable (also known as the Maroc Telecom West Africa or MTWA cable) remained operational and provided connectivity.

The cable operators of the affected submarine cables have provided the below estimates to restore services:

  • SAT-3 from 29 March to 5 April (fully restored as of 6 April)
  • ACE from 4 to 14 April
  • WACS from 25 April to 5 May
  • MainOne from 5 to 16 May

As of publishing, information from affected countries shows that IXPs remained operational, meaning content available via IXPs has remained reachable.

Niger’s IXP is not operational at the moment. As mentioned, available terrestrial fiber and satellite connectivity are believed to have helped avoid the total outage of local and international traffic.

We will share more information about how the IXPs reacted to the incident as it comes to light.

The Internet Society has carried out many activities to support the establishment and/or growth of IXPs in the countries affected by this fiber cut. These activities have included training workshops under the AXIS Project, equipment donations, cache fill grants, and hosting peering forums to strengthen the local IXP community.

Below is a summary of these activities and their respective impacts from the year 2011:

The below map (Figure 2) shows the Internet Society’s IXP support activities in Africa from 2020. These have included:

  • Hardware support (HS) — equipment donations to the IXP.
  • Peering forums (PFs) — in-person events that bring together and strengthen the local IXP community.
  • Cache fill (CF) grants — a grant support program that provides connectivity support to fill CDN caches hosted at IXPs.

The following Internet Society Chapters shared various articles and updates on the outage:

  • Ghana Chapter: One of the chapter members and Internet Society alumni published an article assessing the state of Internet resilience in Ghana and what needs improvement. The article was shared on the Internet and in a local newspaper.
  • Togo Chapter: The chapter published a communique, and Radio France International interviewed the Chapter President. The Togo Chapter also shared an update on its website about the outage.
  • Cameroon Chapter: The chapter joined the Cameroon IXP (CAMIX), Cameroon NOG (CAMNOG), and a coalition of local IT service providers and ISPs to publish a joint communique with recommendations to the Cameroon Government on actions to improve Cameroon’s Internet resilience. They used the data from Internet Society Pulse to support their recommendations.
  • Somalia Chapter: The chapter issued a statement on the future of submarine fiber cables following the outage.

Internet Society staff members Jean-Baptiste Millogo and Dr. Dawit Bekele both gave their views on the outage as follows:

Dawit Bekele was interviewed by the French newspaper Jeune Afrique, which is widely read in Francophone Africa. The article provided public awareness of the Internet Society’s Internet measurement project, notably the Pulse Internet Resilience Index. It also discusses the importance of Internet resilience in avoiding the negative impacts of this kind of cable outage. It also denounces some myths, such as the one that says that government control of fiber cables increases Internet resilience.

Jean-Baptiste Millogo was interviewed on BF1 and RTB, two national TV stations in Burkina Faso with regional audiences. During both interviews, he discussed the importance of IXPs, restoration times for damaged submarine cables, how operators and Internet Service Providers (ISPs) provide services, the impact of the outage on Burkina Faso’s Internet ecosystem, and long-term solutions to improve Internet resilience and the impact of future outages in Burkina Faso.

These recent events have shown the importance of having upstream redundancy, whether it be submarine or terrestrial cables, satellite and/or more locally cached content, and IXPs allowing local Internet connectivity to continue when connections to the outside world are broken.

More submarine and regional terrestrial fiber cables are coming live in Africa shortly, including:

  • 2Africa cable, which is reported to be the longest subsea cable ever, is coming live in 2024.
  • Trans-Sahara Optical Fibre Backbone cable, which connects Niger, Algeria, Chad, and Nigeria, is expected to be live in 2024. This will significantly boost Niger and Chad, which are both landlocked countries.
  • South Sudan and Djibouti have agreed to lay a cable between them through Ethiopia.
  • The Djoliba cable, unveiled in 2020, will be the first pan-West African fiber cable to connect Burkina Faso, Cote D’Ivoire, Ghana, Guinea, Liberia, Mali, Nigeria, and Senegal. This will help maintain connectivity within the West African region and help provide redundant paths to other connectivity sources in the event of submarine cable disruptions. 

Starlink continues to increase availability over Africa. Though licenses have not been granted in all countries, it presents an alternative option to fiber connectivity in the highly diverse region. Hopefully, more affordable LEO satellite services like Starlink will be available shortly to help boost redundancy.

More investment in locally hosted content and Internet services in Africa will also help mitigate the impact of submarine cable cuts. Recent growth in data center investment is a positive sign of more locally available content being made available via IXPs.

Read the whole story
Share this story
Delete
1 public comment
acdha
23 minutes ago
reply
Neat to see those support activities paying off
Washington, DC

Constitutional Sheriffs Group Plans To Insert Itself Into More Aspects Of The Voting Process In 2024

1 Comment

On Tuesday afternoon, the CEO of MyPillow Mike Lindell, along with a cadre of election deniers, spoke in front of a crowd of what organizers boasted could be over 800 people at the Ahern Hotel in Las Vegas, during an all-day event hosted by the far-right Constitutional Sheriffs and Peace Officers Association. 

