Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

doublepulsar.com

Post reply on HN
Print view View original

61–70 of 184 posts

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#61

Post by rwmj »

shawnz wrote: post #54
rwmj wrote: post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

Certainly there is a lot of legacy with the registry, but how would any of these issues be improved by moving to a file based config? All these issues could still exist under that model, and there would be new issues too. Like for example, you already point out how the type system in the registry is very limited. But isn't the filesystem even worse? Everything there is binary blobs with no types at all. So how does t…

The problem with hive is that the type has to be set correctly yet several types have no established meaning. For example it's totally random whether a number will be stored in binary with type DWORD or stored as a string (with who knows what type and encoding). However store it in a different way when writing to the registry and Windows or whatever app wants to read that field will break. In a way it's worse than if it wasn't present at all.

NTFS specifically has file forks ("Alternate Data Streams") and I guess you could use those to store a type, although whether using forks would be a good idea or not is up for debate.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#62

Post by zamadatix »

jaclaz wrote: post #48
zamadatix wrote: post #36

Earlier quoted context omitted.

The Windows registry is certainly a database, perhaps just not the type you're used to https://en.wikipedia.org/wiki/Hierarchical_database_model Most of the actual technical issues you list have more to do with it being extended for the last 30 years in a backwards compatible way than anything to do with it being a hierarchical db instead of a filesystem.

I still see it as a file system, very similar to NTFS (similar in the sense of having similar features), apart the (recent) project just mentioned (ProjFS) there existed a file system like driver for it, only for the record: http://reboot.pro/topic/7681-the-registry-as-a-filesystem/ https://web.archive.org/web/20090413131629/http://czwsoft.dy... https://web.archive.org/web/20140401212651/http://pasotech.a... And: htt…

It probably seems similar because file systems are typically classified as a type of hierarchical db themselves. That being said "I can represent it with a file in a filesystem" is different from "it is a filesystem" in posix (nearly) everything is accessible through the filesystem, even network sockets, it doesn't mean everything's canonical representation is a filesystem it just means it's mappable.

Regardless the point wasn't "a filesystem couldn't represent a rewritten registry" it was that the registry is actually a database today (whether viewed as a file-system like db by the reader or hierarchical db it is listed as) and the rest of the technical problems have to do with it being 30 years old and not rewritten not that it wasn't written with a file system representation as primary view in the first place.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#63

Post by IggleSniggle »

withinboredom wrote: post #21
londons_explore wrote: post #18

Earlier quoted context omitted.

I was surprised to find that a modern windows 10 machine (with all default security options) could have the user password bypassed easily with a Windows setup USB. I could then read all the user's documents. I thought the point of disk encryption and secure boot was to prevent that. Yet somehow the hole of allowing Windows setup to give you a privileged command prompt with a decrypted disk was never closed...

This is true of just about any OS though. Linux and OSX has/had single user mode, for example.

I don’t understand. What’s the point of having an encrypted disk if it can be decrypted by any old USB-loaded OS?

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#65

Post by jaclaz »

zamadatix wrote: post #62
jaclaz wrote: post #48

Earlier quoted context omitted.

I still see it as a file system, very similar to NTFS (similar in the sense of having similar features), apart the (recent) project just mentioned (ProjFS) there existed a file system like driver for it, only for the record: http://reboot.pro/topic/7681-the-registry-as-a-filesystem/ https://web.archive.org/web/20090413131629/http://czwsoft.dy... https://web.archive.org/web/20140401212651/http://pasotech.a... And: htt…

It probably seems similar because file systems are typically classified as a type of hierarchical db themselves. That being said "I can represent it with a file in a filesystem" is different from "it is a filesystem" in posix (nearly) everything is accessible through the filesystem, even network sockets, it doesn't mean everything's canonical representation is a filesystem it just means it's mappable. Regardless the…

From the "rant" rwmj just posted a link to:

https://rwmj.wordpress.com/2010/02/18/why-the-windows-regist...

>This misses the point: the Registry is a filesystem. Sure it’s stored in a file, but so is ext3 if you choose to store it in a loopback mount. The Registry binary format has all the aspects of a filesystem: things corresponding to directories, inodes, extended attributes etc.

> The major difference is that this Registry filesystem format is half-arsed. The format is badly constructed, fragile, endian-specific, underspecified and slow.

