10 ms·
HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10
- woliveirajr 5y ago> There’s no patches, it’s a zero day. Seems that MS just released articles on how to prevent it but no update/patch. Perhaps it's hard to fix, i.e., too many things on windows rely on it?
- withinboredom 5y agoOr perhaps, once someone installs untrusted software in the first place, you’re screwed anyway? This is security 101. AFAIK, you can login as a local admin since forever and it’s never been fixed. I just used it recently to access a deceased relative’s computer.
- user-the-name 5y agoEvery computer spends pretty much every hour of every day running untrusted software. There is nothing more common than running untrusted software. This kind of attitude is completely useless.
- withinboredom 5y agoI wasn’t being literal. To clarify, I meant some random person installing some random software without your knowledge type of untrusted software.
- selfhoster11 5y agoAKA JavaScript on websites? Sure, it's sandboxed to the Moon, but it's still random people "installing" software on your computer.
- deleted 5y ago[deleted]
- londons_explore 5y agoI was surprised to find that a modern windows 10 machine (with all default security options) could have the user password bypassed easily with a Windows setup USB. I could then read all the user's documents. I thought the point of disk encryption and secure boot was to prevent that. Yet somehow the hole of allowing Windows setup to give you a privileged command prompt with a decrypted disk was never closed...
- coliveira 5y agoI guess Windows administrators rely on this. If they close this issue, there will be a huge list of complains that they don't want to deal with.
- withinboredom 5y agoThis is true of just about any OS though. Linux and OSX has/had single user mode, for example.
- IggleSniggle 5y agoI don’t understand. What’s the point of having an encrypted disk if it can be decrypted by any old USB-loaded OS?
- selfhoster11 5y agoA user password doesn't enable encryption. Bitlocker or another Full Disk Encryption solution is what you would want to use. If you can see the data, that means it's not encrypted.
- IggleSniggle 5y agoBut doesn’t Windows 10 ship with device encryption? Ie full disk encryption? I thought that’s exactly what this was, which is what I’m not understanding. How can you see data if the device is encrypted?
- ptx 5y agoIf all the OS security measures are useless in the face of untrusted software, why were they introduced? Should we just run Windows 98 and FAT32 on our servers since it's apparently basic security knowledge that Windows NT's system of user accounts and permissions doesn't work?
- wongarsu 5y agoWindows is a multiuser system and tries to give you a reliable security barrier between two (non-admin) users. And at least since Windows Vista it puts some effort into preventing non-elevated software from gaining admin rights, limiting the amount of damage it can do somewhat. Of course in reality installing any untrusted software on a computer that's not airgapped from everything you care about isn't safe. But that doesn't mean we shouldn't at least try to give better security guarantees.
- bottled_poe 5y agoMy first thought too. Too many layers upon layers of technical debt to deploy a timely patch.
- alphadenied 5y agoSo one of the most wonderful things about relying on their proprietary closed source operating system is that you can't have external code audits. You just kind of wait for ethical people to come forward and explain bugs they've found and wonder, 1, how long has it been there, 2, how long have bad actors known about this, 3, how many other bugs are just like this or worse that they haven't found yet, 4, do I need to recreate VM images or can I trust the internal patch process to get it installed before I've been exploited, 5, does the patch actually fix the underlying security flaw or is it something they're calling a "feature" now that will always be an issue... I'm so grateful to not be a janitor for Microsoft Windows software anymore.
- codetrotter 5y agoMicrosoft Windows is proprietary software yes, but they have something called the Shared Source Initiative. > Through the Shared Source Initiative Microsoft licenses product source code to qualified customers, enterprises, governments, and partners for debugging and reference purposes. https://www.microsoft.com/en-us/sharedsource/ https://www.microsoft.com/en-us/sharedsource/ I say this as someone who doesn’t like Windows and doesn’t run Windows. We still need to admit that Microsoft does indeed let others read the source code, only that they decide who gets to read it and not.
- coliveira 5y agoThe key question is: would they let people who want to find bugs? Because that is the point here, if you can read the software but not allowed to do an audit, it doesn't make any difference (for the issue that we're discussing).