Lindell was only one of many election deniers who spoke at this week’s 12 and a half hour event, regaling the, in reality, sparse crowd in attendance with tales of dangerous voting machines and debunked conspiracy theories about a stolen 2020 election. The conference included speakers like failed Arizona Secretary of State candidate Mark Finchem, ex-Overstock CEO Patrick Byrne, and former Trump administration officials-turned MAGA personalities Steve Bannon, and Michael Flynn, among others.  

The Constitutional Sheriffs and Peace Officers Association is a far-right movement that began in 2011, which experts say has only been emboldened since 2020 election denialism became a tenant of the MAGA right and a focus for the group. 

The movement — which stands on principles that Mary McCord, executive director of the Institute for Constitutional Advocacy and Protection and professor of law at Georgetown University Law Center, described as “really sort of made up” — maintains that sheriffs hold supreme law enforcement authority in the country, and that sheriffs, not federal or state law enforcement, have the ultimate authority to reject enforcement of federal law. 

The event provides a glimpse into which elements of the standard voting process the far right group is focused on demonizing as we head into the 2024 election. For example, several speakers focused on the false narrative that illegal immigrants will cast illegal votes on behalf of the Democratic Party in the fall. Speakers shared guides, according to reporting from WIRED, on how to stop the “expected flood” of alleged illegal voters from casting votes in November.

Experts warn that it appears the group could be gearing up for disruption in the fall, as well. 

“You would anticipate, I think, that there is some kind of planning going on for scenarios that might take place after November in which they would want their organizational capacity to be ready to go,” explained Jacob Ware, research fellow at the Council on Foreign Relations, focusing on domestic and and international terrorism and counterterrorism. 

Before going on a tirade about the dangers of voting machines and widespread voter fraud, Lindell told TPM ahead of the event that he would be educating people on how much power sheriffs have at the county level to get rid of electronic voting machines. 

When he was introduced at the event, the MyPillow Guy got a small standing ovation from a less-than rousing crowd before launching into a familiar narrative about dangerous voting machines and compromised elections. On January 9, 2021, he told the room, he handed over “evidence” proving widespread voter fraud, under what he claimed was a government gag order. 

The evidence in question was never fully explained, but it was, according to Lindell, supposed to prove that the 2020 election was stolen from Donald Trump. His goal now, he said, no longer involves overturning the results of the 2020 election, but rather he wants to get “rid of the machines” and move to a hand-counting ballot system – which has been proven to be both error-prone and inefficient

Finchem similarly spoke about faulty voter machines that rejected ballots “at a tune of 7,000” ballots, while election denier Mark Cook falsely told the crowd that Dominion Voting Software can easily be used to flip the votes in an election. 

The various conspiracy theories shared by speakers this week were all sponsored by the Constitutional Sheriffs group, which has been involved in efforts to encourage sheriffs to increase surveillance of ballot drop box locations and infiltrate ballot tabulators since the 2020 election. The group has also pushed member sheriffs to intervene in election administration, increasing the risk of voter intimidation.

Richard Mack, CSPOA founder and former Oath Keeper board member, in an interview with TPM, explained that Tuesday’s event — which according to a press release from the organization was designed to be a “training and press conference” for American leaders, patriots, and constitutional advocates — included state officials, Republican candidates, members of the public, as well as some constitutional sheriff members. 

The goal of the event and the organization as a whole, Mack claimed, is not to train constitutional sheriffs on how to investigate voter fraud, but rather, to “focus on peaceful and effective solutions.” In conversation with TPM, Mack never explicitly explained what these solutions are, but did emphasize that the group is not violent and that no members of the group were videotaped as being part of the January 6 insurrection.

Mack spoke generally about how the group is planning to safeguard the integrity of elections, noting that they have no authority over elections, but that they are working with True the Vote, the far-right Texas based group behind the debunked documentary on voter fraud, “2,000 Mules,” as well as Lindell, who Mack claims has gathered “extensive” evidence of supposed fraud. 

“The main thing we train in is the responsibility of sheriffs to make sure that elections are being protected and that any complaints are being investigated,” Mack argued. 

In the Constitutional Sheriffs movement’s view, protecting elections means inserting themselves into more aspects of the voting process — like providing security at polling places — and supporting officials who want to contest the results of the election via local audits, he said. The group is also focused on ensuring sheriffs follow up with reported voter inconsistencies in 2024, which he says were largely overlooked or ignored after 2020, despite the fact that many of the supposed claims of voter fraud that gained traction in 2020 have since been debunked.

Experts warn that the group’s stated goals are concerning ahead of November. There is a fear, according to Ware, that this particular group of law enforcement officers are not working on behalf of our democracy, but rather, working on behalf of what they determine to be the interests of a local population. 

These constitutional sheriffs, he added, might actually accelerate or intensify political divisions, which could ultimately lead to “a situation where you have pockets of the country where you do not have federal authority” or federal authority is being challenged by the local sheriffs, Ware said.

Read the whole story
Share this story
Delete
1 public comment
acdha
1 hour ago
reply
The brown shirts have spoken. Are we ready?
Washington, DC

The Windows Registry Adventure #1: Introduction and research results

1 Share

Posted by Mateusz Jurczyk, Google Project Zero

In the 20-month period between May 2022 and December 2023, I thoroughly audited the Windows Registry in search of local privilege escalation bugs. It all started unexpectedly: I was in the process of developing a coverage-based Windows kernel fuzzer based on the Bochs x86 emulator (one of my favorite tools for security research: see Bochspwn, Bochspwn Reloaded, and my earlier font fuzzing infrastructure), and needed some binary formats to test it on. My first pick were PE files: they are very popular in the Windows environment, which makes it easy to create an initial corpus of input samples, and a basic fuzzing harness is equally easy to develop with just a single GetFileVersionInfoSizeW API call. The test was successful: even though I had previously fuzzed PE files in 2019, the new element of code coverage guidance allowed me to discover a completely new bug: issue #2281.

