Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows 10 in-place upgrades are a severe security risk

blog.win-fu.com

Post reply on HN
Print view View original

91–100 of 124 posts

Re: Windows 10 in-place upgrades are a severe security risk

#91

Post by pjc50 »

tokenizerrr wrote: post #88
CJefferson wrote: post #71

Earlier quoted context omitted.

> As compared to Windows in which an app can't do that (read keystrokes of other apps) Yes, Apps can't do that. > As compared to Windows or Mac where apps are sandboxed by default? Yes, apps from both the windows and mac App Stores are sandboxed. I'm not sure what your point is. I'm not saying Windows is perfect at all, but the GUI security is better. If nothing else, consider the classic ctrl+alt+delete, which no ap…

> Yes, Apps can't do that. I have AutoHotKey and ShareX. The first reads keystrokes from anywhere, and the second takes screenshots from anywhere and anything. It's pretty clear that Windows applications most definitely can do that.

The parent comment is (slightly obtusely) talking about "UWP Apps", which are installed from the store and have mobile-style "sandboxing". Normal Win32 applications can of course use SetWindowsHookEx() and the DirectDraw screen functions to take over your screen.

Re: Windows 10 in-place upgrades are a severe security risk

#92

Post by josteink »

pjc50 wrote: post #91
tokenizerrr wrote: post #88

Earlier quoted context omitted.

> Yes, Apps can't do that. I have AutoHotKey and ShareX. The first reads keystrokes from anywhere, and the second takes screenshots from anywhere and anything. It's pretty clear that Windows applications most definitely can do that.

The parent comment is (slightly obtusely) talking about "UWP Apps", which are installed from the store and have mobile-style "sandboxing". Normal Win32 applications can of course use SetWindowsHookEx() and the DirectDraw screen functions to take over your screen.

> The parent comment is (slightly obtusely) talking about "UWP Apps", which are installed from the store and have mobile-style "sandboxing".

And if he is, that's an absolutely academical points as 99% of all Windows-users runs zero applications from the store.

Nothing like an imaginary straw-man argument on the internet, eh? :)

Re: Windows 10 in-place upgrades are a severe security risk

#93

Post by sjellis »

sdegutis wrote: post #10
devoply wrote: post #7

Come join Linux my friends. My fedora hat wearing greybeards wait for you. Only operating system left that gives semblance of privacy and security. And to those who think I am derailing... http://news.softpedia.com/news/microsoft-wants-all-linux-dev...

In all seriousness, why is Fedora the mosts worthy Linux out of them all, in terms of privacy and security? I thought those two were kind of an inherent staple of all Linux distros? In the past I've used Debian Stable with AwesomeWM (the inspiration for Mjolnir) and it felt pretty secure?

I've only been following Fedora development from a distance, and haven't had time to look at Fedora 25 yet. From memory, there's a bunch of things:

* Fedora and Ubuntu are more aggressive about compiling security features into the packaged binaries, whilst Debian considers package build flags to be the decision of individual maintainers, so coverage is more piece-meal.

* Fedora ships SELinux enabled. I believe that current versions of Android is the only popular non-Red Hat Linux-based system that does that. The common compliant about RH's SELinux implementation is that it is so restrictive about system integrity that it blocks actual system administrators from doing routine tasks unless they remember to change the appropriate SELinux policy settings first.

* Fedora 25 now uses a Wayland implementation for managing graphics by default, rather than X, so that the security issues of X don't apply.

* Fedora 24+ includes Flatpak, so that there is a system for sandboxed applications. Fedora 25 provides the UI integration for non-technical users to run Flatpak packages (once developers build them).

* The RPM/DNF package management system is more stringent about checking downloaded packages than APT.

Re: Windows 10 in-place upgrades are a severe security risk

#94

Post by cmdrfred »

Nullabillity wrote: post #53
cm2187 wrote: post #48

Earlier quoted context omitted.

Assuming all machines on the network do not have the same local admin password.

This is a privilege escalation bug that lets you reset the admin password, but it doesn't give you the old password.

You might be able to get the hash via mimikatz.

Re: Windows 10 in-place upgrades are a severe security risk

#95

Post by cmdrfred »

microtonal wrote: post #77
bitmapbrother wrote: post #60

Earlier quoted context omitted.

No, he means the OS that runs the Internet, powers the majority of enterprise systems and inside nearly all of the of embedded and IOT devices.

And Windows runs on the vast majority of desktops, so what is your point?

Who will have a desktop in 10 years? (Besides developers)

Re: Windows 10 in-place upgrades are a severe security risk

#96

Post by mnw21cam »

beagle3 wrote: post #80
erelde wrote: post #55

Earlier quoted context omitted.

You can also drop (almost) any executable in place of explorer.exe, it's the basis of Windows Server "Core". It has both good and bad sides, and the same (basic) thing is exploitable on linux. You can replace `cat` with another executable and change the PATH so that the new `cat` comes first. /tmp/cat PATH=/tmp:$PATH edit: I'm aware that this does not give root privilege (though it could, through some SUID hack or co…

Not really. In any Linux system I've seen,if you can change PATH you can already execute your /tmp/cat directly. And generally PATH and LD_LIBRARY_PATH are not passed through suid or sudo.

And this, folks, is why you shouldn't have "." in your PATH.

Re: Windows 10 in-place upgrades are a severe security risk

#97

Post by Sylos »

sdegutis wrote: post #10
devoply wrote: post #7

Come join Linux my friends. My fedora hat wearing greybeards wait for you. Only operating system left that gives semblance of privacy and security. And to those who think I am derailing... http://news.softpedia.com/news/microsoft-wants-all-linux-dev...

In all seriousness, why is Fedora the mosts worthy Linux out of them all, in terms of privacy and security? I thought those two were kind of an inherent staple of all Linux distros? In the past I've used Debian Stable with AwesomeWM (the inspiration for Mjolnir) and it felt pretty secure?

It did have a comparatively low number of security vulnerabilities in 2015.

I also often see it brought up that Fedora uses SELinux by default.

Re: Windows 10 in-place upgrades are a severe security risk

#98

Post by Cthulhu_ »

jbarberu wrote: post #59

So, you leave your machine with BitLocker unlocked and unattended and people can gain admin privileges? I don't see how anyone would expect their data to be secured by disk encryption of the machine isn't powered down. Or am I missing something?

Windows 10's updates can also start while the computer is locked though.

Re: Windows 10 in-place upgrades are a severe security risk

#99

Post by alkonaut »

jbarberu wrote: post #59

So, you leave your machine with BitLocker unlocked and unattended and people can gain admin privileges? I don't see how anyone would expect their data to be secured by disk encryption of the machine isn't powered down. Or am I missing something?

I don't understand either (didn't watch video though).

Is the problem that the machine can be locked and still start the upgrade process, during which a non admin at the keyboard can rrad the disk?

That would be a pretty serious hole but would be easily fixable by only starting updates when unlocked.

Re: Windows 10 in-place upgrades are a severe security risk

#100

Post by zerohm »

jbarberu wrote: post #59

So, you leave your machine with BitLocker unlocked and unattended and people can gain admin privileges? I don't see how anyone would expect their data to be secured by disk encryption of the machine isn't powered down. Or am I missing something?

Let's say you are a desktop admin updating 500 Windows 10 machines. Maybe some of these machines are terminals for customers. This bug is a significant attack vector to gain admin on those machines being updated.
Post reply on HN