Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

doublepulsar.com

Post reply on HN
Print view View original

51–60 of 184 posts

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#51

Post by rwmj »

Randor wrote: post #26
rwmj wrote: post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

Hi, Actually you can use the Windows Projected File System to project the registry into the file system, making registry keys and values appear as files and directories. https://github.com/Microsoft/Windows-classic-samples/tree/ma...

Something is still translating the virtual files back and forth to the half-arsed hive format. Would recommend reading the link I posted since I have actually reverse-engineered the hive format.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#52

Post by tjoff »

throwaway09223 wrote: post #41
denton-scratch wrote: post #10

Not willing to "sign in with Google". Didn't read (just the comments).

I have the same strong feelings about walled sites and tracking. May I recommend installing an extension to disable paywalls/tracking? Something like https://github.com/iamadamdev/bypass-paywalls-chrome (supports firefox despite the project name) which automatically wipes cookies from sites like Medium which enable "sign on" requirements after so many visits. It really improves the browsing experience. I used to open…

Then why visit such sites? I deliberately do not install extensions that hide problems for me. I want it to be cumbersome. I want to get annoyed so that I get discouraged to use the site in the first place, and I get reminded of that fact with every single visit.

If the few that do care still visits there is no incitement for the site to not do it.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#53

Post by zamadatix »

throwaway09223 wrote: post #46
zamadatix wrote: post #36

Earlier quoted context omitted.

The Windows registry is certainly a database, perhaps just not the type you're used to https://en.wikipedia.org/wiki/Hierarchical_database_model Most of the actual technical issues you list have more to do with it being extended for the last 30 years in a backwards compatible way than anything to do with it being a hierarchical db instead of a filesystem.

Yes but a filesystem is also a hierarchical database. A filesystem solves these issues specifically because it avoids reimplementation. As the registry has been extended as you say it approaches parity with filesystem functionality, but on a parallel track. At a high level, avoiding multiple implementations of similar metaphors is ideal in terms of security. Reuse what you have.

I'd agree a filesystem is also a type of hierarchical database but the author doesn't think so:

"Back to point 1, the Registry is a half-assed, poor quality implementation of a filesystem. Importantly, it’s not a database. It should be a database!"

Noting "not a database" is bolded.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#54

Post by shawnz »

rwmj wrote: post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

Certainly there is a lot of legacy with the registry, but how would any of these issues be improved by moving to a file based config? All these issues could still exist under that model, and there would be new issues too.

Like for example, you already point out how the type system in the registry is very limited. But isn't the filesystem even worse? Everything there is binary blobs with no types at all. So how does that improve things?

It seems like your complains don't really have to do with the "directory" structure of the registry much, so I don't think moving to a file based model would really change anything. You'd just end up with the same legacy issues, but spread across more files.

Finally, AppData wasn't introduced with Vista, but rather it's always been there if applications need to store file-based data rather than individual configuration values. That is not a new or improved way of doing things as you seem to imply in the post.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#55

Post by majkinetor »

bob1029 wrote: post #23

I am legitimately not sure if this is a bug or a feature. I'll take all the side-channels I can get though. These "exploits" are really useful for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install.

Yeah, it was the only way to remove defender. Then I used debloaters and shutup10 to remove all other "features". Windows didn't like it and returned ALL of them on update. Now I disabled update, and are totally motivated to go back to linux.

Luckily all the tools I use on Windows are x-platform and with PowerShell, vscode, sql server etc. on linux and games working nothing holds me any more. I will probably miss Autohotkey and Foobar2k (maybe total commander but Dobulecmd is decent alternative and much better in some domains).

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#56

Post by Datagenerator »

bob1029 wrote: post #23

I am legitimately not sure if this is a bug or a feature. I'll take all the side-channels I can get though. These "exploits" are really useful for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install.

Due this feature or was this possible normally too? Any links?

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#57

Post by rwmj »

anthk wrote: post #43
rwmj wrote: post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

Wine exposes the registry as a file.

Implementing the registry APIs, but backed by a regular filesystem (as Wine does) would be the sensible thing for Windows to do. (I looked at the source of Wine just now and I'm fairly sure nowhere does it process hive files.)

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#58

Post by gruez »

bob1029 wrote: post #23

I am legitimately not sure if this is a bug or a feature. I'll take all the side-channels I can get though. These "exploits" are really useful for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install.

>I'll take all the side-channels I can get though. These "exploits" are really useful for regaining control over my own PC.

Not really? What does this exploit let you do that you couldn't already do with a local administrator account? Or are you making the general argument that "EoP exploits are features because they allow you to jailbreak your device"?

>Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install.

They're not really comparable. You need admin to do it, which means you already crossed the security boundary[1]. This is in contrast to this exploit which allows you to cross a security boundary.

[1] https://devblogs.microsoft.com/oldnewthing/20121207-00/?p=58...

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#59

Post by cjones26 »

Asooka wrote: post #45

I am confused how having read access to the registry allows local privilege escalation. As a Linux user, having read access to the registry sounds like having read access to /etc, which every user already has. What sensitive data is stored in SAM that allows that?

Agreed. The article also does not seem to explain it. From what I understood the SAM only stores encrypted password hashes, nothing that could be readily exploited for local privilege escalation.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#60

Post by aj3 »

Asooka wrote: post #45

I am confused how having read access to the registry allows local privilege escalation. As a Linux user, having read access to the registry sounds like having read access to /etc, which every user already has. What sensitive data is stored in SAM that allows that?

Password hashes. /etc/shadow isn’t world readable in Linux dither
Post reply on HN