For my next target, I chose the Windows registry. That's because arbitrary registry hives can be loaded from disk without any special privileges via the RegLoadAppKey API (since Windows Vista). The hives use a binary format and are fully parsed in the kernel, making them a noteworthy local attack surface. Furthermore, I was also somewhat familiar with basic harnessing of the registry, having fuzzed it in 2016 together with James Forshaw. Once again, the code coverage support proved useful, leading to the discovery of issue #2299. But when I started to perform a root cause analysis of the bug, I realized that:

  • The hive binary format is not very well suited for trivial bitflipping-style fuzzing, because it is structurally simple, and random mutations are much more likely to render (parts of) the hive unusable than to trigger any interesting memory safety violations.
  • On the other hand, the registry has many properties that make it an attractive attack surface for further research, especially for manual review. It is 30+ years old, written in C, running in kernel space but highly accessible from user-mode, and it implements much more complex logic than I had previously imagined.

And that's how the story starts. Instead of further refining the fuzzer, I made a detour to reverse engineer the registry implementation in the Windows kernel (internally known as the Configuration Manager) and learn more about its inner workings. The more I learned, the more hooked I became, and before long, I was all-in on a journey to audit as much of the registry code as possible. This series of blog posts is meant to document what I've learned about the registry, including its basic functionality, advanced features, security properties, typical bug classes, case studies of specific vulnerabilities, and exploitation techniques.

While this blog is one of the first places to announce this effort, I did already give a talk titled "Exploring the Windows Registry as a powerful LPE attack surface" at Microsoft BlueHat Redmond in October 2023 (see slides and video recording). The upcoming blog posts will go into much deeper detail than the presentation, but if you're particularly curious and can't wait to find out more, feel free to check these resources as a starter. 🙂

Research results

In the course of the research, I filed 39 bug reports in the Project Zero bug tracker, which have been fixed by Microsoft as 44 CVEs. There are a few reasons for the discrepancy between these numbers:

  • Some single reports included information about multiple problems, e.g. issue #2375 was addressed by four CVEs,
  • Some groups of reports were fixed with a single patch, e.g. issues #2392 and #2408 as CVE-2023-23420,
  • One bug report was closed as WontFix and not addressed in a security bulletin at all (issue #2508).

All of the reports were submitted under the Project Zero 90-day disclosure deadline policy, and Microsoft successfully met the deadline in all cases. The average time from report to fix was 81 days.

Furthermore, between November 2023 and January 2024, I reported 20 issues that had low or unclear security impact, but I believed the vendor should nevertheless be made aware of them. They were sent without a disclosure deadline and weren't put on the PZ tracker; I have since published them on our team's GitHub. Upon assessment, Microsoft decided to fix 6 of them in a security bulletin in March 2024, while the other 14 were closed as WontFix with the option of being addressed in a future version of Windows.

This sums up to a total of 50 CVEs, classified by Microsoft as:

  • 39 × Windows Kernel Elevation of Privilege Vulnerability
  • 9 × Windows Kernel Information Disclosure Vulnerability
  • 1 × Windows Kernel Memory Information Disclosure Vulnerability
  • 1 × Windows Kernel Denial of Service Vulnerability

A full summary of the security-serviced bugs is shown below:

GPZ #

CVE

Title

Reported

Fixed

2295

CVE-2022-34707

Windows Kernel use-after-free due to refcount overflow in registry hive security descriptors

2022-May-11

2022-Aug-09

2297

CVE-2022-34708

Windows Kernel invalid read/write due to unchecked Blink cell index in root security descriptor

2022-May-17

2299

CVE-2022-35768

Windows Kernel multiple memory problems when handling incorrectly formatted security descriptors in registry hives

2022-May-20

2318

CVE-2022-37956

Windows Kernel integer overflows in registry subkey lists leading to memory corruption

2022-Jun-22

2022-Sep-13

2330

CVE-2022-37988

Windows Kernel registry use-after-free due to bad handling of failed reallocations under memory pressure

2022-Jul-8

2022-Oct-11

2332

CVE-2022-38037

Windows Kernel memory corruption due to type confusion of subkey index leaves in registry hives

2022-Jul-11

2341

CVE-2022-37990

Windows Kernel multiple memory corruption issues when operating on very long registry paths

2022-Aug-3

CVE-2022-38039

CVE-2022-38038

2344

CVE-2022-37991

Windows Kernel out-of-bounds reads and other issues when operating on long registry key and value names

2022-Aug-5

2359

CVE-2022-44683

Windows Kernel use-after-free due to bad handling of predefined keys in NtNotifyChangeMultipleKeys

2022-Sep-22

2022-Dec-13

2366

CVE-2023-21675

Windows Kernel memory corruption due to insufficient handling of predefined keys in registry virtualization

