Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

doublepulsar.com

Post reply on HN
Print view View original

131–140 of 184 posts

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#131

Post by garaetjjte »

zamadatix wrote: post #36
rwmj wrote: post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

The Windows registry is certainly a database, perhaps just not the type you're used to https://en.wikipedia.org/wiki/Hierarchical_database_model Most of the actual technical issues you list have more to do with it being extended for the last 30 years in a backwards compatible way than anything to do with it being a hierarchical db instead of a filesystem.

>for the last 30 years in a backwards compatible way

There's nothing that has to be backwards compatible in registry internal storage format, they could just design new sane format and keep old API.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#132

Post by garaetjjte »

naikrovek wrote: post #116
rwmj wrote: post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

> It amazes me that Microsoft haven't replaced the Registry how does this amaze anyone? how do people think backwards compatibility works? Microsoft, supporting Windows, promises to make every effort to maintain backwards compatibility wherever possible so that programs compiled for, say, Windows 95 will run unmodified on Windows 10. Not every program from 20+ years ago runs, but a lot do! That's a very hard thing to…

>how does this amaze anyone? how do people think backwards compatibility works?

That doesn't have anything with backwards compatibility. Nothing forces MS to stick to old ad-hoc memory dump format. Neither there is anything that would suggest registry is deprecated, new Windows components keep using it and adding piles of junk into it.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#133

Post by ylyn »

aj3 wrote: post #60
Asooka wrote: post #45

I am confused how having read access to the registry allows local privilege escalation. As a Linux user, having read access to the registry sounds like having read access to /etc, which every user already has. What sensitive data is stored in SAM that allows that?

Password hashes. /etc/shadow isn’t world readable in Linux dither

It seems like there are some cases where Windows accepts a password hash for authentication as a user though. So by having the hash of an administrator, you can escalate privileges.

I don't think there are such cases in Linux.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#134

Post by CrazyPyroLinux »

bob1029 wrote: post #114
rawoke083600 wrote: post #83

Earlier quoted context omitted.

>" for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install." I understand Linux, Mac, FreeBSD, Magic-Pony-OS is not everyone's cup of tea or they might not be in a position to choose their OS (Work etc) But DAMN that quote above is really showing me how bad it is out there ! Sure it can/does happen on oth…

I've been spending the last 48 hours strongly pondering Linux as a daily driver. If it wasn't for my crippling visual studio addiction, I'd probably be able to swap all my PCs over, with the exception of the one bastard stepchild win10 that I will keep in the closet for when BF2042 is released. Virtualization is another option that I am investigating actively now. I could even see the path for getting our product off…

I've found VSCode and dotnet 5/core be amazingly liberating from the the slow bloated mess that is Visual Studio and the old .NET Framework. This is the way it should have always been, but I'm happy we finally got here.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#135

Post by pxeboot »

bob1029 wrote: post #114
rawoke083600 wrote: post #83

Earlier quoted context omitted.

>" for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install." I understand Linux, Mac, FreeBSD, Magic-Pony-OS is not everyone's cup of tea or they might not be in a position to choose their OS (Work etc) But DAMN that quote above is really showing me how bad it is out there ! Sure it can/does happen on oth…

I've been spending the last 48 hours strongly pondering Linux as a daily driver. If it wasn't for my crippling visual studio addiction, I'd probably be able to swap all my PCs over, with the exception of the one bastard stepchild win10 that I will keep in the closet for when BF2042 is released. Virtualization is another option that I am investigating actively now. I could even see the path for getting our product off…

>Microsoft should consider a "hacker" build of windows that starts as a bare-ass powershell prompt

WinPE? Server Core?

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#136

Post by joshtynjala »

Wowfunhappy wrote: post #120
aftbit wrote: post #88

Earlier quoted context omitted.

IMO if you expand PC to cover mobile computing, the real tragedy is iPhone. No sideloading, very restrictive app store policies, and no custom OSes at all. At least with a Windows desktop or laptop, you can run Linux or one of the other actually free OSes. Modern MacOS is also pretty unfriendly for developers and power users, but at least Apple is somewhat aligned with users on privacy and security, unlike Microsoft.

