Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows 10 in-place upgrades are a severe security risk

blog.win-fu.com

Post reply on HN
Print view View original

71–80 of 124 posts

Re: Windows 10 in-place upgrades are a severe security risk

#71

Post by CJefferson »

devoply wrote: post #66
microtonal wrote: post #52

Earlier quoted context omitted.

Only operating system left that gives semblance of privacy and security. You mean the operating system where with the default display server any application can read keystrokes, read mouse events, and make screen grabs of any other application? The operating system where no apps are sandboxed by default? The operating system where once you find a local root exploit, which are not rare, you can embed a root kit deep i…

> can read keystrokes, read mouse events, and make screen grabs of any other applic As compared to Windows in which an app can't do that? > The operating system where no apps are sandboxed by default? As compared to Windows or Mac where apps are sandboxed by default? > The operating system where once you find a local root exploit, which are not rare, you can embed a root kit deep in the operating system? As a desktop…

> As compared to Windows in which an app can't do that (read keystrokes of other apps)

Yes, Apps can't do that.

> As compared to Windows or Mac where apps are sandboxed by default?

Yes, apps from both the windows and mac App Stores are sandboxed.

I'm not sure what your point is. I'm not saying Windows is perfect at all, but the GUI security is better. If nothing else, consider the classic ctrl+alt+delete, which no app can catch. On Linux there is no way to be sure the 'login' you are seeing isn't a program someone has installed to capture logins. On Windows I know the login is genuine if I press ctrl+alt+delete.

Re: Windows 10 in-place upgrades are a severe security risk

#72

Post by jeff_tyrrill »

gambiting wrote: post #68
wz1000 wrote: post #36

I don't know whether this works in newer versions of Windows, but it was extremely simple to elevate your priveleges on almost any Windows 7 machine. I've done this dozens of times. I haven't used Windows for years now, so the details are a bit fuzzy, but it essentially worked like this: Start the machine. During boot(when you see the orb splashscreen), turn off power or hold down the power button for a few seconds.…

Oh, so essentially the same bug that existed since windows 98? Where you could, on the login screen, click the little question mark, which would open windows help, then you could click on "open file", navigate to C:\windows and just double click on explorer.exe, which would log you in without a password?

Windows 98 was not intended to offer meaningful local security. The password prompt was used to collect the username/password to use to connect to network resources. (And also, perhaps confusingly, the password prompt was overloaded to select the local user profile, if such feature was enabled - but entering a new username would create a new account, so being a barrier to using the computer was never the point.)

Re: Windows 10 in-place upgrades are a severe security risk

#73

Post by pja »

developer2 wrote: post #44
eco wrote: post #21

Earlier quoted context omitted.

We are dealing with this right now with our software. Our end users on Windows 7 who haven't kept their machine up to date can't install the VC++ 2015 redistributable which is required to run our software. It's a Microsoft problem but it's still frustrating having to do basic tech support for them just because they won't let Windows do the updates that it is insistently but politely asking them to let it do. Not a pr…

With all due respect, if your software has an OS-level dependency that is less than 2 years old, you're too cutting edge and it's your fault. You should not require an unpackaged dependency from 2015. This is a problem with your developers trying to use the latest and greatest technologies, with no respect for reality. It is neither your users', nor Microsoft's fault, that your users don't have bleeding edge 2015 upg…

It’s completely normal in my experience for programs developed on windows to have to install the appropriate Microsoft C++ or C runtime that the binary was linked against. Ever installed a game from Steam? Half of them will insist on downloading & installing the Microsoft VC++ runtime before they’ll do anything at all.

Re: Windows 10 in-place upgrades are a severe security risk

#74

Post by Zardoz84 »

wz1000 wrote: post #36

I don't know whether this works in newer versions of Windows, but it was extremely simple to elevate your priveleges on almost any Windows 7 machine. I've done this dozens of times. I haven't used Windows for years now, so the details are a bit fuzzy, but it essentially worked like this: Start the machine. During boot(when you see the orb splashscreen), turn off power or hold down the power button for a few seconds.…

Sticky keys... a classic!

Also. I use the old trick of going to "Fail mode" on Windows XP to get free access on a hotel on a pay per hour computer some years ago.

Re: Windows 10 in-place upgrades are a severe security risk

#75

Post by razakel »

fghgfdfg wrote: post #24
eco wrote: post #21

Earlier quoted context omitted.

We are dealing with this right now with our software. Our end users on Windows 7 who haven't kept their machine up to date can't install the VC++ 2015 redistributable which is required to run our software. It's a Microsoft problem but it's still frustrating having to do basic tech support for them just because they won't let Windows do the updates that it is insistently but politely asking them to let it do. Not a pr…

These days I don't blame them. I'm guilty of it myself. After Microsoft repeatedly dropped in the Windows 10 "updates" (including nag) under new names it got to be enough of a hassle to avoid them that I've basically stopped updating. Finding the latest update names to ignore, then actually finding them in the update listing is enough of a pain to get me to continually put it off.

>These days I don't blame them. I'm guilty of it myself. After Microsoft repeatedly dropped in the Windows 10 "updates" (including nag) under new names it got to be enough of a hassle to avoid them that I've basically stopped updating.

My PC is next to my bed. I love being woken up at 3 in the morning by Windows attempting and failing to install updates.

It's got to the point where I turn it off at the power supply to stop it.