2022-Oct-6

2023-Jan-10

2369

CVE-2023-21747

Windows Kernel use-after-free due to dangling registry link node under paged pool memory pressure

2022-Oct-13

2389

CVE-2023-21748

Windows Kernel registry virtualization incompatible with transactions, leading to inconsistent hive state and memory corruption

2022-Nov-30

2375

Windows Kernel multiple issues in the key replication feature of registry virtualization

2022-Oct-25

CVE-2023-21772

CVE-2023-21773

CVE-2023-21774

2378

CVE-2023-21749

Windows Kernel registry SID table poisoning leading to bad locking and other issues

2022-Oct-31

CVE-2023-21776

2379

CVE-2023-21750

Windows Kernel allows deletion of keys in virtualizable hives with KEY_READ and KEY_SET_VALUE access rights

2022-Nov-2

2392

CVE-2023-23420

Windows Kernel multiple issues with subkeys of transactionally renamed registry keys

2022-Dec-7

2023-Mar-14

2408

Windows Kernel insufficient validation of new registry key names in transacted NtRenameKey

2023-Jan-13

2394

CVE-2023-23421

Windows Kernel multiple issues in the prepare/commit phase of a transactional registry key rename

2022-Dec-14

CVE-2023-23422

CVE-2023-23423

2410

CVE-2023-28248

Windows Kernel CmpCleanupLightWeightPrepare registry security descriptor refcount leak leading to UAF

2023-Jan-19

2023-Apr-11

2418

CVE-2023-28271

Windows Kernel disclosure of kernel pointers and uninitialized memory through registry KTM transaction log files

2023-Jan-31

2419

CVE-2023-28272

Windows Kernel out-of-bounds reads when operating on invalid registry paths in CmpDoReDoCreateKey/CmpDoReOpenTransKey

2023-Feb-2

CVE-2023-28293

2433

CVE-2023-32019

Windows Kernel KTM registry transactions may have non-atomic outcomes

2023-Mar-7

2023-Jun-13

2445

CVE-2023-35356

Windows Kernel arbitrary read by accessing predefined keys through differencing hives

2023-Apr-19

2023-Jul-11

2452

Windows Kernel CmDeleteLayeredKey may delete predefined tombstone keys, leading to security descriptor UAF

2023-May-10

2446

CVE-2023-35357

Windows Kernel may reference unbacked layered keys through registry virtualization

2023-Apr-20

2447

CVE-2023-35358

Windows Kernel may reference rolled-back transacted keys through differencing hives

2023-Apr-27

2449

CVE-2023-35382

Windows Kernel renaming layered keys doesn't reference count security descriptors, leading to UAF

2023-May-2

2023-Aug-8

2454

CVE-2023-35386

Windows Kernel out-of-bounds reads due to an integer overflow in registry .LOG file parsing

2023-May-15

2456

CVE-2023-38154

Windows Kernel partial success of registry hive log recovery may lead to inconsistent state and memory corruption

2023-May-22

2457

CVE-2023-38139

Windows Kernel doesn't reset security cache during self-healing, leading to refcount overflow and UAF

2023-May-31

2023-Sep-12

2462

CVE-2023-38141

Windows Kernel passes user-mode pointers to registry callbacks, leading to race conditions and memory corruption

2023-Jun-26

2463

CVE-2023-38140

Windows Kernel paged pool memory disclosure in VrpPostEnumerateKey

2023-Jun-27

2464

CVE-2023-36803

Windows Kernel out-of-bounds reads and paged pool memory disclosure in VrpUpdateKeyInformation

2023-Jun-27

2466

CVE-2023-36576

Windows Kernel containerized registry escape through integer overflows in VrpBuildKeyPath and other weaknesses

2023-Jul-7

2023-Oct-10

2479

CVE-2023-36404

Windows Kernel time-of-check/time-of-use issue in verifying layered key security may lead to information disclosure from privileged registry keys

2023-Aug-10

2023-Nov-14

2480

CVE-2023-36403

Windows Kernel bad locking in registry virtualization leads to race conditions

2023-Aug-22

2492

CVE-2023-35633

Windows registry predefined keys may lead to confused deputy problems and local privilege escalation

2023-Oct-6

2023-Dec-12

2511

CVE-2024-26182

Windows Kernel subkey list use-after-free due to mishandling of partial success in CmpAddSubKeyEx

2023-Dec-13

2024-Mar-12

None (MSRC-84131)

CVE-2024-26174

Windows Kernel out-of-bounds read of key node security in CmpValidateHiveSecurityDescriptors when loading corrupted hives

2023-Nov-29

None (MSRC-84149)

CVE-2024-26176

Windows Kernel out-of-bounds read when validating symbolic links in CmpCheckValueList

2023-Nov-29

None (MSRC-84046)

CVE-2024-26173

Windows Kernel allows the creation of stable subkeys under volatile keys via registry transactions

2023-Nov-30

None (MSRC-84228)

CVE-2024-26177

Windows Kernel unsafe behavior in CmpUndoDeleteKeyForTrans when transactionally re-creating registry keys

2023-Dec-1

None (MSRC-84237)

CVE-2024-26178

Windows Kernel security descriptor linked list confusion in CmpLightWeightPrepareSetSecDescUoW

2023-Dec-1

None (MSRC-84263)

