Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows 10 in-place upgrades are a severe security risk

blog.win-fu.com

Post reply on HN
Print view View original

61–70 of 124 posts

Re: Windows 10 in-place upgrades are a severe security risk

#61

Post by mavhc »

mintplant wrote: post #56
developer2 wrote: post #39

Earlier quoted context omitted.

You're kidding, right? You can drop in any executable in place of sticky keys? And it runs with Administrator privileges? How does Microsoft own the enterprise and government spaces with glaring lack of basic security like this? :/

As a kid I did this with magnify.exe to get around account time restrictions (hi, Dad). Enabling magnifier from the accessibility dialog on the login screen would pop open a command prompt running under the SYSTEM account. Punching in "explorer.exe" would get you a desktop.

Smart parents lock down their kid's computer to turn them into better hackers

Re: Windows 10 in-place upgrades are a severe security risk

#62

Post by mavhc »

bitmapbrother wrote: post #60
microtonal wrote: post #52

Earlier quoted context omitted.

Only operating system left that gives semblance of privacy and security. You mean the operating system where with the default display server any application can read keystrokes, read mouse events, and make screen grabs of any other application? The operating system where no apps are sandboxed by default? The operating system where once you find a local root exploit, which are not rare, you can embed a root kit deep i…

No, he means the OS that runs the Internet, powers the majority of enterprise systems and inside nearly all of the of embedded and IOT devices.

Should probably keep quiet about the IoT part.

Re: Windows 10 in-place upgrades are a severe security risk

#63

Post by hollander »

erelde wrote: post #55
developer2 wrote: post #39

Earlier quoted context omitted.

You're kidding, right? You can drop in any executable in place of sticky keys? And it runs with Administrator privileges? How does Microsoft own the enterprise and government spaces with glaring lack of basic security like this? :/

You can also drop (almost) any executable in place of explorer.exe, it's the basis of Windows Server "Core". It has both good and bad sides, and the same (basic) thing is exploitable on linux. You can replace `cat` with another executable and change the PATH so that the new `cat` comes first. /tmp/cat PATH=/tmp:$PATH edit: I'm aware that this does not give root privilege (though it could, through some SUID hack or co…

Explain how this is a security threat like the Windows example given here?!

Re: Windows 10 in-place upgrades are a severe security risk

#64

Post by 2T1Qka0rEiPr »

erelde wrote: post #55
developer2 wrote: post #39

Earlier quoted context omitted.

You're kidding, right? You can drop in any executable in place of sticky keys? And it runs with Administrator privileges? How does Microsoft own the enterprise and government spaces with glaring lack of basic security like this? :/

You can also drop (almost) any executable in place of explorer.exe, it's the basis of Windows Server "Core". It has both good and bad sides, and the same (basic) thing is exploitable on linux. You can replace `cat` with another executable and change the PATH so that the new `cat` comes first. /tmp/cat PATH=/tmp:$PATH edit: I'm aware that this does not give root privilege (though it could, through some SUID hack or co…

Yes, how does this run your executable with root privileges as with the Windows example?

Re: Windows 10 in-place upgrades are a severe security risk

#65

Post by m_mueller »

developer2 wrote: post #39
wz1000 wrote: post #36

I don't know whether this works in newer versions of Windows, but it was extremely simple to elevate your priveleges on almost any Windows 7 machine. I've done this dozens of times. I haven't used Windows for years now, so the details are a bit fuzzy, but it essentially worked like this: Start the machine. During boot(when you see the orb splashscreen), turn off power or hold down the power button for a few seconds.…

You're kidding, right? You can drop in any executable in place of sticky keys? And it runs with Administrator privileges? How does Microsoft own the enterprise and government spaces with glaring lack of basic security like this? :/

You have to get used to the fact that any physical contact with an unencrypted hard disk, whether it's locked in a computer or not, means that this person now has r/w access to all that data.

Re: Windows 10 in-place upgrades are a severe security risk

#66

Post by devoply »

microtonal wrote: post #52
devoply wrote: post #7

Come join Linux my friends. My fedora hat wearing greybeards wait for you. Only operating system left that gives semblance of privacy and security. And to those who think I am derailing... http://news.softpedia.com/news/microsoft-wants-all-linux-dev...

