Live data from Hacker News

HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

doublepulsar.com

111–120 of 184 posts

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#111
post #23

I am legitimately not sure if this is a bug or a feature. I'll take all the side-channels I can get though. These "exploits" are really useful for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install.

Definitely a bug. The Unix equivalent would be a package update silently making /etc/shadow world readable, exposing the hashed passwords of local users.

Not a big deal for a single user machine — there’s nothing you can do with this that you can’t do some other way as a local admin/root — but not good if you have untrusted, non-admin user accounts.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#112

Earlier quoted context omitted.

(Nearly?) All ChromeOS devices use CoreBoot. You really can't get much more open than that. Android is open source and if you don't buy a locked down device from a carrier, the bootloader is unlockable and the system easily rootable. Your two examples of something more 'not my pc anymore' than Windows aren't exactly good ones. Now, if you were to mention MacOS and iOS... then you definitely would have had a point.

> (Nearly?) All ChromeOS devices use CoreBoot. You really can't get much more open than that. Last time I looked, it was really hard to install anything other than ChromeOS on Chromebook hardware. You can install a chrooted Linux on them, yes, but on the device itself you can't even execute unsigned binaries. Impossible? No. Harder than executing an installer with elevated rights? Yes. Plus, they also come with pre-i…

> Last time I looked, it was really hard to install anything other than ChromeOS on Chromebook hardware.

Look again.

Switching to Developer Mode and hitting Ctrl-L at the boot up screen allows you to boot from USB or SD Card.

>And, when talking about pre-installed apps that the user can't remove without a lot of effort, Android basically invented that.

This statement is so disingenuous that I'm just going to stop quoting here.

Hello? iOS? Couldn't even remove icons/apps like Newsstand off your homescreen for 7 OS versions.

You need to familiarize yourself a bit more with what you're criticizing lest you sound like a head-in-the-sand zealot.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#113

Earlier quoted context omitted.

A user password doesn't enable encryption. Bitlocker or another Full Disk Encryption solution is what you would want to use. If you can see the data, that means it's not encrypted.

But doesn’t Windows 10 ship with device encryption? Ie full disk encryption? I thought that’s exactly what this was, which is what I’m not understanding. How can you see data if the device is encrypted?

It isn't enabled by default, you have to turn it on. It also isn't included in the home edition at all.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#114
post #23

I am legitimately not sure if this is a bug or a feature. I'll take all the side-channels I can get though. These "exploits" are really useful for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install.

>" for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install." I understand Linux, Mac, FreeBSD, Magic-Pony-OS is not everyone's cup of tea or they might not be in a position to choose their OS (Work etc) But DAMN that quote above is really showing me how bad it is out there ! Sure it can/does happen on oth…

I've been spending the last 48 hours strongly pondering Linux as a daily driver. If it wasn't for my crippling visual studio addiction, I'd probably be able to swap all my PCs over, with the exception of the one bastard stepchild win10 that I will keep in the closet for when BF2042 is released. Virtualization is another option that I am investigating actively now.

I could even see the path for getting our product off the Windows platform and onto Linux (while still using Microsoft's dotnet toolchain). There are only 2 DLLs keeping us locked to Windows and I have a very solid hypothetical answer for both.

All of this is so depressing because it doesn't have to be this way. A few small changes to the OS (that would incur negligible impact to Microsoft's cashflow or margins) could mean life changing improvements in the user experience.

If profit must be obtained, then Microsoft should consider a "hacker" build of windows that starts as a bare-ass powershell prompt that you have to tack on what you want to use. I'd pay a fucking premium. Microsoft, are you out there? Charge me $1000. I swear I'll pay it if you promise to not shove updates, telemetry, defender or cortana down my throat ever again.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#115

Earlier quoted context omitted.

I wasn’t being literal. To clarify, I meant some random person installing some random software without your knowledge type of untrusted software.

AKA JavaScript on websites? Sure, it's sandboxed to the Moon, but it's still random people "installing" software on your computer.

[deleted]

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#116
post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

> It amazes me that Microsoft haven't replaced the Registry

how does this amaze anyone? how do people think backwards compatibility works?

Microsoft, supporting Windows, promises to make every effort to maintain backwards compatibility wherever possible so that programs compiled for, say, Windows 95 will run unmodified on Windows 10.