Anyway, file systems and databases are essentially similar, the point revolves more around the poor implementation of the Registry (whatever it is).

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#66

Post by shawnz »

rwmj wrote: post #61
shawnz wrote: post #54

Earlier quoted context omitted.

Certainly there is a lot of legacy with the registry, but how would any of these issues be improved by moving to a file based config? All these issues could still exist under that model, and there would be new issues too. Like for example, you already point out how the type system in the registry is very limited. But isn't the filesystem even worse? Everything there is binary blobs with no types at all. So how does t…

The problem with hive is that the type has to be set correctly yet several types have no established meaning. For example it's totally random whether a number will be stored in binary with type DWORD or stored as a string (with who knows what type and encoding). However store it in a different way when writing to the registry and Windows or whatever app wants to read that field will break. In a way it's worse than if…

This seems like the same kind of argument as saying that because JSON doesn't support the number formats I like, it would be better to use a notation that doesn't support types at all. Well, I think the reality has shown that in fact having some support for types sometimes is the more pragmatic way of doing things.

If those types aren't enough for your use case, then you will be forced to roll your own types in some binary/string data anyway, so it seems like it's strictly more work if you just always force everyone to roll their own.

And even then you still end up with the possibility of people using the wrong syntax for your hand-rolled types, like not quoting values that are supposed to be strings or quoting values that are supposed to be numbers.

Besides, wouldn't it be easier to fix this just by adding some more types, or deprecating everything except REG_SZ or something? What's the advantage of moving to a directory based model?

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#67

Post by throwaway09223 »

tjoff wrote: post #52
throwaway09223 wrote: post #41

Earlier quoted context omitted.

I have the same strong feelings about walled sites and tracking. May I recommend installing an extension to disable paywalls/tracking? Something like https://github.com/iamadamdev/bypass-paywalls-chrome (supports firefox despite the project name) which automatically wipes cookies from sites like Medium which enable "sign on" requirements after so many visits. It really improves the browsing experience. I used to open…

Then why visit such sites? I deliberately do not install extensions that hide problems for me. I want it to be cumbersome. I want to get annoyed so that I get discouraged to use the site in the first place, and I get reminded of that fact with every single visit. If the few that do care still visits there is no incitement for the site to not do it.

Sure, I understand that philosophy and I think it's valid as well.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#68

Post by chungy »

bob1029 wrote: post #23

I am legitimately not sure if this is a bug or a feature. I'll take all the side-channels I can get though. These "exploits" are really useful for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install.

Feature, I'd say. Volume Shadow Copies are used to make consistent online backups of an NTFS file system. I don't think non-admin users are normally able to make them in the first place, and if admin is required, it's hard to see the fuss.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#69

Post by gruez »

majkinetor wrote: post #55
bob1029 wrote: post #23

I am legitimately not sure if this is a bug or a feature. I'll take all the side-channels I can get though. These "exploits" are really useful for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install.

Yeah, it was the only way to remove defender. Then I used debloaters and shutup10 to remove all other "features". Windows didn't like it and returned ALL of them on update. Now I disabled update, and are totally motivated to go back to linux. Luckily all the tools I use on Windows are x-platform and with PowerShell, vscode, sql server etc. on linux and games working nothing holds me any more. I will probably miss Aut…

>Yeah, it was the only way to remove defender

Why not just disable it using group policy?

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#70

Post by throwaway09223 »

zamadatix wrote: post #53
throwaway09223 wrote: post #46

Earlier quoted context omitted.

Yes but a filesystem is also a hierarchical database. A filesystem solves these issues specifically because it avoids reimplementation. As the registry has been extended as you say it approaches parity with filesystem functionality, but on a parallel track. At a high level, avoiding multiple implementations of similar metaphors is ideal in terms of security. Reuse what you have.

I'd agree a filesystem is also a type of hierarchical database but the author doesn't think so: "Back to point 1, the Registry is a half-assed, poor quality implementation of a filesystem. Importantly, it’s not a database. It should be a database!" Noting "not a database" is bolded.

Sure, and I would agree with you here.

These are the kinds of categorizations that people can go nuts over. Rather than get too hung up on words I'd say that whatever this is, it can effectively be represented by a filesystem and therefore it should be as a matter of general architecture and security principle.

Post reply on HN