Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

doublepulsar.com

Post reply on HN
Print view View original

121–130 of 184 posts

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#121

Post by Sebb767 »

techrat wrote: post #112
Sebb767 wrote: post #108

Earlier quoted context omitted.

> (Nearly?) All ChromeOS devices use CoreBoot. You really can't get much more open than that. Last time I looked, it was really hard to install anything other than ChromeOS on Chromebook hardware. You can install a chrooted Linux on them, yes, but on the device itself you can't even execute unsigned binaries. Impossible? No. Harder than executing an installer with elevated rights? Yes. Plus, they also come with pre-i…

> Last time I looked, it was really hard to install anything other than ChromeOS on Chromebook hardware. Look again. Switching to Developer Mode and hitting Ctrl-L at the boot up screen allows you to boot from USB or SD Card. >And, when talking about pre-installed apps that the user can't remove without a lot of effort, Android basically invented that. This statement is so disingenuous that I'm just going to stop quo…

Maybe you should have read my comment (or the previous one):

> We agree on iOS, but the grandparent talked about PCs - iOS really does not fall into that category (that's why I explicitly mentioned smartphones).

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#122

Post by jsjohnst »

aftbit wrote: post #88
rawoke083600 wrote: post #83

Earlier quoted context omitted.

>" for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install." I understand Linux, Mac, FreeBSD, Magic-Pony-OS is not everyone's cup of tea or they might not be in a position to choose their OS (Work etc) But DAMN that quote above is really showing me how bad it is out there ! Sure it can/does happen on oth…

IMO if you expand PC to cover mobile computing, the real tragedy is iPhone. No sideloading, very restrictive app store policies, and no custom OSes at all. At least with a Windows desktop or laptop, you can run Linux or one of the other actually free OSes. Modern MacOS is also pretty unfriendly for developers and power users, but at least Apple is somewhat aligned with users on privacy and security, unlike Microsoft.

> the real tragedy is iPhone. No sideloading

I’m so tired of seeing folks parroting no sideloading on iOS. That’s not been true for a long time. Yes, the conditions of side loading (needs a free developer account, must have app signing refreshed weekly, etc) might not be palatable for your taste (which I’d generally agree), but to say it’s not possible to sideload apps on a stock iOS device is just wrong.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#123

Post by gruez »

majkinetor wrote: post #101
gruez wrote: post #92

Earlier quoted context omitted.

>Totally removing defender as TI is the only option if you dont want it turning itself back on arbitrarily I disabled it via group policy 2 years ago and just checked, still disabled.

It was working like that before, but on latest updates it automatically turns on every restart (or so). I don't really need to remove it, only disable it because it visibly slows down machine x2-x10 depending on what you do.

> It was working like that before, but on latest updates it automatically turns on every restart (or so).

that's if you disable through the normal settings interface. the group policy settings stick, although you might have to turn off "tamper protection" first before applying the group policy.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#124

Post by gruez »

bob1029 wrote: post #96
gruez wrote: post #92

Earlier quoted context omitted.

>Totally removing defender as TI is the only option if you dont want it turning itself back on arbitrarily I disabled it via group policy 2 years ago and just checked, still disabled.

What version/edition of Win10 are you on?

LTSC

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#125

Post by techrat »

Sebb767 wrote: post #121
techrat wrote: post #112

Earlier quoted context omitted.

> Last time I looked, it was really hard to install anything other than ChromeOS on Chromebook hardware. Look again. Switching to Developer Mode and hitting Ctrl-L at the boot up screen allows you to boot from USB or SD Card. >And, when talking about pre-installed apps that the user can't remove without a lot of effort, Android basically invented that. This statement is so disingenuous that I'm just going to stop quo…

Maybe you should have read my comment (or the previous one): > We agree on iOS, but the grandparent talked about PCs - iOS really does not fall into that category (that's why I explicitly mentioned smartphones).

> > > Android basically invented that.

> > Prior art.

> Watch me dance.

Okay.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#126

Post by jakogut »

bob1029 wrote: post #114
rawoke083600 wrote: post #83

Earlier quoted context omitted.

