Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows 10 in-place upgrades are a severe security risk

blog.win-fu.com

Post reply on HN
Print view View original

51–60 of 124 posts

Re: Windows 10 in-place upgrades are a severe security risk

#51

Post by Nullabillity »

developer2 wrote: post #39
wz1000 wrote: post #36

I don't know whether this works in newer versions of Windows, but it was extremely simple to elevate your priveleges on almost any Windows 7 machine. I've done this dozens of times. I haven't used Windows for years now, so the details are a bit fuzzy, but it essentially worked like this: Start the machine. During boot(when you see the orb splashscreen), turn off power or hold down the power button for a few seconds.…

You're kidding, right? You can drop in any executable in place of sticky keys? And it runs with Administrator privileges? How does Microsoft own the enterprise and government spaces with glaring lack of basic security like this? :/

Yup. You can also drop in any executable in place of the "accessibility center" which, of course, also runs as admin in the login/lock screens.

Re: Windows 10 in-place upgrades are a severe security risk

#52

Post by microtonal »

devoply wrote: post #7

Come join Linux my friends. My fedora hat wearing greybeards wait for you. Only operating system left that gives semblance of privacy and security. And to those who think I am derailing... http://news.softpedia.com/news/microsoft-wants-all-linux-dev...

Only operating system left that gives semblance of privacy and security.

You mean the operating system where with the default display server any application can read keystrokes, read mouse events, and make screen grabs of any other application? The operating system where no apps are sandboxed by default? The operating system where once you find a local root exploit, which are not rare, you can embed a root kit deep in the operating system?

Sorry for the harsh comment, but Linux is hardly the pinnacle of security. (Perhaps with rare exceptions like Qubes or RHEL with SELinux on servers.)

Re: Windows 10 in-place upgrades are a severe security risk

#53

Post by Nullabillity »

cm2187 wrote: post #48
derefr wrote: post #14

Earlier quoted context omitted.

Another common Raymond Chen reminder: "Local Administrator != Domain Administrator". If a user gains administrative privileges on their own machine as part of a corporate network, that just means they can bork their own machine and IT will have to come and take it for repair (and they'll likely be disciplined for doing stupid things against IT policy.) If becoming a local administrator on your own machine allows you…

Assuming all machines on the network do not have the same local admin password.

This is a privilege escalation bug that lets you reset the admin password, but it doesn't give you the old password.

Re: Windows 10 in-place upgrades are a severe security risk

#54

Post by alien3d »

mappu wrote: post #19
alien3d wrote: post #9

I'm disable windows update and windows background intelligent service . The most reason was windows keep re downloading broken update and cost a lot my broadband bandwidth. To secure my laptop, i only remove csript.exe and wscript.exe.

>i only remove csript.exe and wscript.exe. You are no longer running Windows, you are running alien3d's-special-snowflake-version. Please don't be surprised when many third party programs/games no longer run, because, some of my software certainly won't.

Most of the time not much issue.May i know why you need vbscript scripting?

Re: Windows 10 in-place upgrades are a severe security risk

#55

Post by erelde »

developer2 wrote: post #39
wz1000 wrote: post #36

I don't know whether this works in newer versions of Windows, but it was extremely simple to elevate your priveleges on almost any Windows 7 machine. I've done this dozens of times. I haven't used Windows for years now, so the details are a bit fuzzy, but it essentially worked like this: Start the machine. During boot(when you see the orb splashscreen), turn off power or hold down the power button for a few seconds.…

You're kidding, right? You can drop in any executable in place of sticky keys? And it runs with Administrator privileges? How does Microsoft own the enterprise and government spaces with glaring lack of basic security like this? :/

You can also drop (almost) any executable in place of explorer.exe, it's the basis of Windows Server "Core".

It has both good and bad sides, and the same (basic) thing is exploitable on linux. You can replace `cat` with another executable and change the PATH so that the new `cat` comes first.

   /tmp/cat
   PATH=/tmp:$PATH
edit: I'm aware that this does not give root privilege (though it could, through some SUID hack or cowroot or anything really), but it is the same basic "flaw". (again, though it isn't really a flaw)

Re: Windows 10 in-place upgrades are a severe security risk

#56

Post by mintplant »

developer2 wrote: post #39
wz1000 wrote: post #36

I don't know whether this works in newer versions of Windows, but it was extremely simple to elevate your priveleges on almost any Windows 7 machine. I've done this dozens of times. I haven't used Windows for years now, so the details are a bit fuzzy, but it essentially worked like this: Start the machine. During boot(when you see the orb splashscreen), turn off power or hold down the power button for a few seconds.…

You're kidding, right? You can drop in any executable in place of sticky keys? And it runs with Administrator privileges? How does Microsoft own the enterprise and government spaces with glaring lack of basic security like this? :/

As a kid I did this with magnify.exe to get around account time restrictions (hi, Dad). Enabling magnifier from the accessibility dialog on the login screen would pop open a command prompt running under the SYSTEM account. Punching in "explorer.exe" would get you a desktop.

Re: Windows 10 in-place upgrades are a severe security risk

#57

Post by _cmmn »

na85 wrote: post #26
type0 wrote: post #22

Earlier quoted context omitted.

Fedora 25 is best ever, you should try it. Now that then replaced X with Wayland it should become be ever more secure.

Does Fedora still recommend wipe->reinstall from scratch as the default upgrade path?

Nope, Gnome Software can upgrade systems now.

Re: Windows 10 in-place upgrades are a severe security risk

#58

Post by yread »

gnu8 wrote: post #2

Sounds like a case of 'already behind the airtight hatch'. If you have administrative privileges to install an OS upgrade then you have administrative privileges to disable filesystem encryption. On the other hand, if MS pushes the update to the PC and it self-launches or can be initiated by a non-administrator, then it seems like there is a real security problem here.

It's not earth shattering - somebody could steal a encrypted laptop that's already running and keep it running until an upgrade comes and then bypass bitlocker. Aren't there other ways of bypassing it with a running machine?

Re: Windows 10 in-place upgrades are a severe security risk

#60

Post by bitmapbrother »

microtonal wrote: post #52
devoply wrote: post #7

Come join Linux my friends. My fedora hat wearing greybeards wait for you. Only operating system left that gives semblance of privacy and security. And to those who think I am derailing... http://news.softpedia.com/news/microsoft-wants-all-linux-dev...

Only operating system left that gives semblance of privacy and security. You mean the operating system where with the default display server any application can read keystrokes, read mouse events, and make screen grabs of any other application? The operating system where no apps are sandboxed by default? The operating system where once you find a local root exploit, which are not rare, you can embed a root kit deep i…

No, he means the OS that runs the Internet, powers the majority of enterprise systems and inside nearly all of the of embedded and IOT devices.
Post reply on HN