Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows 10 in-place upgrades are a severe security risk

blog.win-fu.com

Post reply on HN
Print view View original

101–110 of 124 posts

Re: Windows 10 in-place upgrades are a severe security risk

#101

Post by 0xcde4c3db »

donatj wrote: post #27

Is there not a presumption that with physical access to a machine it can be rooted if you try hard enough? I certainly make that presumption. The number of Macs I've unlocked by creating a new admin by removing the "install is finished" file in single user mode is in the teens.

There is such a presumption, but it's a bit of a mental shortcut, sort of like "water is incompressible". In some scenarios it's still useful to know how obvious the methods are if an attacker is supervised, how much unsupervised time they might need to successfully own the machine, and whether they would need to break any tamper-evident seals that could be checked afterward.

Re: Windows 10 in-place upgrades are a severe security risk

#103

Post by drzaiusapelord »

gnu8 wrote: post #2

Sounds like a case of 'already behind the airtight hatch'. If you have administrative privileges to install an OS upgrade then you have administrative privileges to disable filesystem encryption. On the other hand, if MS pushes the update to the PC and it self-launches or can be initiated by a non-administrator, then it seems like there is a real security problem here.

Maybe with a home system, but in business most users don't have local admin rights but the systems are set to allow them to initiate updates, or updates happen the next time the computer boots up from patch tuesday. If an end-user catches an image-based update being deployed, she can just press that hotkey combo and get local admin rights. Scary stuff here for sysadmins until this is patched or some work-around can be implemented.

WindowsPE is a whole separate Windows distro and has all its failings and security issues. MS doesn't seem to have hardened it correctly for its update system. This is also why organizations are usually 2-3 years behind Windows versions. Its just too risky to trust MS to get things done on an acceptable level without nearly 3 years of bug squashing and security auditing per Windows version.

I've kept my employer on 7 until next year for reasons like these. Considering all the update and security issues with Win10, we might even put this off until 2018.

Re: Windows 10 in-place upgrades are a severe security risk

#104

Post by kalleboo »

devoply wrote: post #66
microtonal wrote: post #52

Earlier quoted context omitted.

Only operating system left that gives semblance of privacy and security. You mean the operating system where with the default display server any application can read keystrokes, read mouse events, and make screen grabs of any other application? The operating system where no apps are sandboxed by default? The operating system where once you find a local root exploit, which are not rare, you can embed a root kit deep i…

> can read keystrokes, read mouse events, and make screen grabs of any other applic As compared to Windows in which an app can't do that? > The operating system where no apps are sandboxed by default? As compared to Windows or Mac where apps are sandboxed by default? > The operating system where once you find a local root exploit, which are not rare, you can embed a root kit deep in the operating system? As a desktop…

> As I said a semblance of security and privacy

Unless you happened to install Ubuntu, which used to send all your local file searches to the cloud to find Amazon deals

Re: Windows 10 in-place upgrades are a severe security risk

#105

Post by tunap »

fghgfdfg wrote: post #24
eco wrote: post #21

Earlier quoted context omitted.

We are dealing with this right now with our software. Our end users on Windows 7 who haven't kept their machine up to date can't install the VC++ 2015 redistributable which is required to run our software. It's a Microsoft problem but it's still frustrating having to do basic tech support for them just because they won't let Windows do the updates that it is insistently but politely asking them to let it do. Not a pr…

These days I don't blame them. I'm guilty of it myself. After Microsoft repeatedly dropped in the Windows 10 "updates" (including nag) under new names it got to be enough of a hassle to avoid them that I've basically stopped updating. Finding the latest update names to ignore, then actually finding them in the update listing is enough of a pain to get me to continually put it off.

I tired of the 'whack-a-mole' game and just stopped installing post-March 2015 updates on my Win 7 install. It may be vulnerable(what isn't?), but 3rd party sandboxing, firewall and noscript mitigate the immediate, automated threats well enough(last succeasful exploit on my machines outside of a purposely infected VM: ~2009). When MS can no longer harvest my activities(or I can deny them control) I will revisit my security policies. Until then, I will continue to disable updates, harden my firewall and deny any contributions to MS* 's data grab.