Only operating system left that gives semblance of privacy and security. You mean the operating system where with the default display server any application can read keystrokes, read mouse events, and make screen grabs of any other application? The operating system where no apps are sandboxed by default? The operating system where once you find a local root exploit, which are not rare, you can embed a root kit deep i…

> can read keystrokes, read mouse events, and make screen grabs of any other applic

As compared to Windows in which an app can't do that?

> The operating system where no apps are sandboxed by default?

As compared to Windows or Mac where apps are sandboxed by default?

> The operating system where once you find a local root exploit, which are not rare, you can embed a root kit deep in the operating system?

As a desktop user, not sure how this applies. Windows has rootkits as does Mac.

However, every time I boot my computer my computer doesn't call home. I am also not worried about government agencies having unfettered access to my machine as a default setting. With Windows I don't know that. When I install Mac I give them my e-mail address and thereby my identity just to install the operating system. They also have my credit card number. When a Mac calls home they have my IP. So anything I do online can be traced by to my identity as a default setting through Apple... a company not located in my country.

As I said a semblance of security and privacy. Better than no semblance which at this point is the case with Windows and Mac. I know it's not real security, but best that no money can buy at this time.

I also have Windows. It's for playing old games... Surprising they still work after 15 years.

Re: Windows 10 in-place upgrades are a severe security risk

#67

Post by jeff_tyrrill »

m_mueller wrote: post #65
developer2 wrote: post #39

Earlier quoted context omitted.

You're kidding, right? You can drop in any executable in place of sticky keys? And it runs with Administrator privileges? How does Microsoft own the enterprise and government spaces with glaring lack of basic security like this? :/

You have to get used to the fact that any physical contact with an unencrypted hard disk, whether it's locked in a computer or not, means that this person now has r/w access to all that data.

The grandparent technique does not rely on physical access to the raw hardware - only mouse, keyboard, and power switch (intended human interface endpoints). The computer case could be behind a concrete bunker with the only communication being cables for the mouse, keyboard, power switch, and video out, and no ports, and this would work.

The Windows security model is intended to protect administrator-account access given these parameters.

Re: Windows 10 in-place upgrades are a severe security risk

#68

Post by gambiting »

wz1000 wrote: post #36

I don't know whether this works in newer versions of Windows, but it was extremely simple to elevate your priveleges on almost any Windows 7 machine. I've done this dozens of times. I haven't used Windows for years now, so the details are a bit fuzzy, but it essentially worked like this: Start the machine. During boot(when you see the orb splashscreen), turn off power or hold down the power button for a few seconds.…

Oh, so essentially the same bug that existed since windows 98? Where you could, on the login screen, click the little question mark, which would open windows help, then you could click on "open file", navigate to C:\windows and just double click on explorer.exe, which would log you in without a password?

Re: Windows 10 in-place upgrades are a severe security risk

#69

Post by [deleted] »

wz1000 wrote: post #36

I don't know whether this works in newer versions of Windows, but it was extremely simple to elevate your priveleges on almost any Windows 7 machine. I've done this dozens of times. I haven't used Windows for years now, so the details are a bit fuzzy, but it essentially worked like this: Start the machine. During boot(when you see the orb splashscreen), turn off power or hold down the power button for a few seconds.…

[deleted]

Re: Windows 10 in-place upgrades are a severe security risk

#70

Post by akerro »

developer2 wrote: post #39
wz1000 wrote: post #36

I don't know whether this works in newer versions of Windows, but it was extremely simple to elevate your priveleges on almost any Windows 7 machine. I've done this dozens of times. I haven't used Windows for years now, so the details are a bit fuzzy, but it essentially worked like this: Start the machine. During boot(when you see the orb splashscreen), turn off power or hold down the power button for a few seconds.…

You're kidding, right? You can drop in any executable in place of sticky keys? And it runs with Administrator privileges? How does Microsoft own the enterprise and government spaces with glaring lack of basic security like this? :/

Yes, I was doing it for years since Win98. There even was Linux distro dedicated for it called logmein that has something like 35MB. I still have .img of it, if you would like to test it. The distro was no longer supported since Vista, but still worked on win7.
Post reply on HN