Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

doublepulsar.com

Post reply on HN
Print view View original

81–90 of 184 posts

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#81

Post by gruez »

malwarebytess wrote: post #80
gruez wrote: post #69

Earlier quoted context omitted.

>Yeah, it was the only way to remove defender Why not just disable it using group policy?

Because he wants to removed unwanted software from his machine, not disable it. It's not dissimilar to being unable to remove bundled software on android.

What's the difference, that you save 200MB of disk space?

>It's not dissimilar to being unable to remove bundled software on android.

It actually makes less sense on android since bundled apps are typically installed on the /system partition, which means they don't really take up any disk space (the space allocated to the /system partition is the same regardless of whether the app is there or not).

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#83

Post by rawoke083600 »

bob1029 wrote: post #23

I am legitimately not sure if this is a bug or a feature. I'll take all the side-channels I can get though. These "exploits" are really useful for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install.

>" for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install."

I understand Linux, Mac, FreeBSD, Magic-Pony-OS is not everyone's cup of tea or they might not be in a position to choose their OS (Work etc)

But DAMN that quote above is really showing me how bad it is out there ! Sure it can/does happen on other OS as well, but I'm betting Windows is the leader in "my-pc-is-not-my-pc-anymore" :/

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#84

Post by Sebb767 »

rawoke083600 wrote: post #83
bob1029 wrote: post #23

I am legitimately not sure if this is a bug or a feature. I'll take all the side-channels I can get though. These "exploits" are really useful for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install.

>" for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install." I understand Linux, Mac, FreeBSD, Magic-Pony-OS is not everyone's cup of tea or they might not be in a position to choose their OS (Work etc) But DAMN that quote above is really showing me how bad it is out there ! Sure it can/does happen on oth…

> I'm betting Windows is the leader in "my-pc-is-not-my-pc-anymore" :/

There are PCs out there running ChromeOS and Android. Not to mention smartphones and game consoles.

Windows is not good in this regard, but it's by far not the worst (though the UX for administrative actions is really not great, IMO).

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#85

Post by TheRealPomax »

rwmj wrote: post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

No thanks: the registry is a truly huge simple key/value store, which is something files-in-dirs are terrible for because almost every single one of them would take up a full block on disk instead of the fraction of a block they actually need.

A better solution would be a simple database (like sqlite3) but then the immediate counter-argument is "okay, so we're done: it's already a simple database", because the registry hive is literally a file-backed database in the same vein as sqlite =)

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#86

Post by bob1029 »

gruez wrote: post #69
majkinetor wrote: post #55

Earlier quoted context omitted.

Yeah, it was the only way to remove defender. Then I used debloaters and shutup10 to remove all other "features". Windows didn't like it and returned ALL of them on update. Now I disabled update, and are totally motivated to go back to linux. Luckily all the tools I use on Windows are x-platform and with PowerShell, vscode, sql server etc. on linux and games working nothing holds me any more. I will probably miss Aut…

>Yeah, it was the only way to remove defender Why not just disable it using group policy?

Totally removing defender as TI is the only option if you dont want it turning itself back on arbitrarily. I went through this hell yesterday for about 3 hours.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#87

Post by tenebrisalietum »

TheRealPomax wrote: post #85
rwmj wrote: post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

No thanks: the registry is a truly huge simple key/value store, which is something files-in-dirs are terrible for because almost every single one of them would take up a full block on disk instead of the fraction of a block they actually need. A better solution would be a simple database (like sqlite3) but then the immediate counter-argument is "okay, so we're done: it's already a simple database", because the regist…

I feel this mattered much more in the mid 90's when 4GB disks were common in PCs, but with today's modern storage sizes this is trivial. Besides, the NTFS MFT already stores small files directly in the indexes.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#88

Post by aftbit »

rawoke083600 wrote: post #83
bob1029 wrote: post #23

I am legitimately not sure if this is a bug or a feature. I'll take all the side-channels I can get though. These "exploits" are really useful for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install.

>" for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install." I understand Linux, Mac, FreeBSD, Magic-Pony-OS is not everyone's cup of tea or they might not be in a position to choose their OS (Work etc) But DAMN that quote above is really showing me how bad it is out there ! Sure it can/does happen on oth…

IMO if you expand PC to cover mobile computing, the real tragedy is iPhone. No sideloading, very restrictive app store policies, and no custom OSes at all. At least with a Windows desktop or laptop, you can run Linux or one of the other actually free OSes. Modern MacOS is also pretty unfriendly for developers and power users, but at least Apple is somewhat aligned with users on privacy and security, unlike Microsoft.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#89

Post by wutwutwutwut »

formerly_proven wrote: post #50
pjmlp wrote: post #34

Earlier quoted context omitted.

After how many years of deployment into production?

If you're asking me personally, OpenSSL always had a funny smell even at the time, and so did TLS, simply because it seemed all way too complicated. TLS v1.3 agrees. As far as TLS implementations go I think pretty much all of them have had major, critical flaws. Microsoft's SChannel has had an RCE since it was born, patched the same year as Heartbleed, Apple's Secure Transport had goto fail (also in 2014 if I recall)…

But that didn't answer his question.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#90

Post by rootsudo »

bob1029 wrote: post #23

I am legitimately not sure if this is a bug or a feature. I'll take all the side-channels I can get though. These "exploits" are really useful for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install.

Huge oversight, it renders and breaks previous GPO, meaning that the tech debt in Windows NT itself is huge.

Which makes you wonder really how comfy OSX POSIX is, but they had their own fun bugs lately too, sudo for example and other ones. Plus they're doing an CPU Arch jump.

Kinda feels like the 90's again, in a sense.

Post reply on HN