* et al. Sadly, "everybody's doing it" these days.

edit:fixed asterisks and unwanted italics.

Re: Windows 10 in-place upgrades are a severe security risk

#106

Post by Godel_unicode »

semi-extrinsic wrote: post #86
wildmusings wrote: post #31

Earlier quoted context omitted.

If you have Bitlocker setup with TPM and PIN, you should be secure even from attackers with physical access.

Not if you're still on Win7, like most corporations still mostly are: https://github.com/carmaa/inception/blob/master/README.md

This requires FireWire or thunderbolt, which is relatively uncommon on Windows machines.

Re: Windows 10 in-place upgrades are a severe security risk

#107

Post by 0xfeba »

satysin wrote: post #11

TL;DR When you do an in-place upgrade it does so in the SYSTEM authority. If you hit Shift+F10 during part of this process you get a Command Prompt running as SYSTEM. Then you can do some file system and registry changes to replace an accessibility feature exe with cmd and again run it under the SYSTEM authority pre-login and add your account to the Administrators group.

I knew I wasn't dreaming when my Bitlocked Win10 machine did the Anniversary Update and rebooted to the update screen without entering my Bitlocker password. Scary.

But that must have been Windows PE doing the update.

Re: Windows 10 in-place upgrades are a severe security risk

#108

Post by chris_wot »

kalleboo wrote: post #104
devoply wrote: post #66

Earlier quoted context omitted.

> can read keystrokes, read mouse events, and make screen grabs of any other applic As compared to Windows in which an app can't do that? > The operating system where no apps are sandboxed by default? As compared to Windows or Mac where apps are sandboxed by default? > The operating system where once you find a local root exploit, which are not rare, you can embed a root kit deep in the operating system? As a desktop…

> As I said a semblance of security and privacy Unless you happened to install Ubuntu, which used to send all your local file searches to the cloud to find Amazon deals

And does not any more?

Re: Windows 10 in-place upgrades are a severe security risk

#109

Post by Accacin »

microtonal wrote: post #78
devoply wrote: post #66

Earlier quoted context omitted.

> can read keystrokes, read mouse events, and make screen grabs of any other applic As compared to Windows in which an app can't do that? > The operating system where no apps are sandboxed by default? As compared to Windows or Mac where apps are sandboxed by default? > The operating system where once you find a local root exploit, which are not rare, you can embed a root kit deep in the operating system? As a desktop…

As compared to Windows in which an app can't do that? Windows provides UI isolation between privilege levels: https://msdn.microsoft.com/en-us/library/bb625963.aspx As compared to Windows or Mac where apps are sandboxed by default? As the sibling commenter mentions. Mac App Store applications are required to be sandboxed: https://developer.apple.com/library/content/documentation/Se... The same applies for Windows Sto…

Sorry, but how many people actually use the Mac and Windows app stores?

Re: Windows 10 in-place upgrades are a severe security risk

#110

Post by Someone1234 »

gnu8 wrote: post #2

Sounds like a case of 'already behind the airtight hatch'. If you have administrative privileges to install an OS upgrade then you have administrative privileges to disable filesystem encryption. On the other hand, if MS pushes the update to the PC and it self-launches or can be initiated by a non-administrator, then it seems like there is a real security problem here.

In the video they demonstrated that they're NOT local admin. The machine was set to automatically install updates, all they had to do was hit the "restart" button to start the automatic installation.

They were then able to use a key combination to give them SYSTEM level access from a normal user account. This is absolutely an elevation exploit, and the fact it bypasses Bitlocker during in-place upgrade is a little disturbing.

This bug likely isn't impactful for home users, but for enterprise-style systems (in particular in education) it has a big impact. Now every regular user can trivially become a local admin user. Problematic.

Post reply on HN