Re: Windows 10 in-place upgrades are a severe security risk

#76

Post by skocznymroczny »

wz1000 wrote: post #36

I don't know whether this works in newer versions of Windows, but it was extremely simple to elevate your priveleges on almost any Windows 7 machine. I've done this dozens of times. I haven't used Windows for years now, so the details are a bit fuzzy, but it essentially worked like this: Start the machine. During boot(when you see the orb splashscreen), turn off power or hold down the power button for a few seconds.…

Works with the "accessibility features" too on XP, probably on newer OSes too.

Re: Windows 10 in-place upgrades are a severe security risk

#77

Post by microtonal »

bitmapbrother wrote: post #60
microtonal wrote: post #52

Earlier quoted context omitted.

Only operating system left that gives semblance of privacy and security. You mean the operating system where with the default display server any application can read keystrokes, read mouse events, and make screen grabs of any other application? The operating system where no apps are sandboxed by default? The operating system where once you find a local root exploit, which are not rare, you can embed a root kit deep i…

No, he means the OS that runs the Internet, powers the majority of enterprise systems and inside nearly all of the of embedded and IOT devices.

And Windows runs on the vast majority of desktops, so what is your point?

Re: Windows 10 in-place upgrades are a severe security risk

#78

Post by microtonal »

devoply wrote: post #66
microtonal wrote: post #52

Earlier quoted context omitted.

Only operating system left that gives semblance of privacy and security. You mean the operating system where with the default display server any application can read keystrokes, read mouse events, and make screen grabs of any other application? The operating system where no apps are sandboxed by default? The operating system where once you find a local root exploit, which are not rare, you can embed a root kit deep i…

> can read keystrokes, read mouse events, and make screen grabs of any other applic As compared to Windows in which an app can't do that? > The operating system where no apps are sandboxed by default? As compared to Windows or Mac where apps are sandboxed by default? > The operating system where once you find a local root exploit, which are not rare, you can embed a root kit deep in the operating system? As a desktop…

As compared to Windows in which an app can't do that?

Windows provides UI isolation between privilege levels:

https://msdn.microsoft.com/en-us/library/bb625963.aspx

As compared to Windows or Mac where apps are sandboxed by default?

As the sibling commenter mentions. Mac App Store applications are required to be sandboxed:

https://developer.apple.com/library/content/documentation/Se...

The same applies for Windows Store apps.

Windows has rootkits as does Mac.

Mac has system integrity protection (SIP). Even as root, you cannot replace system files (unless you disable SIP):

https://support.apple.com/en-us/HT204899

So, in contrast to default Linux distributions, a root kit cannot replace system files (a common trick that root kits apply is to replace system files to preserve itself during reboots and to hide the root kit, e.g. by hiding it from 'ps' output).

Moreover, macOS only loads signed kernel extensions, so it is not possible for a root kit to inject itself as a loadable kernel module. I think the same is true for Windows, but I am not familiar enough with Windows.

I am also not worried about government agencies having unfettered access to my machine as a default setting.

You are throwing two things one one heap now: (1) having a backdoor and (2) sending out usage data.

If you believe that there is a difference between Linux, macOS, or Windows when it comes to (1), this is utterly naive. Linux distributions have a large number of package maintainers and upstream projects. You cannot be certain that none of these ten thousands of people is compromised and inserts a subtle backdoor. And even if you are certain about this, it's likely that government actors have a collection of exploitable remote and local exploits.

When it comes to sending out data, such as usage data, use an app firewall. E.g. with a program like Little Snitch, it is easy to configure which program can contact what server in the outside world.

Ps. Linux has the potential to be very secure. A lot of the technology is there (e.g. Wayland and SELinux). The problem is that the Linux community is too conservative and/or believes in the myth that Linux is already secure.

Re: Windows 10 in-place upgrades are a severe security risk

#79

Post by m_mueller »

jeff_tyrrill wrote: post #67
m_mueller wrote: post #65

Earlier quoted context omitted.

You have to get used to the fact that any physical contact with an unencrypted hard disk, whether it's locked in a computer or not, means that this person now has r/w access to all that data.

The grandparent technique does not rely on physical access to the raw hardware - only mouse, keyboard, and power switch (intended human interface endpoints). The computer case could be behind a concrete bunker with the only communication being cables for the mouse, keyboard, power switch, and video out, and no ports, and this would work. The Windows security model is intended to protect administrator-account access g…

.. and so far it has AFAIK never succeeded to protect from all these attacks. That's what I meant with 'locked inside a computer'. It also doesn't matter because in the real world you don't have that bunker in between.

Re: Windows 10 in-place upgrades are a severe security risk

#80

Post by beagle3 »

erelde wrote: post #55
developer2 wrote: post #39

Earlier quoted context omitted.

You're kidding, right? You can drop in any executable in place of sticky keys? And it runs with Administrator privileges? How does Microsoft own the enterprise and government spaces with glaring lack of basic security like this? :/

You can also drop (almost) any executable in place of explorer.exe, it's the basis of Windows Server "Core". It has both good and bad sides, and the same (basic) thing is exploitable on linux. You can replace `cat` with another executable and change the PATH so that the new `cat` comes first. /tmp/cat PATH=/tmp:$PATH edit: I'm aware that this does not give root privilege (though it could, through some SUID hack or co…

Not really. In any Linux system I've seen,if you can change PATH you can already execute your /tmp/cat directly. And generally PATH and LD_LIBRARY_PATH are not passed through suid or sudo.
Post reply on HN