CVE-2024-26181

Windows Kernel registry quota exhaustion may lead to permanent corruption of the SAM database

2023-Dec-11

Exploitability

Software bugs are typically only interesting to either the offensive/defensive sides of the security community if they have practical security implications. Unfortunately, it is impossible to give a blanket statement regarding the exploitability of all registry-related vulnerabilities due to their sheer diversity on a number of levels:

  • Affected platforms: Windows 10, Windows 11, various Windows Server versions (32/64-bit)
  • Attack targets: the kernel itself, drivers implementing registry callbacks, privileged user-mode applications/services
  • Entry points: direct registry operations, hive loading, transaction log recovery
  • End results: memory corruption, broken security guarantees, broken API contracts, memory/pointer disclosure, out-of-bounds reads, invalid/controlled cell index accesses
  • Root cause of issues: C-specific, logic errors, bad reference counting, locking problems
  • Nature of memory corruption: temporal (use-after-free), spatial (buffer overflows)
  • Types of corrupted memory: kernel pools, hive data
  • Exploitation time: instant, up to several hours

As we can see, there are multiple factors at play that determine how the bugs came to be and what state they leave the system in after being triggered. However, to get a better understanding of the impact of the findings, I have performed a cursory analysis of the exploitability of each bug, trying to classify it as either "easy", "moderate" or "hard" to exploit according to my current knowledge and experience (this is of course highly subjective). The proportions of these exploitability ratings are shown in the chart below:

A histogram showing the difficulty of exploitability for the registry issues: 18 were considered easy to exploit, 10 considered moderate and 22 considered hard

The ratings were largely based on the following considerations:

  • Hive-based memory corruption is generally considered easy to exploit, while pool-based memory corruption is considered moderate/hard depending on the specifics of the bug.
  • Triggering OOM-type conditions in the hive space is easy, but completely exhausting the kernel pools is more difficult and intrusive.
  • Logic bugs are typically easier and more reliable to exploit than memory corruption.
  • The kernel itself is typically easier to attack than other user-mode processes (system services etc.).
  • Direct information disclosure (leaking kernel pointers / uninitialized memory via various channels) is usually straightforward to exploit.
  • However, random out-of-bounds reads, as well as read access to invalid/controlled cell indexes is generally hard to do anything useful with.

Overall, it seems that more than half of the findings can be feasibly exploited for information disclosure or local privilege escalation (rated easy or moderate). What is more, many of them exhibit registry-specific bug classes which can enable particularly unique exploitation primitives. For example, hive-based memory corruption can be effectively transformed into both a KASLR bypass and a fully reliable arbitrary read/write capability, making it possible to use a single bug to compromise the kernel with a data-only attack. To demonstrate this, I have successfully developed exploits for CVE-2022-34707 and CVE-2023-23420. The outcome of running one of them to elevate privileges to SYSTEM on Windows 11 is shown on the screenshot below:

Screenshot of windows terminal showing successful exploitation for CVE-2022-34707 and CVE-2023-23420

Upcoming posts in this series will introduce you to the Windows registry as a system mechanism and as an attack surface, and will dive deeper into practical exploitation using hive memory corruption, out-of-bounds cell indexes and other amusing techniques. Stay tuned!

Read the whole story
Share this story
Delete

A Powerful Atlanta Movie Executive Praised for His Diversity Efforts Shared Racist, Antisemitic Sentiments in Texts

1 Share

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up for Dispatches, a newsletter that spotlights wrongdoing around the country, to receive our stories in your inbox every week.

When Ryan Millsap arrived in Atlanta from California a decade ago, the real estate investor set his sights on becoming a major player in Georgia’s booming film industry. In just a few years, he achieved that, opening a movie studio that attracted big-budget productions like “Venom,” Marvel’s alien villain, and “Lovecraft Country,” HBO’s fictional drama centered on the racial terror of Jim Crow America.

As he rose to prominence, Millsap cultivated important relationships with Black leaders and Jewish colleagues and won accolades for his commitment to diversity. But allegations brought by his former attorney present a starkly different picture. In private conversations, court documents allege, Millsap expressed racist and antisemitic views.

Various filings in an ongoing legal fight show Millsap, who is white, making derogatory comments regarding race and ethnicity, including complaints about “Fucking Black People” and “nasty Jews.”

“Ryan’s public persona is different from who he is,” John Da Grosa Smith, Millsap’s former attorney, alleges in one filing, adding: “Ryan works hard to mislead and hide the truth. And he is very good at it.”

Smith submitted troves of text messages between Millsap and his former girlfriend as evidence in two separate cases in Fulton County Superior Court. The messages, reviewed by ProPublica and The Atlanta Journal-Constitution, represent a fraction of the evidence in a complex, yearslong dispute centered on compensation for the work Smith performed for Millsap.

In response to a request for an interview about the text messages and related cases, Millsap wrote that this “sounds like a strange situation,” asking “how this came up” and requesting to review the material. After ProPublica and the AJC provided the material cited in this story, he did not respond to multiple requests for comment.

Many of the text messages filed with the court were sent in 2019, an important year for Millsap. He was planning an expansion of his Blackhall Studios that would nearly triple its soundstage space. Instead, Millsap ended up selling Blackhall, now called Shadowbox, for $120 million in 2021. The following year he announced plans to build a massive new complex in Newton County, about 40 miles east of Atlanta.