>" for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install." I understand Linux, Mac, FreeBSD, Magic-Pony-OS is not everyone's cup of tea or they might not be in a position to choose their OS (Work etc) But DAMN that quote above is really showing me how bad it is out there ! Sure it can/does happen on oth…

I've been spending the last 48 hours strongly pondering Linux as a daily driver. If it wasn't for my crippling visual studio addiction, I'd probably be able to swap all my PCs over, with the exception of the one bastard stepchild win10 that I will keep in the closet for when BF2042 is released. Virtualization is another option that I am investigating actively now. I could even see the path for getting our product off…

> with the exception of the one bastard stepchild win10 that I will keep in the closet for when BF2042 is released

For what it's worth, all recent Battlefield games run flawlessly through Proton, including multiplayer with anti-cheat, D3D12, and soon (if not already), ray tracing. This includes at least BF:BC2, BF3, BF4, BF1, and BFV. There's no reason to think BF2042 will be any different.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#127

Post by gruez »

majkinetor wrote: post #102
gruez wrote: post #58

Earlier quoted context omitted.

>I'll take all the side-channels I can get though. These "exploits" are really useful for regaining control over my own PC. Not really? What does this exploit let you do that you couldn't already do with a local administrator account? Or are you making the general argument that "EoP exploits are features because they allow you to jailbreak your device"? >Just yesterday I learned how to Run-As TrustedInstaller, and th…

> What does this exploit let you do that you couldn't already do with a local administrator account There are some things that users in Administrators group still can't do. Hence the need for TrustedInstaller perms. For example, try running this script: https://github.com/W4RH4WK/Debloat-Windows-10/blob/master/sc... You will get access denied since few months back: https://github.com/W4RH4WK/Debloat-Windows-10/issues…

> > What does this exploit let you do that you couldn't already do with a local administrator account

>There are some things that users in Administrators group still can't do. Hence the need for TrustedInstaller perms.

By "this exploit" I was referring to the exploit mentioned in the article, not whatever gp did to get trustedinstaller permissions. As far as I know I don't see why you'd need access to the SAM file to give yourself trustedinstaller permissions. You can do that yourself if you're administrator.

Also, from a security point of view there isn't much that administrators can't do. You're right that they can't directly delete certain files, but they can take ownership of any file they want and adjust the ACLs to give them the required permissions. I don't think is some sort of EoP/exploit/hack, but rather protection against accidental deletions (eg. https://news.ycombinator.com/item?id=23054506)

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#128

Post by staticman2 »

withinboredom wrote: post #113
IggleSniggle wrote: post #91

Earlier quoted context omitted.

But doesn’t Windows 10 ship with device encryption? Ie full disk encryption? I thought that’s exactly what this was, which is what I’m not understanding. How can you see data if the device is encrypted?

It isn't enabled by default, you have to turn it on. It also isn't included in the home edition at all.

Windows home supports device encryption if you meet certain hardware requirements. (A TPM 2.0 chip, apparently) My laptop doesn't meet those requirements so I've never looked into it further.

Windows pro supports encryption with all hardware.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#129

Post by Sebb767 »

techrat wrote: post #125
Sebb767 wrote: post #121

Earlier quoted context omitted.

Maybe you should have read my comment (or the previous one): > We agree on iOS, but the grandparent talked about PCs - iOS really does not fall into that category (that's why I explicitly mentioned smartphones).

> > > Android basically invented that. > > Prior art. > Watch me dance. Okay.

I mentioned that exclusion in the first comment. I re-emphasized it in the second comment. If we don't limit ourselves to PCs, I raise you my PS1 - could not even play a burned CD without hardware modifications, let alone customize anything. Predates iOS by 13 years.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#130

Post by staticman2 »

alphadenied wrote: post #3

So one of the most wonderful things about relying on their proprietary closed source operating system is that you can't have external code audits. You just kind of wait for ethical people to come forward and explain bugs they've found and wonder, 1, how long has it been there, 2, how long have bad actors known about this, 3, how many other bugs are just like this or worse that they haven't found yet, 4, do I need to…

At Microsoft's size it may make more sense to just hire an auditing team who works internally.
Post reply on HN