HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10 • Hacker News Board

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#41

Post by throwaway09223 » Sat, Jul 24, 2021, 1:38 PM UTC

denton-scratch wrote: post #10

Not willing to "sign in with Google". Didn't read (just the comments).

I have the same strong feelings about walled sites and tracking. May I recommend installing an extension to disable paywalls/tracking? Something like https://github.com/iamadamdev/bypass-paywalls-chrome (supports firefox despite the project name) which automatically wipes cookies from sites like Medium which enable "sign on" requirements after so many visits. It really improves the browsing experience.

I used to open these sites incognito or delete the cookies manually but it's really such an annoyance. Better to automate the policy of disallowing these folks to store cookies.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#42

Post by wongarsu » Sat, Jul 24, 2021, 1:39 PM UTC

ape4 wrote: post #32

rwmj wrote: post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

I imagine that the registry is optimized for many small values (eg a DWORD - 4 bytes). Most filesystems wouldn't be very efficient with tons of 4 byte files.

Just naively translating the registry into a NTFS directory structure would require 1kb per value, simply because that's the size of a file record (NTFS already has an optimization to store small files directly in the file record if it fits in next to all the attributes and ACLs).

Also the Windows Filesystem driver stack is not very efficient for accessing many small files. It's built for flexibility and security, not speed.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#43

Post by anthk » Sat, Jul 24, 2021, 1:40 PM UTC

rwmj wrote: post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

Wine exposes the registry as a file.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#44

Post by anthk » Sat, Jul 24, 2021, 1:41 PM UTC

ape4 wrote: post #32

rwmj wrote: post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

I imagine that the registry is optimized for many small values (eg a DWORD - 4 bytes). Most filesystems wouldn't be very efficient with tons of 4 byte files.

Wine exposes the registry as a file.

Current machines aren't the ones as Windows 98 with 32MB of RAM requiring binary configs for the OS everywhere.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#45

Post by Asooka » Sat, Jul 24, 2021, 1:41 PM UTC

I am confused how having read access to the registry allows local privilege escalation. As a Linux user, having read access to the registry sounds like having read access to /etc, which every user already has. What sensitive data is stored in SAM that allows that?

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#46

Post by throwaway09223 » Sat, Jul 24, 2021, 1:42 PM UTC

zamadatix wrote: post #36

rwmj wrote: post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

The Windows registry is certainly a database, perhaps just not the type you're used to https://en.wikipedia.org/wiki/Hierarchical_database_model Most of the actual technical issues you list have more to do with it being extended for the last 30 years in a backwards compatible way than anything to do with it being a hierarchical db instead of a filesystem.

Yes but a filesystem is also a hierarchical database.

A filesystem solves these issues specifically because it avoids reimplementation. As the registry has been extended as you say it approaches parity with filesystem functionality, but on a parallel track.

At a high level, avoiding multiple implementations of similar metaphors is ideal in terms of security. Reuse what you have.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#47

Post by rurban » Sat, Jul 24, 2021, 1:43 PM UTC

anthk wrote: post #43

rwmj wrote: post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

Wine exposes the registry as a file.

Cygwin also. Extremely trivial implementation

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#48

Post by jaclaz » Sat, Jul 24, 2021, 1:43 PM UTC

zamadatix wrote: post #36

rwmj wrote: post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

The Windows registry is certainly a database, perhaps just not the type you're used to https://en.wikipedia.org/wiki/Hierarchical_database_model Most of the actual technical issues you list have more to do with it being extended for the last 30 years in a backwards compatible way than anything to do with it being a hierarchical db instead of a filesystem.

I still see it as a file system, very similar to NTFS (similar in the sense of having similar features), apart the (recent) project just mentioned (ProjFS) there existed a file system like driver for it, only for the record:

http://reboot.pro/topic/7681-the-registry-as-a-filesystem/

https://web.archive.org/web/20090413131629/http://czwsoft.dy...

https://web.archive.org/web/20140401212651/http://pasotech.a...

And:

https://github.com/jbruchon/winregfs

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#49

Post by Sebb767 » Sat, Jul 24, 2021, 1:45 PM UTC

zamadatix wrote: post #36

rwmj wrote: post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

The Windows registry is certainly a database, perhaps just not the type you're used to https://en.wikipedia.org/wiki/Hierarchical_database_model Most of the actual technical issues you list have more to do with it being extended for the last 30 years in a backwards compatible way than anything to do with it being a hierarchical db instead of a filesystem.

Technically a file system is just a special database. I think a better formulation of the authors point would be "the registry is a lot like a file system, even though a more traditional database approach or fully embracing it as a file system would have probably worked out better".

Also, they would have been able to at least improve the on-disk format with a major version; I highly doubt that the registry itself is backwards-compatible anyway and there are probably very few programs that access it directly.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#50

Post by formerly_proven » Sat, Jul 24, 2021, 1:48 PM UTC

pjmlp wrote: post #34

formerly_proven wrote: post #11

Earlier quoted context omitted.

But why, yes. OpenSSL has seen vast improvements, not just in code, but also in processes, and multiple audits due to Heartbleed.

After how many years of deployment into production?

If you're asking me personally, OpenSSL always had a funny smell even at the time, and so did TLS, simply because it seemed all way too complicated. TLS v1.3 agrees. As far as TLS implementations go I think pretty much all of them have had major, critical flaws. Microsoft's SChannel has had an RCE since it was born, patched the same year as Heartbleed, Apple's Secure Transport had goto fail (also in 2014 if I recall) etc.