- codetrotter 5y agoSee for example the Enterprise Source Licensing Program page https://www.microsoft.com/en-us/sharedsource/enterprise-source-licensing-program.aspx https://www.microsoft.com/en-us/sharedsource/enterprise-sour... Allowed purposes for said licensing program includes “performing internal security audits of the Microsoft Windows operating system”.
- jaclaz 5y agoPossibly I am missing something, but the use of volume shadow copies or direct (RAW) disk access to retrieve particular files that are "in use" is a long time established possibility. Extents and Rawcopy were initially written several years ago: http://reboot.pro/files/file/316-extents/ http://reboot.pro/files/file/316-extents/ https://github.com/jschicht/RawCopy https://github.com/jschicht/RawCopy Or is there something new specific to Windows 10?
- praseodym 5y agoThe vulnerability here is that regular non-administrator users can also read sensitive registry hives from the shadow copy. This allows for local privilege escalation exploits.
- jaclaz 5y agoI see, thanks, I never tested the mentioned programs as a non-Admin user, though the mechanism (if the shadow copies are used) is seemingly the same, so if the BUILTIN/USERS are authorized, they may work as well (and not only on Windows 10).
- jesboat 5y agoI guess one way to phrase it would be "the ACLs on the registry files were always overly permissive, but nobody noticed until now because trying to read them the obvious way failed with 'file in use'"
- denton-scratch 5y agoNot willing to "sign in with Google". Didn't read (just the comments).
- 1023bytes 5y agohttps://archive.is/gn2Gj https://archive.is/gn2Gj
- nullwarp 5y agoWhat is up with Medium requiring a google or facebook account to read posts now?
- gogopuppygogo 5y agoThey need to make money. I guess they gave up on advertising directly and instead want to capture our info alongside what we read on the website to build profiles they can sell to marketers.
- technion 5y agoYou appear to be able to bypass it by opening the page in incognito mode. It does leave me more likely to skip content I find on medium - this particular blog has the type of content that would make it a rare exception.
- Superblazer 5y agoCheckout medium unlimited extension
- throwaway09223 5y agoI have the same strong feelings about walled sites and tracking. May I recommend installing an extension to disable paywalls/tracking? Something like https://github.com/iamadamdev/bypass-paywalls-chrome https://github.com/iamadamdev/bypass-paywalls-chrome (supports firefox despite the project name) which automatically wipes cookies from sites like Medium which enable "sign on" requirements after so many visits. It really improves the browsing experience. I used to open these sites incognito or delete the cookies manually but it's really such an annoyance. Better to automate the policy of disallowing these folks to store cookies.
- notorandit 5y agoIt's not a bug! It's clearly a feature!
- nickdothutton 5y agoAn operating system can never fully escape its heritage.
- altharaz 5y agoTL;DR: Some Windows configuration have bad permissions on their SAM database. If a standard user has access to shadow copies (VSS), this can lead to privilege escalation. Microsoft recommends to [1]: 1) Restrict access to the contents of %windir%\system32\config: - Command Prompt (Run as administrator): icacls %windir%\system32\config*.* /inheritance:e - Windows PowerShell (Run as administrator): icacls $env:windir\system32\config*.* /inheritance:e 2) Delete Volume Shadow Copy Service (VSS) shadow copies: - Delete any System Restore points and Shadow volumes that existed prior to restricting access to %windir%\system32\config. - Create a new System Restore point (if desired). -- Also, please note that some authorities seem to adress this subject carefully. The French national cybersecurity agency (ANSSI) has for instance published a News bulletin [2] but no "real" Security bulletin of this vulnerability [3]. In its News bulletin, the ANSSI specifies that it also affects Windows Vista RTM :). However, the ANSSI also says that deleting VSS entries (step 2 of Microsoft recommendations) "must be decided after evaluating the advantages and disadvantages with regard to the risks, in particular because there may be other possibilities for privilege escalation depending on the level of security of your information system." [1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... [2] https://www.cert.ssi.gouv.fr/actualite/CERTFR-2021-ACT-031/ https://www.cert.ssi.gouv.fr/actualite/CERTFR-2021-ACT-031/ [3] https://www.cert.ssi.gouv.fr/alerte/ https://www.cert.ssi.gouv.fr/alerte/
- bob1029 5y agoI am legitimately not sure if this is a bug or a feature. I'll take all the side-channels I can get though. These "exploits" are really useful for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install.