> Modern MacOS is also pretty unfriendly for developers and power users. It has become somewhat unfriendly, but I really appreciate that you can still do whatever you want. To run self-signed apps, run `sudo spctl --master-disable` To turn off System Integrity Protection, run `csrutil --disable` from recovery mode. To modify the root filesystem, do all of the above and run `csrutil authenticated-root disable` from re…

There’s a safer way to run self-signed software on macOS, for anyone that prefers not to do the master disable. First, try to run the program. When it fails, open Settings.app and go to the security section. You’ll find the most recently blocked program name mentioned and an Allow button that will remove the block. Then, you can run the program. You need to do this only once per program.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#137

Post by throwawayboise »

pxeboot wrote: post #135
bob1029 wrote: post #114

Earlier quoted context omitted.

I've been spending the last 48 hours strongly pondering Linux as a daily driver. If it wasn't for my crippling visual studio addiction, I'd probably be able to swap all my PCs over, with the exception of the one bastard stepchild win10 that I will keep in the closet for when BF2042 is released. Virtualization is another option that I am investigating actively now. I could even see the path for getting our product off…

>Microsoft should consider a "hacker" build of windows that starts as a bare-ass powershell prompt WinPE? Server Core?

Is LTSC still offered? That was a pretty minimal (though still GUI) install last time I tried it. Also I think it only gets security updates, and only when you initiate the update process.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#138

Post by api »

joshtynjala wrote: post #136
Wowfunhappy wrote: post #120

Earlier quoted context omitted.

> Modern MacOS is also pretty unfriendly for developers and power users. It has become somewhat unfriendly, but I really appreciate that you can still do whatever you want. To run self-signed apps, run `sudo spctl --master-disable` To turn off System Integrity Protection, run `csrutil --disable` from recovery mode. To modify the root filesystem, do all of the above and run `csrutil authenticated-root disable` from re…

There’s a safer way to run self-signed software on macOS, for anyone that prefers not to do the master disable. First, try to run the program. When it fails, open Settings.app and go to the security section. You’ll find the most recently blocked program name mentioned and an Allow button that will remove the block. Then, you can run the program. You need to do this only once per program.

Right click open. Fail. Right click open again, hit okay, and it will succeed. It remembers your decision. This has been the magic incantation since signing was introduced.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#139

Post by Wowfunhappy »

jsjohnst wrote: post #122
aftbit wrote: post #88

Earlier quoted context omitted.

IMO if you expand PC to cover mobile computing, the real tragedy is iPhone. No sideloading, very restrictive app store policies, and no custom OSes at all. At least with a Windows desktop or laptop, you can run Linux or one of the other actually free OSes. Modern MacOS is also pretty unfriendly for developers and power users, but at least Apple is somewhat aligned with users on privacy and security, unlike Microsoft.

> the real tragedy is iPhone. No sideloading I’m so tired of seeing folks parroting no sideloading on iOS. That’s not been true for a long time. Yes, the conditions of side loading (needs a free developer account, must have app signing refreshed weekly, etc) might not be palatable for your taste (which I’d generally agree), but to say it’s not possible to sideload apps on a stock iOS device is just wrong.

IMO, saying "no side-loading" is as good as correct, and getting technical about it just creates confusion and muddies the waters. Unless you're paying $99 per year for a developer account, what little sideloading Apple offers is completely useless for anything but limited testing. Who wants to reinstall an app they actually use every seven days?

The semi-exception is Altstore, which is a fantastic project... but it's a major hack which sometimes breaks, and which Apple is liable to kill at any time. You also need to keep a server running on a PC or Mac on your wifi network, which isn't workable in a lot of situations.

I mean, my iPhone can run unsandboxed sideloaded apps, because it's jailbroken. But I wouldn't say that Apple allows third-party unsandboxed apps.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#140

Post by bob1029 »

CrazyPyroLinux wrote: post #134
bob1029 wrote: post #114

Earlier quoted context omitted.

I've been spending the last 48 hours strongly pondering Linux as a daily driver. If it wasn't for my crippling visual studio addiction, I'd probably be able to swap all my PCs over, with the exception of the one bastard stepchild win10 that I will keep in the closet for when BF2042 is released. Virtualization is another option that I am investigating actively now. I could even see the path for getting our product off…

I've found VSCode and dotnet 5/core be amazingly liberating from the the slow bloated mess that is Visual Studio and the old .NET Framework. This is the way it should have always been, but I'm happy we finally got here.

Do razor components work in vscode? Like w/ breakpoints and such?
Post reply on HN