Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

doublepulsar.com

Post reply on HN
Print view View original

31–40 of 184 posts

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#31

Post by ptx »

withinboredom wrote: post #15
woliveirajr wrote: post #2

> There’s no patches, it’s a zero day. Seems that MS just released articles on how to prevent it but no update/patch. Perhaps it's hard to fix, i.e., too many things on windows rely on it?

Or perhaps, once someone installs untrusted software in the first place, you’re screwed anyway? This is security 101. AFAIK, you can login as a local admin since forever and it’s never been fixed. I just used it recently to access a deceased relative’s computer.

If all the OS security measures are useless in the face of untrusted software, why were they introduced? Should we just run Windows 98 and FAT32 on our servers since it's apparently basic security knowledge that Windows NT's system of user accounts and permissions doesn't work?

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#32

Post by ape4 »

rwmj wrote: post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

I imagine that the registry is optimized for many small values (eg a DWORD - 4 bytes). Most filesystems wouldn't be very efficient with tons of 4 byte files.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#34

Post by pjmlp »

formerly_proven wrote: post #11
pjmlp wrote: post #9

Earlier quoted context omitted.

OpenSSL code audits having been great, hence why it is such a good example of FOSS secure software.

But why, yes. OpenSSL has seen vast improvements, not just in code, but also in processes, and multiple audits due to Heartbleed.

After how many years of deployment into production?

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#35

Post by gogopuppygogo »

nullwarp wrote: post #33
denton-scratch wrote: post #10

Not willing to "sign in with Google". Didn't read (just the comments).

What is up with Medium requiring a google or facebook account to read posts now?

They need to make money. I guess they gave up on advertising directly and instead want to capture our info alongside what we read on the website to build profiles they can sell to marketers.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#36

Post by zamadatix »

rwmj wrote: post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

The Windows registry is certainly a database, perhaps just not the type you're used to https://en.wikipedia.org/wiki/Hierarchical_database_model

Most of the actual technical issues you list have more to do with it being extended for the last 30 years in a backwards compatible way than anything to do with it being a hierarchical db instead of a filesystem.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#37

Post by technion »

nullwarp wrote: post #33
denton-scratch wrote: post #10

Not willing to "sign in with Google". Didn't read (just the comments).

What is up with Medium requiring a google or facebook account to read posts now?

You appear to be able to bypass it by opening the page in incognito mode.

It does leave me more likely to skip content I find on medium - this particular blog has the type of content that would make it a rare exception.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#38

Post by wongarsu »

withinboredom wrote: post #15
woliveirajr wrote: post #2

> There’s no patches, it’s a zero day. Seems that MS just released articles on how to prevent it but no update/patch. Perhaps it's hard to fix, i.e., too many things on windows rely on it?

Or perhaps, once someone installs untrusted software in the first place, you’re screwed anyway? This is security 101. AFAIK, you can login as a local admin since forever and it’s never been fixed. I just used it recently to access a deceased relative’s computer.

Windows is a multiuser system and tries to give you a reliable security barrier between two (non-admin) users. And at least since Windows Vista it puts some effort into preventing non-elevated software from gaining admin rights, limiting the amount of damage it can do somewhat.

Of course in reality installing any untrusted software on a computer that's not airgapped from everything you care about isn't safe. But that doesn't mean we shouldn't at least try to give better security guarantees.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#40

Post by throwaway09223 »

ape4 wrote: post #32
rwmj wrote: post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

I imagine that the registry is optimized for many small values (eg a DWORD - 4 bytes). Most filesystems wouldn't be very efficient with tons of 4 byte files.

A registryfs would be. The data structures underpinning access would not need to change.

The importance of using a filesystem interface is reuse of the access control mechanisms and filesystem API. It would avoid the type of bug above, due to nesting a hierarchical permissioned structure inside a file.

Post reply on HN