- majkinetor 5y agoYeah, it was the only way to remove defender. Then I used debloaters and shutup10 to remove all other "features". Windows didn't like it and returned ALL of them on update. Now I disabled update, and are totally motivated to go back to linux. Luckily all the tools I use on Windows are x-platform and with PowerShell, vscode, sql server etc. on linux and games working nothing holds me any more. I will probably miss Autohotkey and Foobar2k (maybe total commander but Dobulecmd is decent alternative and much better in some domains).
- gruez 5y ago>Yeah, it was the only way to remove defender Why not just disable it using group policy?
- malwarebytess 5y agoBecause he wants to removed unwanted software from his machine, not disable it. It's not dissimilar to being unable to remove bundled software on android.
- gruez 5y agoWhat's the difference, that you save 200MB of disk space? >It's not dissimilar to being unable to remove bundled software on android. It actually makes less sense on android since bundled apps are typically installed on the /system partition, which means they don't really take up any disk space (the space allocated to the /system partition is the same regardless of whether the app is there or not).
- 5y ago
- rwmj 5y agoIt amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux (https://github.com/libguestfs/hivex https://github.com/libguestfs/hivex) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-the-windows-registry-sucks-technically/ https://rwmj.wordpress.com/2010/02/18/why-the-windows-regist...
- Randor 5y agoHi, Actually you can use the Windows Projected File System to project the registry into the file system, making registry keys and values appear as files and directories. https://github.com/Microsoft/Windows-classic-samples/tree/master/Samples/ProjectedFileSystem https://github.com/Microsoft/Windows-classic-samples/tree/ma...
- ape4 5y agoI imagine that the registry is optimized for many small values (eg a DWORD - 4 bytes). Most filesystems wouldn't be very efficient with tons of 4 byte files.
- throwaway09223 5y agoA registryfs would be. The data structures underpinning access would not need to change. The importance of using a filesystem interface is reuse of the access control mechanisms and filesystem API. It would avoid the type of bug above, due to nesting a hierarchical permissioned structure inside a file.
- Asooka 5y agoI am confused how having read access to the registry allows local privilege escalation. As a Linux user, having read access to the registry sounds like having read access to /etc, which every user already has. What sensitive data is stored in SAM that allows that?
- cjones26 5y agoAgreed. The article also does not seem to explain it. From what I understood the SAM only stores encrypted password hashes, nothing that could be readily exploited for local privilege escalation.
- jesboat 5y agoThere's a video (bleh) which appears to extract the hash and then use a pass-the-hash. I'm not clear on exactly what the preconditions are (are NTLMv1/v2 hashes still stored by default? Does PTH work with newer hashes? Etc) or if there's another way to escalate
- aj3 5y agoPassword hashes. /etc/shadow isn’t world readable in Linux dither
- ylyn 5y agoIt seems like there are some cases where Windows accepts a password hash for authentication as a user though. So by having the hash of an administrator, you can escalate privileges. I don't think there are such cases in Linux.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- tyingq 5y agoI thought there was also a way to schedule a copy of a file at boot time...something that installers use to copy/delete locked files.
- bencollier49 5y agoPaywalled. I don't understand why people published to Medium.
- bitwize 5y ago"To keep reading this story, get the free app or log in." FUCK. YOU. Remember when people just published informative and thoughtful stuff online without expecting monetization? Yeah, I and Pepperidge Farm remember, but it seems to have become a lost art. It's worth it to forgo this article, no matter how interesting it seemed to me, to encourage the author and others to publish their blogs to be readable by all.
- grayhatter 5y agoFirst commit was 5 days ago. july 15 which wasn't patch Tuesday... Which means it wasn't an 0day... Stop getting this wrong!