Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

doublepulsar.com

Post reply on HN
Print view View original

71–80 of 184 posts

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#71

Post by gruez »

chungy wrote: post #68
bob1029 wrote: post #23

I am legitimately not sure if this is a bug or a feature. I'll take all the side-channels I can get though. These "exploits" are really useful for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install.

Feature, I'd say. Volume Shadow Copies are used to make consistent online backups of an NTFS file system. I don't think non-admin users are normally able to make them in the first place, and if admin is required, it's hard to see the fuss.

>I don't think non-admin users are normally able to make them in the first place, and if admin is required, it's hard to see the fuss.

shadow copies are automatically created as part of system protection (enabled by default).

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#72

Post by zamadatix »

jaclaz wrote: post #65
zamadatix wrote: post #62

Earlier quoted context omitted.

It probably seems similar because file systems are typically classified as a type of hierarchical db themselves. That being said "I can represent it with a file in a filesystem" is different from "it is a filesystem" in posix (nearly) everything is accessible through the filesystem, even network sockets, it doesn't mean everything's canonical representation is a filesystem it just means it's mappable. Regardless the…

From the "rant" rwmj just posted a link to: https://rwmj.wordpress.com/2010/02/18/why-the-windows-regist... >This misses the point: the Registry is a filesystem. Sure it’s stored in a file, but so is ext3 if you choose to store it in a loopback mount. The Registry binary format has all the aspects of a filesystem: things corresponding to directories, inodes, extended attributes etc. > The major difference is that thi…

I think everyone is in agreement it's bad, as I said:

> Most of the actual technical issues you list have more to do with it being extended for the last 30 years in a backwards compatible way than anything to do with it being a hierarchical db instead of a filesystem.

My first line about it being a database was about point 7 in the same link:

> Back to point 1, the Registry is a half-assed, poor quality implementation of a filesystem. Importantly, it’s not a database. It should be a database!

With "not a database" in bold.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#74

Post by zamadatix »

throwaway09223 wrote: post #70
zamadatix wrote: post #53

Earlier quoted context omitted.

I'd agree a filesystem is also a type of hierarchical database but the author doesn't think so: "Back to point 1, the Registry is a half-assed, poor quality implementation of a filesystem. Importantly, it’s not a database. It should be a database!" Noting "not a database" is bolded.

Sure, and I would agree with you here. These are the kinds of categorizations that people can go nuts over. Rather than get too hung up on words I'd say that whatever this is, it can effectively be represented by a filesystem and therefore it should be as a matter of general architecture and security principle.

I'm actually with the author that if it were going to be rewritten a freshly written columnar database would be way more efficient than representing it as a filesystem but that either would be better than what we have after 30 years. I just don't think "it wasn't a filesystem originally" has much to do with why it's so crap now. Similar case: posix specifies network sockets be accessed as files/filesystems (as most everything in posix is) but nobody actually used that representation because it's inefficient even though it's the standard and easily mappable to files/filesystems. Well I think Solaris actually allows both but the point stands.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#75

Post by selfhoster11 »

IggleSniggle wrote: post #63
withinboredom wrote: post #21

Earlier quoted context omitted.

This is true of just about any OS though. Linux and OSX has/had single user mode, for example.

I don’t understand. What’s the point of having an encrypted disk if it can be decrypted by any old USB-loaded OS?

A user password doesn't enable encryption. Bitlocker or another Full Disk Encryption solution is what you would want to use. If you can see the data, that means it's not encrypted.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#77

Post by selfhoster11 »

withinboredom wrote: post #19
user-the-name wrote: post #17

Earlier quoted context omitted.

Every computer spends pretty much every hour of every day running untrusted software. There is nothing more common than running untrusted software. This kind of attitude is completely useless.

I wasn’t being literal. To clarify, I meant some random person installing some random software without your knowledge type of untrusted software.

AKA JavaScript on websites? Sure, it's sandboxed to the Moon, but it's still random people "installing" software on your computer.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#78

Post by selfhoster11 »

alphadenied wrote: post #3

So one of the most wonderful things about relying on their proprietary closed source operating system is that you can't have external code audits. You just kind of wait for ethical people to come forward and explain bugs they've found and wonder, 1, how long has it been there, 2, how long have bad actors known about this, 3, how many other bugs are just like this or worse that they haven't found yet, 4, do I need to…

Microsoft can easily pay for external software audits. They just need them to sign an NDA or other agreement that the access to code is only to be used to audit the code, and nothing else.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#79

Post by zamadatix »

Sebb767 wrote: post #49
zamadatix wrote: post #36

Earlier quoted context omitted.

The Windows registry is certainly a database, perhaps just not the type you're used to https://en.wikipedia.org/wiki/Hierarchical_database_model Most of the actual technical issues you list have more to do with it being extended for the last 30 years in a backwards compatible way than anything to do with it being a hierarchical db instead of a filesystem.

Technically a file system is just a special database. I think a better formulation of the authors point would be "the registry is a lot like a file system, even though a more traditional database approach or fully embracing it as a file system would have probably worked out better". Also, they would have been able to at least improve the on-disk format with a major version; I highly doubt that the registry itself is…

That's a really good take on what the author was going for, I appreciate the take! I still disagree that it starting out as a filesystem or database has anything to do with why it's so crap 30 years later but it gets to the crux of the topic much quicker.

With how tightly the APIs for accessing the registry are coupled with the model and encodings of the registry, particularly the driver APIs for it, I don't think it would have been so easy to just swap out the back end without breaking something though (which Windows avoids like the plague) but maybe doable by someone more optimistic than me :). The real "rewrite" was the push for Universal Windows apps using the .NET platform which stores everything for the app in XML files and shadow directories instead of the registry. Of course that didn't take over quite like they hoped so they ended up back with using the registry they were trying to leave 10 years later.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#80

Post by malwarebytess »

gruez wrote: post #69
majkinetor wrote: post #55

Earlier quoted context omitted.

Yeah, it was the only way to remove defender. Then I used debloaters and shutup10 to remove all other "features". Windows didn't like it and returned ALL of them on update. Now I disabled update, and are totally motivated to go back to linux. Luckily all the tools I use on Windows are x-platform and with PowerShell, vscode, sql server etc. on linux and games working nothing holds me any more. I will probably miss Aut…

>Yeah, it was the only way to remove defender Why not just disable it using group policy?

Because he wants to removed unwanted software from his machine, not disable it. It's not dissimilar to being unable to remove bundled software on android.
Post reply on HN