Smith started working for Millsap in August 2019, representing the film executive and his companies in a lawsuit brought by a business associate who claimed a stake in Blackhall. In May 2020, Smith became Blackhall Real Estate’s chief legal counsel.

Their relationship soured in early 2021. In the ensuing feud, Smith claimed that Millsap had promised him a third of his family company, as well as compensation for extra legal work — and, in a letter from his attorney, demanded that Millsap pay him $24 million within four business days: “We, however, have no interest in harming Mr. Millsap or disrupting his deal, his impending marriage, his future deals, or anything else.”

In the arbitration proceeding that followed, Millsap’s attorneys described the letter as “extortionate” and claimed that Smith was trying to “blow up” Millsap’s personal and business life and stall the sale of Blackhall Studios. “Smith breached the most sacred of bonds that exist between a lawyer and his or her clients: the duty of loyalty,” lawyers for Millsap later wrote.

In the same proceeding, Smith accused Millsap of firing him after he raised allegations of a hostile and discriminatory workplace, referencing Millsap’s text messages. Smith’s late father was Jewish.

In January 2023, an arbitrator sided with Millsap, ordering that Smith pay him and his companies $3.7 million for breach of contract and breach of fiduciary duty. She ruled that Smith’s conduct was “egregious and intended to inflict economic injury on his clients.”

Through his attorney, Smith declined to be interviewed. In response to a list of questions, he wrote, “This has been a tireless campaign of false narratives and retaliation against me for more than three years.” He claimed that his employment agreement with Millsap guaranteed him a cut of the profits he helped generate and that an expert estimated his share to be between $17 million and $39 million.

Even as Millsap won his legal fight with his former attorney, Smith has continued to press the court battle. In an April 2023 motion to vacate, Smith called the arbitration process a “sham” and the award a “fraud,” and he is now appealing a judge’s decision to uphold the award. In January, a lawyer for Smith filed hundreds of pages of Millsap’s texts in a separate legal dispute in which Millsap is not a party.

In a city with dominant Black representation and a significant Jewish population, maintaining a positive relationship with these communities — or at least the appearance of one — is essential to doing business.

“Mr. Millsap knows,” Smith alleged in one filing, “these text messages are perilous for him.”

On a Thursday night in January 2019, Millsap stood near the pulpit at Welcome Friend Baptist, a Black church 10 miles from downtown Atlanta in DeKalb County, near where he was planning the expansion of his movie studio.

Securing support from the community would be key in convincing the county commission to approve a land-swap deal that would be necessary for the expansion. Several commissioners saw the project, including Millsap’s promise to create thousands of jobs, as a way to revitalize the area.

Dozens of longtime residents, most of them Black, sat in the sanctuary’s colorful upholstered chairs. The attendees received information sheets on Blackhall’s plans, which cited $3.8 million in public improvements, including the creation of a new public park. They asked about internship opportunities for their children and restaurants Millsap might help bring.

Millsap raised the possibility of a restaurant, one he said could offer healthy meals. Several older Black women in the church nodded in agreement and one clapped, Millsap’s pitch seemingly helping him appeal to those whose buy-in he needed.

Two months later, Millsap sent his then-girlfriend a text that Smith’s lawyers later alleged shows he “laments his political work with African Americans and his distaste for having to do it.”

In the text exchange, which was filed in court, Millsap wrote: “Well, it’s like me w black people in ATL!! Bahahahahaha!! Political nonsense everywhere!! … I’m so ready to be finished w that.”

Messages sent between Ryan Millsap (green) and Christy Hockmeyer (blue) in 2019 (Screenshot from a court exhibit filed by John Da Grosa Smith’s attorney in January)

In another text filed in court, Millsap’s girlfriend alluded to the damage she’d caused another vehicle in a car accident: “So the black girl wants $2500 to fix her car on a quote that was $1800.” He responded that she should pay the woman rather than filing an insurance claim, adding, “Fucking Black People.”

Messages sent between Ryan Millsap (green) and Christy Hockmeyer (blue) in 2019 (Screenshot from a court exhibit filed by John Da Grosa Smith’s attorney in January)

Court records and Millsap’s own testimony show that his girlfriend at the time, Christy Hockmeyer, was an investor in his real estate company, and their text messages show she played an active role in his business dealings. In a filing that claims the company had a “hostile and discriminatory work environment,” Smith alleged that Blackhall Real Estate “through its CEO, Ryan Millsap, and one of its influential investors, Christy Hockmeyer, disfavors African- Americans and Jews.”

When Hockmeyer texted Millsap after a doctor’s visit, complaining that a nurse was “retarded,” Millsap responded: “Not shocked. Black or Asian?” Hockmeyer wrote back: “Black.” Millsap replied, “Yes.”

Messages sent between Ryan Millsap (green) and Christy Hockmeyer (blue) in 2019 (Screenshot from a court exhibit filed by John Da Grosa Smith’s attorney in January)

In other exchanges filed with the court, Hockmeyer complained to Millsap, “My uber driver smells like a black person. Yuck!” He echoed her sentiment, writing back, “Yuck!” While on a flight, Hockmeyer wrote to Millsap that a “large smelly black man is seated next to me.” Millsap wrote back, “Yucko!!”

