Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows 10 in-place upgrades are a severe security risk

blog.win-fu.com

Post reply on HN
Print view View original

81–90 of 124 posts

Re: Windows 10 in-place upgrades are a severe security risk

#81

Post by LoSboccacc »

jeff_tyrrill wrote: post #67
m_mueller wrote: post #65

Earlier quoted context omitted.

You have to get used to the fact that any physical contact with an unencrypted hard disk, whether it's locked in a computer or not, means that this person now has r/w access to all that data.

The grandparent technique does not rely on physical access to the raw hardware - only mouse, keyboard, and power switch (intended human interface endpoints). The computer case could be behind a concrete bunker with the only communication being cables for the mouse, keyboard, power switch, and video out, and no ports, and this would work. The Windows security model is intended to protect administrator-account access g…

you'd either have it in a bunker with a remote terminal, or you'd get in the bunker after security clearance. making up weird scenario to prove a point is a fool errand, security needs compromise and threat modeling, it's not a blanket meant to protect for every type of attack ever.

Re: Windows 10 in-place upgrades are a severe security risk

#82

Post by erelde »

beagle3 wrote: post #80
erelde wrote: post #55

Earlier quoted context omitted.

You can also drop (almost) any executable in place of explorer.exe, it's the basis of Windows Server "Core". It has both good and bad sides, and the same (basic) thing is exploitable on linux. You can replace `cat` with another executable and change the PATH so that the new `cat` comes first. /tmp/cat PATH=/tmp:$PATH edit: I'm aware that this does not give root privilege (though it could, through some SUID hack or co…

Not really. In any Linux system I've seen,if you can change PATH you can already execute your /tmp/cat directly. And generally PATH and LD_LIBRARY_PATH are not passed through suid or sudo.

Yeah, not really, that's what I'm saying in all my parentheses...

Re: Windows 10 in-place upgrades are a severe security risk

#83

Post by semi-extrinsic »

mavhc wrote: post #61
mintplant wrote: post #56

Earlier quoted context omitted.

As a kid I did this with magnify.exe to get around account time restrictions (hi, Dad). Enabling magnifier from the accessibility dialog on the login screen would pop open a command prompt running under the SYSTEM account. Punching in "explorer.exe" would get you a desktop.

Smart parents lock down their kid's computer to turn them into better hackers

I can't remember where I saw it, but here's how you teach your kids to start scripting:

Step 1: put a note on the fridge saying "The new WiFi password is one of the 10 random keys in the text file on this USB drive [taped to note]".

Step 2: wait a few days, repeat Step 1 with 10 replaced by 10 000 and also leave them an intro to Python (or $favorite_lang) book. Bonus points if you make the USB drive boot Linux straight to a Python REPL.

Re: Windows 10 in-place upgrades are a severe security risk

#84

Post by besselheim »

erelde wrote: post #55
developer2 wrote: post #39

Earlier quoted context omitted.

You're kidding, right? You can drop in any executable in place of sticky keys? And it runs with Administrator privileges? How does Microsoft own the enterprise and government spaces with glaring lack of basic security like this? :/

You can also drop (almost) any executable in place of explorer.exe, it's the basis of Windows Server "Core". It has both good and bad sides, and the same (basic) thing is exploitable on linux. You can replace `cat` with another executable and change the PATH so that the new `cat` comes first. /tmp/cat PATH=/tmp:$PATH edit: I'm aware that this does not give root privilege (though it could, through some SUID hack or co…

I think the Linux equivalent would be more like interrupting the boot process at the GRUB menu, then adding "init=/bin/sh" onto the kernel command line, so Linux boots into a root shell.

Re: Windows 10 in-place upgrades are a severe security risk

#85

Post by pjc50 »

m_mueller wrote: post #65
developer2 wrote: post #39

Earlier quoted context omitted.

You're kidding, right? You can drop in any executable in place of sticky keys? And it runs with Administrator privileges? How does Microsoft own the enterprise and government spaces with glaring lack of basic security like this? :/

You have to get used to the fact that any physical contact with an unencrypted hard disk, whether it's locked in a computer or not, means that this person now has r/w access to all that data.

