Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

doublepulsar.com

Post reply on HN
Print view View original

11–20 of 184 posts

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#11

Post by formerly_proven »

pjmlp wrote: post #9
alphadenied wrote: post #3

So one of the most wonderful things about relying on their proprietary closed source operating system is that you can't have external code audits. You just kind of wait for ethical people to come forward and explain bugs they've found and wonder, 1, how long has it been there, 2, how long have bad actors known about this, 3, how many other bugs are just like this or worse that they haven't found yet, 4, do I need to…

OpenSSL code audits having been great, hence why it is such a good example of FOSS secure software.

But why, yes. OpenSSL has seen vast improvements, not just in code, but also in processes, and multiple audits due to Heartbleed.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#12

Post by jaclaz »

praseodym wrote: post #8
jaclaz wrote: post #7

Possibly I am missing something, but the use of volume shadow copies or direct (RAW) disk access to retrieve particular files that are "in use" is a long time established possibility. Extents and Rawcopy were initially written several years ago: http://reboot.pro/files/file/316-extents/ https://github.com/jschicht/RawCopy Or is there something new specific to Windows 10?

The vulnerability here is that regular non-administrator users can also read sensitive registry hives from the shadow copy. This allows for local privilege escalation exploits.

I see, thanks, I never tested the mentioned programs as a non-Admin user, though the mechanism (if the shadow copies are used) is seemingly the same, so if the BUILTIN/USERS are authorized, they may work as well (and not only on Windows 10).

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#15

Post by withinboredom »

woliveirajr wrote: post #2

> There’s no patches, it’s a zero day. Seems that MS just released articles on how to prevent it but no update/patch. Perhaps it's hard to fix, i.e., too many things on windows rely on it?

Or perhaps, once someone installs untrusted software in the first place, you’re screwed anyway?

This is security 101. AFAIK, you can login as a local admin since forever and it’s never been fixed. I just used it recently to access a deceased relative’s computer.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#17

Post by user-the-name »

withinboredom wrote: post #15
woliveirajr wrote: post #2

> There’s no patches, it’s a zero day. Seems that MS just released articles on how to prevent it but no update/patch. Perhaps it's hard to fix, i.e., too many things on windows rely on it?

Or perhaps, once someone installs untrusted software in the first place, you’re screwed anyway? This is security 101. AFAIK, you can login as a local admin since forever and it’s never been fixed. I just used it recently to access a deceased relative’s computer.

Every computer spends pretty much every hour of every day running untrusted software.

There is nothing more common than running untrusted software.

This kind of attitude is completely useless.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#18

Post by londons_explore »

withinboredom wrote: post #15
woliveirajr wrote: post #2

> There’s no patches, it’s a zero day. Seems that MS just released articles on how to prevent it but no update/patch. Perhaps it's hard to fix, i.e., too many things on windows rely on it?

Or perhaps, once someone installs untrusted software in the first place, you’re screwed anyway? This is security 101. AFAIK, you can login as a local admin since forever and it’s never been fixed. I just used it recently to access a deceased relative’s computer.

I was surprised to find that a modern windows 10 machine (with all default security options) could have the user password bypassed easily with a Windows setup USB.

I could then read all the user's documents.

I thought the point of disk encryption and secure boot was to prevent that. Yet somehow the hole of allowing Windows setup to give you a privileged command prompt with a decrypted disk was never closed...

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#19

Post by withinboredom »

user-the-name wrote: post #17
withinboredom wrote: post #15

Earlier quoted context omitted.

Or perhaps, once someone installs untrusted software in the first place, you’re screwed anyway? This is security 101. AFAIK, you can login as a local admin since forever and it’s never been fixed. I just used it recently to access a deceased relative’s computer.

Every computer spends pretty much every hour of every day running untrusted software. There is nothing more common than running untrusted software. This kind of attitude is completely useless.

I wasn’t being literal. To clarify, I meant some random person installing some random software without your knowledge type of untrusted software.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#20

Post by coliveira »

londons_explore wrote: post #18
withinboredom wrote: post #15

Earlier quoted context omitted.

Or perhaps, once someone installs untrusted software in the first place, you’re screwed anyway? This is security 101. AFAIK, you can login as a local admin since forever and it’s never been fixed. I just used it recently to access a deceased relative’s computer.

I was surprised to find that a modern windows 10 machine (with all default security options) could have the user password bypassed easily with a Windows setup USB. I could then read all the user's documents. I thought the point of disk encryption and secure boot was to prevent that. Yet somehow the hole of allowing Windows setup to give you a privileged command prompt with a decrypted disk was never closed...

I guess Windows administrators rely on this. If they close this issue, there will be a huge list of complains that they don't want to deal with.
Post reply on HN