And while passing through an airport in France, Millsap texted Hockmeyer, “The smells here are unreal” and “I can't even imagine if your sensitive nose was here!!”

Hockmeyer responded, “I am so self conscious about bodily smells because there is nothing worse. I mean. Makes you dread it when you see a black person.”

Messages sent between Ryan Millsap (green) and Christy Hockmeyer (blue) in 2019 (Screenshot from a court exhibit filed by John Da Grosa Smith’s attorney in January)

Smith alleged that the conversations between Millsap and Hockmeyer reveal how they think about people with whom they conduct business. “The insidious belief that ‘black’ people are beneath them and not worthy of being hired is a theme that persists in their private writings to one another,” Smith said in the filing.

At a time in 2019 when Millsap was looking to hire an executive with a track record in the Atlanta film industry, Hockmeyer texted him that he might consider bringing on someone from Tyler Perry Studios, a 12-stage southwest Atlanta lot named after its founder, one of the highest-profile Black film producers in the country. “And taking someone from Tyler Perry would be fine too,” she wrote in a text exchange filed with the court. “As long as they are white.”

She also offered another name for Millsap to consider, adding: “He’s even a Jew. That’s good for this role.” Millsap responded, “Teeny tiniest Jew.”

On another occasion, Hockmeyer “opined that Anglo-Americans do not do business with Jewish people,” Smith alleged in a court filing, referencing a text message exchange in which she wrote to Millsap: “You know why wasps won’t do deals with Jews? Because they know that Jews have a different play book and they might get screwed.” Smith also claimed in a court filing that Millsap described to Hockmeyer “a terrible meeting with one of the most nasty Jews I’ve ever encountered.”

In an email to ProPublica and the AJC, Hockmeyer wrote: “I severed all personal and professional ties with Mr. Millsap years ago because our values, ethics, and beliefs did not align. As a passive investor in Blackhall, I was not involved in the day-to-day operations of the company, nor have I been party to any of the lawsuits involving Blackhall. I consistently encouraged Mr. Millsap to treat his investors and community supporters with fairness and respect.”

In a subsequent email, she apologized for the texts between her and Millsap. “There were times when I may have become angry or emotional and tacitly acknowledged statements he made or said things that do not reflect my values or beliefs, and I deeply regret that,” she wrote, adding: “I made comments and used language that was inappropriate. I referred to people in ways I shouldn’t have. I’m sincerely sorry for what I said. Those comments do not reflect who I am and I disavow racism and antisemitism as a whole.”

Smith claimed in a court filing that Millsap regularly expressed disrespect toward Jewish people, describing three of his Jewish colleagues and investors as “the Jew crew,” calling one of them “a greedy Israelite” and saying another had “Jew jitsued” him. Millsap concluded, according to Smith, that “no friendship comes before money in that tribe.”

During the arbitration, Millsap testified in August 2022 that his remarks about people of the Jewish faith constituted “locker room talk.”

In December 2019, Millsap received several warnings from Hockmeyer, according to arbitration records that highlight excerpts from some of her text messages. (Other exhibits in the case show the couple’s relationship had become strained around that time.)

“Ryan you have to understand why people are over your bulls**t,” she wrote that month, according to the records. “They feel lied to taken advantage of and stolen from.”

The following month, she wrote: “Wow. You are going to get lit the f**k up. Holy s**t you are such a bad person. You are a f**king crook!”

During the arbitration hearing, one of Smith’s attorneys asked Millsap about some of Hockmeyer’s December 2019 warnings. He responded, “These are the text messages of a very angry ex-girlfriend.”

As Smith began taking on more responsibility for his client in 2020, Millsap continued to connect with Black influencers and cement himself as a cultural force in Atlanta.

In December of that year, Millsap was a guest on an episode of actor and rapper T.I.’s “Expeditiously” podcast. After discussing the differences between the Atlanta and Los Angeles entertainment markets, Millsap praised what he called “a very robust, Black creative vortex” in Atlanta. And he went on to offer more praise. “There seems like a particular magic in Atlanta about being Black.”

He also talked about his studio expansion plans amid the land-swap deal in a majority-Black DeKalb County neighborhood, telling T.I., “It’s been a fascinating study in race actually.”

Millsap went on to explain how his business interests aligned with the desires of residents. “What pushed this through was Black commissioners supporting their Black residents who wanted to see this happen, right?” he said. “They’re fighting against one white commissioner and a lot of her white constituents who took it upon themselves to be against this when they’re not even the residents who live nearby.”

One evening in August 2021, Millsap stepped onto the stage at the Coca-Cola Roxy theater in Cobb County. He and a dozen other people had been named the year’s Most Admired CEOs, an honor awarded by the Atlanta Business Chronicle. The CEO’s were recognized for, among other things, their “commitment to diversity in the workplace.”

As the dispute between Smith and Millsap unfolded, Millsap expanded his business interests to Newton County, where he purchased a $14 million, 1,500-acre lot in 2022. He said at the time that his vision is to make Georgia a “King Kong of entertainment” by building a production complex on the site and launching a streaming service that, in his words, would be “something on the scale of Netflix.” He later invested in a vodka brand with the aim, he said, of it becoming “quintessentially” Georgia, “like Coca-Cola and Delta.”

