Windows 10: Vulnerability hunting with Semmle QL, part 2

Brink · Mar 19, 2019

The first part of this series introduced Semmle QL, and how the Microsoft Security Response Center (MSRC) are using it to investigate variants of vulnerabilities reported to us. This post discusses an example of how we’ve been using it proactively, covering a security audit of an Azure firmware component.

This was part of a wider defense in depth security review of Azure services, exploring attack vectors from the point of view of a hypothetical adversary who has already penetrated at least one security boundary, and now sits in the operating environment of a service backend (marked with * on the diagram below).

One of the targets of this review was a Linux-based embedded device that interfaces both with a service backend and a management backend, passing operational data between the two. The main attack surface of this device is a management protocol used on both interfaces.

An initial manual review of its firmware indicated that this management protocol is message-based, and there are over four hundred different message types, each with their own handler function. Manually auditing every single function would have been tedious and error-prone, so using Semmle to scale up our code review capabilities was an easy choice. We found 33 vulnerable message handler functions in total, using the static analysis techniques discussed in this post...
Click to expand...

Read more: Vulnerability hunting with Semmle QL, part 2 Defense

Tweet

— Twitter API (@User) View on Twiiter

:)

Brink · Mar 19, 2019

Vulnerability hunting with Semmle QL, part 1

Previously on this blog, we’ve talked about how MSRC automates the root cause analysis of vulnerabilities reported and found. After doing this, our next step is variant analysis: finding and investigating any variants of the vulnerability. It’s important that we find all such variants and patch them simultaneously, otherwise we bear the risk of these being exploited in the wild. In this post, I’d like to explain the automation we use in variant finding.

For the past year or so, we’ve been augmenting our manual code review processes with Semmle, a third-party static analysis environment. It compiles code to a relational database (the snapshot database – a combination of database and source code), which is queried using Semmle QL, a declarative, object-oriented query language designed for program analysis.

The basic workflow is that, after root cause analysis, we write queries to find code patterns that are semantically similar to the original vulnerability. Any results are triaged as usual and provided to our engineering teams for a fix to be developed. Also, the queries are placed in a central repository to be re-run periodically by MSRC and other security teams. This way, we can scale our variant finding over time and across multiple codebases.

In addition to variant analysis, we’ve been using QL proactively, in our security reviews of source code. This will be the topic of a future blog post. For now, let’s look at some real-world examples inspired by MSRC cases...
Click to expand...

Read more: https://blogs.technet.microsoft.com/...mle-ql-part-1/

MarGal1 · Mar 19, 2019

Microsoft Treasure Hunt

Hi ,

A corrupted profile is one of the potential reasons you're having issue playing the game Microsoft Treasure Hunt specifically resetting your game weapon. To help you resolve this concern, I suggest that you perform the steps below:

Step 1: Run the troubleshooter for Windows apps using the link below. This can help remove problems with an app from Microsoft Store.

Click here

Step 2: Check for updates for apps and games from Windows Store. Kindly click the link below to proceed:

Check for updates for apps and games from Windows Store

Step 3: Delete Temporary files. This will help delete temporary files that have been stored on your computer.

Click Start and click Settings.

Select System.

Select Storage.

Select This PC.

Click Temporary files.

Choose Temporary files.

Click Remove files.

Step 4: Reset the game from the Settings menu.

Click Start and click Settings.

Select System.

Select Apps and features.

Find the game and click Advanced options.

Click Reset. You need to restart your computer to let the changes take effect.

Step 5: Try to uninstall and reinstall the game.

Kindly update us with the results.
Click to expand...

In step 4, under System I do not find Apps and features. I have done the other steps. Marlene

Wilfred Mac · Mar 19, 2019

Microsoft Treasure Hunt

Hi MarGal1,

A corrupted profile is one of the potential reasons you're having issue playing the game Microsoft Treasure Hunt specifically resetting your game weapon. To help you resolve this concern, I suggest that you perform the steps below:

Step 1: Run the troubleshooter for Windows apps using the link below. This can help remove problems with an app from Microsoft Store.

Click here

Step 2: Check for updates for apps and games from Windows Store. Kindly click the link below to proceed:

Check for updates for apps and games from Windows Store

Step 3: Delete Temporary files. This will help delete temporary files that have been stored on your computer.

Click Start and click Settings.

Select System.

Select Storage.

Select This PC.

Click Temporary files.

Choose Temporary files.

Click Remove files.

Step 4: Reset the game from the Settings menu.

Click Start and click Settings.

Select System.

Select Apps and features.

Find the game and click Advanced options.

Click Reset. You need to restart your computer to let the changes take effect.

Step 5: Try to uninstall and reinstall the game.

Kindly update us with the results.

Windows 10: Vulnerability hunting with Semmle QL, part 2

Vulnerability hunting with Semmle QL, part 2

Vulnerability hunting with Semmle QL, part 2

Vulnerability hunting with Semmle QL, part 2

Vulnerability hunting with Semmle QL, part 2 - Similar Threads - Vulnerability hunting Semmle

Back UP Part 2

Back UP Part 2

Back UP Part 2

Mouse problems part 2

Update part 2

Treasure Hunt

Reinstalling Windows (part 2)

DVD ISSUE PART 2

Vulnerability hunting with Semmle QL, part 1