Not every program from 20+ years ago runs, but a lot do! That's a very hard thing to do if you wish to continue to advance the technology you use in your operating system. Apple doesn't even try.

Microsoft have taken steps to break backwards compatibility a few times in the name of progress and every time I talk to people during those transition periods, it is a 50/50 split between people who don't know that they've been given a decade of notice and now their "tried & true" software development paradigm doesn't work anymore, and people who are angry because most of the old ways are still supported.

The registry wasn't even supposed to be what it is today. it was a small stop-gap thing to stand in place while a better solution was developed. Developers discovered it, started using it, and now Microsoft has to support it. Of course it's rubbish; metaphorically, it's a piece of a whiteboard used as a doorstop until the real doorstop is delivered, except for some reason people started using it for important stuff and now everyone needs it.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#117
"To keep reading this story, get the free app or log in." FUCK. YOU. Remember when people just published informative and thoughtful stuff online without expecting monetization? Yeah, I and Pepperidge Farm remember, but it seems to have become a lost art. It's worth it to forgo this article, no matter how interesting it seemed to me, to encourage the author and others to publish their blogs to be readable by all.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#118
post #97

Earlier quoted context omitted.

If there was never an "old way" of doing things that didn't involve the new TrustedInstaller system, then would we even be thinking twice about these new restrictions? Or would we just see the restrictions as part of the design of the APIs? Just because they took a part of the system that used to be externally facing and made it internally facing, I don't think that is the same as making "your PC not your PC anymore"…

> If they were blocking administrators from executing arbitrary code or having arbitrary access to I/Os, that would be a different story. I think this is the exact story being discussed here.

[deleted]

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#119
post #57
post #43

Earlier quoted context omitted.

Wine exposes the registry as a file.

Implementing the registry APIs, but backed by a regular filesystem (as Wine does) would be the sensible thing for Windows to do. (I looked at the source of Wine just now and I'm fairly sure nowhere does it process hive files.)

PowerShell exposes the hives as a directory structure, and has for a decade or more. just type "HKLM:" or whatever hive you want and start using "cd" and "dir" all you want.

https://docs.microsoft.com/en-us/powershell/scripting/sample...

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#120
post #88

Earlier quoted context omitted.

>" for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install." I understand Linux, Mac, FreeBSD, Magic-Pony-OS is not everyone's cup of tea or they might not be in a position to choose their OS (Work etc) But DAMN that quote above is really showing me how bad it is out there ! Sure it can/does happen on oth…

IMO if you expand PC to cover mobile computing, the real tragedy is iPhone. No sideloading, very restrictive app store policies, and no custom OSes at all. At least with a Windows desktop or laptop, you can run Linux or one of the other actually free OSes. Modern MacOS is also pretty unfriendly for developers and power users, but at least Apple is somewhat aligned with users on privacy and security, unlike Microsoft.

> Modern MacOS is also pretty unfriendly for developers and power users.

It has become somewhat unfriendly, but I really appreciate that you can still do whatever you want.

To run self-signed apps, run `sudo spctl --master-disable`

To turn off System Integrity Protection, run `csrutil --disable` from recovery mode.

To modify the root filesystem, do all of the above and run `csrutil authenticated-root disable` from recovery mode.

To disable library validation, do all of the above and run `sudo defaults write /Library/Preferences/com.apple.security.libraryvalidation.plist DisableLibraryValidation -bool true`

To disable AMFI, do all of the above and add the boot argument amfi_get_out_of_my_way=0x1

(Some steps may be a bit different on Apple Silicon Macs, I don't own any so I'm not as familiar.)

---

You now have the same privileges Apple does. You can grant yourself whatever entitlements you like, inject your own code into any process, load your own kernel extensions, or just replace the whole kernel with your custom build of XNU.

I actually think a decent chunk of macOS's perceived "unfriendliness" comes from Mac users being less willing to hack around than users of other OSs. The common refrain in Mac circles seems to be that System Integrity Protection should never be switched off under any circumstances. I agree, if you're a normal user—but if you're not, and the handcuffs are annoying you, just unlock them already. (But do leave everything else in place until such a time as it presents a roadblock.)

Also, method swizzling in Objective-C is fun, try it!

Post reply on HN