Earlier this year, Millsap sat down in his stately home office, decorated with Atlanta-centric trinkets like a model Delta plane, to record an episode of his “Blackhall Podcast with Ryan Millsap.” T.I. has been a guest, as have Isaac Hayes III, son of the iconic soul singer Isaac Hayes and a social media startup founder, and Speech, the frontman for the Atlanta-based, Grammy-winning musical act Arrested Development.

On this day, Millsap talked about race and culture, pointing out that one of his best friends is a “Persian Jew in LA.”

Millsap noted that his understanding of “Black and white” was formed on the West Coast, where he had “a lot of Black friends” — “very Caucasian Black people” who had adopted white cultural norms.

“I grew up thinking like I had no racial prejudice of any kind,” Millsap said. “I thought we were beyond all that stuff.”

Rosie Manins of The Atlanta Journal-Constitution contributed reporting.

Read the whole story
Share this story
Delete

The Open Source Problem

1 Share

People are having a big freakout about the Jia Tan user and I want to throw a little napalm on that kitchen fire by showing ya'll what the open source community looks like when you filter it for people with the same basic signature as Jia Tan. The summary here is: You have software on your machine right now that is running code from one of many similar "suspicious" accounts. 

We can run a simple scan for "Jia-Tans" with a test Reagent database and a few Cypher queries, the first on just looking at the top 5000 Pip packages for:

  • anyone who has commit access
  • is in Timezone 8 (mostly China)
  • has an email that matches the simple regular expression the Jia Tan team used for their email (a Gmail with name+number):

MATCH path=(p:Pip)<-[:PARENT]-(r:Repo)<-[:COMMITTER_IN]-(u:User) WHERE u.email_address =~ '^[a-zA-Z]+[0-9]+@gmail\\.com$' AND u.tz_guess = 8 RETURN path LIMIT 5000

This gets us a little graph with 310 Pip packages selected:

So many potential targets, so little time

One of my favorites is that Pip itself has a matching contributor: <a href="mailto:meowmeowcat1211@gmail.com">meowmeowcat1211@gmail.com</a>

I'm sure whoever meowmeowcat is did a great job editing Pip.py

Almost every package of importance has a user that matches our suspicious criteria. And of course, your problems just start there when you look at the magnitude of these packages. 

I didn't scroll all the way down, but you can imagine how long this list is.

You can also look for matching Jia Tan-like Users who own (as opposed to just commit into) pip packages in the top 5000:


MATCH path=(u:User)-[:PARENT]->(p:Pip)<-[:PARENT]-(r:Repo)
WHERE u.tz_guess = 8
AND u.email_address =~ '^[a-zA-Z]+[0-9]+@gmail\\.com$'
RETURN path
ORDER BY r.pagerank DESC

Ok, there's not as many (less than 100), but some of these might be interesting given they are in the top 5000.

Pip packages can require other pip packages to be installed, and you also want to look at that entire chain of dependencies when looking at your risk profile. Reagent allows you to do this with a simple query. Below you can see the popular diffusers tool and scipy packages require pip packages that match "dangerous" users. In the scipy case, this is only if you install it as a dev. But nonetheless, this is interesting.

MATCH path=(u:User)-[:PARENT]->(p:Pip)<-[:REQUIRES]-(p2:Pip)<-[:PARENT]-(r:Repo) 

WHERE u.tz_guess = 8

AND u.email_address =~ '^[a-zA-Z]+[0-9]+@gmail\\.com$'

RETURN path

On the other hand, many people don't care about the particular regular expression that matches emails. What if we broadened it out to all Chinese owners of a top5000 Pip packages with either Gmail or <a href="http://QQ.com" rel="nofollow">QQ.com</a> addresses and all the packages that rely on them. We sort by pagerank for shock value.

For customers that want to cut and paste into their DB:
MATCH path=(u:User)-[:PARENT]->(p:Pip)<-[:REQUIRES*..5]-(p2:Pip)<-[:PARENT]-(r:Repo)

WHERE u.tz_guess = 8

  AND ALL(rel IN relationships(path) WHERE rel.marker IS NULL)

  AND (u.email_address CONTAINS "gmail.com" OR u.email_address CONTAINS "qq.com")

RETURN p2.name, r.pagerank

ORDER BY r.pagerank DESC

Don't run Ansible, I guess?

One of the unique things about Reagent is we can say if a contributor is actually a maintainer, using some graph theory that we've gone into in depth in other posts. This is the query you could use:

MATCH path=(u:User)-[:MAINTAINS]->(c:Community)<-[:HAS_COMMUNITY]-(r:Repo)-[:PARENT]->(p:Pip)   

 WHERE u.tz_guess = 8

 AND u.email_address =~ '^[a-zA-Z]+[0-9]+@gmail\\.com$'

RETURN path LIMIT 15

As you can see, there are quite a few Pip packages where at least one maintainer (by our own definition) has been or currently is in the "Jin Tan"-style format.

Ok, so that's the tip of the iceberg! We didn't go over using HIBP as a verification on emails, or looking at any time data at all or commit frequencies or commit message content or anything like that. And of course, we also support NPM and Deb packages, and just Git repos in general. Perhaps in the next blog post we will pull the thread further. 

Also: I want to thank the DARPA SocialCyber program for sponsoring this work! Definitely thinking ahead! 

Read the whole story
Share this story
Delete
Next Page of Stories