HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

Post by withinboredom » Sat, Jul 24, 2021, 12:51 PM UTC

londons_explore wrote: post #18

withinboredom wrote: post #15

Earlier quoted context omitted.

Or perhaps, once someone installs untrusted software in the first place, you’re screwed anyway? This is security 101. AFAIK, you can login as a local admin since forever and it’s never been fixed. I just used it recently to access a deceased relative’s computer.

I was surprised to find that a modern windows 10 machine (with all default security options) could have the user password bypassed easily with a Windows setup USB. I could then read all the user's documents. I thought the point of disk encryption and secure boot was to prevent that. Yet somehow the hole of allowing Windows setup to give you a privileged command prompt with a decrypted disk was never closed...

Post by bob1029 » Sat, Jul 24, 2021, 12:55 PM UTC

Post by coliveira » Sat, Jul 24, 2021, 12:59 PM UTC

codetrotter wrote: post #4

alphadenied wrote: post #3

So one of the most wonderful things about relying on their proprietary closed source operating system is that you can't have external code audits. You just kind of wait for ethical people to come forward and explain bugs they've found and wonder, 1, how long has it been there, 2, how long have bad actors known about this, 3, how many other bugs are just like this or worse that they haven't found yet, 4, do I need to…

Microsoft Windows is proprietary software yes, but they have something called the Shared Source Initiative. > Through the Shared Source Initiative Microsoft licenses product source code to qualified customers, enterprises, governments, and partners for debugging and reference purposes. https://www.microsoft.com/en-us/sharedsource/ I say this as someone who doesn’t like Windows and doesn’t run Windows. We still need t…

Post by squarefoot » Sat, Jul 24, 2021, 1:03 PM UTC

codetrotter wrote: post #4

alphadenied wrote: post #3

So one of the most wonderful things about relying on their proprietary closed source operating system is that you can't have external code audits. You just kind of wait for ethical people to come forward and explain bugs they've found and wonder, 1, how long has it been there, 2, how long have bad actors known about this, 3, how many other bugs are just like this or worse that they haven't found yet, 4, do I need to…

Microsoft Windows is proprietary software yes, but they have something called the Shared Source Initiative. > Through the Shared Source Initiative Microsoft licenses product source code to qualified customers, enterprises, governments, and partners for debugging and reference purposes. https://www.microsoft.com/en-us/sharedsource/ I say this as someone who doesn’t like Windows and doesn’t run Windows. We still need t…

Post by noxer » Sat, Jul 24, 2021, 1:04 PM UTC

londons_explore wrote: post #18

withinboredom wrote: post #15

Earlier quoted context omitted.

Or perhaps, once someone installs untrusted software in the first place, you’re screwed anyway? This is security 101. AFAIK, you can login as a local admin since forever and it’s never been fixed. I just used it recently to access a deceased relative’s computer.

I was surprised to find that a modern windows 10 machine (with all default security options) could have the user password bypassed easily with a Windows setup USB. I could then read all the user's documents. I thought the point of disk encryption and secure boot was to prevent that. Yet somehow the hole of allowing Windows setup to give you a privileged command prompt with a decrypted disk was never closed...