I think we should continue to resist accepting this as normal, especially when it's not true for iPhones. We should get used to at-rest encryption. (It seems that part of the current exploit under discussion bypasses Bitlocker?)

Re: Windows 10 in-place upgrades are a severe security risk

#86

Post by semi-extrinsic »

wildmusings wrote: post #31
donatj wrote: post #27

Is there not a presumption that with physical access to a machine it can be rooted if you try hard enough? I certainly make that presumption. The number of Macs I've unlocked by creating a new admin by removing the "install is finished" file in single user mode is in the teens.

If you have Bitlocker setup with TPM and PIN, you should be secure even from attackers with physical access.

Not if you're still on Win7, like most corporations still mostly are:

https://github.com/carmaa/inception/blob/master/README.md

Re: Windows 10 in-place upgrades are a severe security risk

#87

Post by tokenizerrr »

cm2187 wrote: post #48
derefr wrote: post #14

Earlier quoted context omitted.

Another common Raymond Chen reminder: "Local Administrator != Domain Administrator". If a user gains administrative privileges on their own machine as part of a corporate network, that just means they can bork their own machine and IT will have to come and take it for repair (and they'll likely be disciplined for doing stupid things against IT policy.) If becoming a local administrator on your own machine allows you…

Assuming all machines on the network do not have the same local admin password.

This was the case in my high school. The domain administrator account had the same password as well. Good times.

Re: Windows 10 in-place upgrades are a severe security risk

#88

Post by tokenizerrr »

CJefferson wrote: post #71
devoply wrote: post #66

Earlier quoted context omitted.

> can read keystrokes, read mouse events, and make screen grabs of any other applic As compared to Windows in which an app can't do that? > The operating system where no apps are sandboxed by default? As compared to Windows or Mac where apps are sandboxed by default? > The operating system where once you find a local root exploit, which are not rare, you can embed a root kit deep in the operating system? As a desktop…

> As compared to Windows in which an app can't do that (read keystrokes of other apps) Yes, Apps can't do that. > As compared to Windows or Mac where apps are sandboxed by default? Yes, apps from both the windows and mac App Stores are sandboxed. I'm not sure what your point is. I'm not saying Windows is perfect at all, but the GUI security is better. If nothing else, consider the classic ctrl+alt+delete, which no ap…

> Yes, Apps can't do that.

I have AutoHotKey and ShareX. The first reads keystrokes from anywhere, and the second takes screenshots from anywhere and anything.

It's pretty clear that Windows applications most definitely can do that.

Re: Windows 10 in-place upgrades are a severe security risk

#89

Post by m_mueller »

pjc50 wrote: post #85
m_mueller wrote: post #65

Earlier quoted context omitted.

You have to get used to the fact that any physical contact with an unencrypted hard disk, whether it's locked in a computer or not, means that this person now has r/w access to all that data.

I think we should continue to resist accepting this as normal, especially when it's not true for iPhones. We should get used to at-rest encryption. (It seems that part of the current exploit under discussion bypasses Bitlocker?)

Oh, does that get around bitlocker? I didn't get that part. I've assumed bitlocker uses a keyfile encrypted with the user PW?

Re: Windows 10 in-place upgrades are a severe security risk

#90

Post by egeozcan »

mavhc wrote: post #61
mintplant wrote: post #56

Earlier quoted context omitted.

As a kid I did this with magnify.exe to get around account time restrictions (hi, Dad). Enabling magnifier from the accessibility dialog on the login screen would pop open a command prompt running under the SYSTEM account. Punching in "explorer.exe" would get you a desktop.

Smart parents lock down their kid's computer to turn them into better hackers

I had to learn lock-picking first to have access to the mighty computer room, first. After a while I discovered that I could kick the door open easily. Then they realized the door was wobbly and replaced the entire frame. That's how I learned brute-forcing was not a viable long-term strategy.
Post reply on HN