Live data from Hacker News

Windows 10 in-place upgrades are a severe security risk

blog.win-fu.com

31–40 of 124 posts

Re: Windows 10 in-place upgrades are a severe security risk

#31
post #27

Is there not a presumption that with physical access to a machine it can be rooted if you try hard enough? I certainly make that presumption. The number of Macs I've unlocked by creating a new admin by removing the "install is finished" file in single user mode is in the teens.

If you have Bitlocker setup with TPM and PIN, you should be secure even from attackers with physical access.

Re: Windows 10 in-place upgrades are a severe security risk

#32
post #12

Earlier quoted context omitted.

In all seriousness, why is Fedora the mosts worthy Linux out of them all, in terms of privacy and security? I thought those two were kind of an inherent staple of all Linux distros? In the past I've used Debian Stable with AwesomeWM (the inspiration for Mjolnir) and it felt pretty secure?

I meant the hat not the distro. I use Ubuntu, I am happy with it. Before that used Debian and Slackware. Was happy with those too. Used it for 15 years. Can't complain. I don't feel my computing has been hurt by using Linux. And over time it seems as it's the only sane choice.

I misread your post too, but now it's clear on a reread that you meant the hat!

I am also a proud and happy Linux user going on about 10 years now, and what's great is that I know all the knowledge I've acquired will still be relevant many decades into the future -- not sure the same can be said of Windows or MacOS.

Re: Windows 10 in-place upgrades are a severe security risk

#33
What's the fix of it?

There must be an option to stop full automation of upgrade process or MS can just recommend disconnecting from network while upgrade is taking place.

MS does it for connivence I assume, so people aren't promoted while upgrade is taking place. This is my presumption, I may be wrong.

Re: Windows 10 in-place upgrades are a severe security risk

#34

Earlier quoted context omitted.

Although I think it's strange what they exclude. For example, they didn't include Calculator in Windows Server 2016 LTSB: http://www.zdnet.com/article/windows-server-2016-ltsb-whats-... Sure, maybe you wouldn't use it that much, but it's small and useful.

The Windows 10 Calculator is a Store app, and Server 2016 LTSB doesn't include Store apps. Therefore, Server 2016 LTSB doesn't have Calculator. While I guess they could bundle the Windows 7/8 Calculator with Server 2016, that would make server and desktop Windows different (for a feature that both include).

They don't even include the Edge browser on Windows 10 LTSB. That's ... strange. Edge has been out for like 18 months on Windows 10. They really seem to have taken out the whole UWP platform on LTSB, so we once again see that the whole "one Windows to rule them all" spiel is nothing but a nice marketing story Microsoft likes to tell its fans, but not as real as they might like it to be. Unfortunately this just means Internet Explorer will have to be supported that much longer by developers.

https://redmondmag.com/articles/2015/06/09/edge-windows-10-s...

http://www.techradar.com/news/software/microsoft-edge-s-ente...

Re: Windows 10 in-place upgrades are a severe security risk

#35
post #21
post #19

Earlier quoted context omitted.

>i only remove csript.exe and wscript.exe. You are no longer running Windows, you are running alien3d's-special-snowflake-version. Please don't be surprised when many third party programs/games no longer run, because, some of my software certainly won't.

We are dealing with this right now with our software. Our end users on Windows 7 who haven't kept their machine up to date can't install the VC++ 2015 redistributable which is required to run our software. It's a Microsoft problem but it's still frustrating having to do basic tech support for them just because they won't let Windows do the updates that it is insistently but politely asking them to let it do. Not a pr…

In my case it's because it get's stuck on and upgrade that won't install. The error messages are completely unhelpful, googling them doesn't help either.

Re: Windows 10 in-place upgrades are a severe security risk

#36
I don't know whether this works in newer versions of Windows, but it was extremely simple to elevate your priveleges on almost any Windows 7 machine. I've done this dozens of times.

I haven't used Windows for years now, so the details are a bit fuzzy, but it essentially worked like this:

Start the machine. During boot(when you see the orb splashscreen), turn off power or hold down the power button for a few seconds.

The next time you boot up the machine, windows will say it failed to boot and offer to go into startup repair. Do that, wait for some time, and click through until eventually you see a bug report that you can open up in notepad.

Once you are in notepad, open up the "open file" dialog. From there, navigate to "C:\Windows\System32" and replace "sethc.exe" with "cmd.exe". Now, reboot normally.

Once you reach the login screen, spam left shift until you get a command prompt with admin privileges. Now, you can create new users, change the password and privileges of existing users, or even start up explorer.exe and use the computer normally as admin, bypassing the login screen entirely.

This works because "sethc.exe" is the executable responsible for Sticky Keys, which is activated by pressing shift repeatedly. Instead of sethc.exe, now cmd.exe would be run instead.

Re: Windows 10 in-place upgrades are a severe security risk

#37
post #21
post #19

Earlier quoted context omitted.

>i only remove csript.exe and wscript.exe. You are no longer running Windows, you are running alien3d's-special-snowflake-version. Please don't be surprised when many third party programs/games no longer run, because, some of my software certainly won't.

We are dealing with this right now with our software. Our end users on Windows 7 who haven't kept their machine up to date can't install the VC++ 2015 redistributable which is required to run our software. It's a Microsoft problem but it's still frustrating having to do basic tech support for them just because they won't let Windows do the updates that it is insistently but politely asking them to let it do. Not a pr…

Does static linking msvcrt help this issue?

Re: Windows 10 in-place upgrades are a severe security risk

#38
post #36

I don't know whether this works in newer versions of Windows, but it was extremely simple to elevate your priveleges on almost any Windows 7 machine. I've done this dozens of times. I haven't used Windows for years now, so the details are a bit fuzzy, but it essentially worked like this: Start the machine. During boot(when you see the orb splashscreen), turn off power or hold down the power button for a few seconds.…

On BitLocker protected machines, you would need to provide the recovery key to unlock the disk and open any file.

Edit: To clarify why that isn't the case here, the Windows 10 upgrade process suspends BitLocker.

Re: Windows 10 in-place upgrades are a severe security risk

#39
post #36

I don't know whether this works in newer versions of Windows, but it was extremely simple to elevate your priveleges on almost any Windows 7 machine. I've done this dozens of times. I haven't used Windows for years now, so the details are a bit fuzzy, but it essentially worked like this: Start the machine. During boot(when you see the orb splashscreen), turn off power or hold down the power button for a few seconds.…

You're kidding, right? You can drop in any executable in place of sticky keys? And it runs with Administrator privileges? How does Microsoft own the enterprise and government spaces with glaring lack of basic security like this? :/

Re: Windows 10 in-place upgrades are a severe security risk

#40
post #27

Is there not a presumption that with physical access to a machine it can be rooted if you try hard enough? I certainly make that presumption. The number of Macs I've unlocked by creating a new admin by removing the "install is finished" file in single user mode is in the teens.

> The number of Macs I've unlocked by creating a new admin by removing the "install is finished" file in single user mode is in the teens.

What's the procedure, in case I need to unlock a mac someday?

Post reply on HN