Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

doublepulsar.com

Post reply on HN
Print view View original

91–100 of 184 posts

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#91

Post by IggleSniggle »

selfhoster11 wrote: post #75
IggleSniggle wrote: post #63

Earlier quoted context omitted.

I don’t understand. What’s the point of having an encrypted disk if it can be decrypted by any old USB-loaded OS?

A user password doesn't enable encryption. Bitlocker or another Full Disk Encryption solution is what you would want to use. If you can see the data, that means it's not encrypted.

But doesn’t Windows 10 ship with device encryption? Ie full disk encryption? I thought that’s exactly what this was, which is what I’m not understanding. How can you see data if the device is encrypted?

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#92

Post by gruez »

bob1029 wrote: post #86
gruez wrote: post #69

Earlier quoted context omitted.

>Yeah, it was the only way to remove defender Why not just disable it using group policy?

Totally removing defender as TI is the only option if you dont want it turning itself back on arbitrarily. I went through this hell yesterday for about 3 hours.

>Totally removing defender as TI is the only option if you dont want it turning itself back on arbitrarily

I disabled it via group policy 2 years ago and just checked, still disabled.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#93

Post by wutwutwutwut »

coliveira wrote: post #25
codetrotter wrote: post #4

Earlier quoted context omitted.

Microsoft Windows is proprietary software yes, but they have something called the Shared Source Initiative. > Through the Shared Source Initiative Microsoft licenses product source code to qualified customers, enterprises, governments, and partners for debugging and reference purposes. https://www.microsoft.com/en-us/sharedsource/ I say this as someone who doesn’t like Windows and doesn’t run Windows. We still need t…

The key question is: would they let people who want to find bugs? Because that is the point here, if you can read the software but not allowed to do an audit, it doesn't make any difference (for the issue that we're discussing).

Can you clarify the distinction? They share the source code so that other people can do auditing, obviously. But what would be the scenario where you are allowed to read the code, but you're not allowed to look for issues? Have you ever seen that set up anywhere? It would not make any sense.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#94

Post by throwaway09223 »

zamadatix wrote: post #74
throwaway09223 wrote: post #70

Earlier quoted context omitted.

Sure, and I would agree with you here. These are the kinds of categorizations that people can go nuts over. Rather than get too hung up on words I'd say that whatever this is, it can effectively be represented by a filesystem and therefore it should be as a matter of general architecture and security principle.

I'm actually with the author that if it were going to be rewritten a freshly written columnar database would be way more efficient than representing it as a filesystem but that either would be better than what we have after 30 years. I just don't think "it wasn't a filesystem originally" has much to do with why it's so crap now. Similar case: posix specifies network sockets be accessed as files/filesystems (as most e…

Sorry, I'm unfamiliar with what you mean by "network sockets be accessed as files." Do you mean unix domain sockets? These are in fact commonly used and they're certainly no less efficient (more efficient in many ways, in fact).

UDS are interfaced with via the same berkeley sockets api, not via the filesystem api. Have you ever written applications that use them?

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#95

Post by rwmj »

TheRealPomax wrote: post #85
rwmj wrote: post #24

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux ( https://github.com/libguestfs/hivex ) and after writing it I also wrote this screed about how it sucks in just about every way possible: https://rwmj.wordpress.com/2010/02/18/why-…

No thanks: the registry is a truly huge simple key/value store, which is something files-in-dirs are terrible for because almost every single one of them would take up a full block on disk instead of the fraction of a block they actually need. A better solution would be a simple database (like sqlite3) but then the immediate counter-argument is "okay, so we're done: it's already a simple database", because the regist…

The Windows registry is not a "simple key/value store" by a long shot. It is hierarchical, there are many different types of value, and there's a complex system of security attributes. These are simple facts.

You're right that a file per value would take a whole block on disk given the way some filesystems are currently implemented, but that's not an immutable feature of all filesystems - some Unix filesystems store small files in the inode. A real database is possible, but also the registry must be available very early in Windows boot (actually it's used by the bootloader, but also by the critical device database) so you'd want something that's at least easy to read with a smallish amount of code.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#96

Post by bob1029 »

gruez wrote: post #92
bob1029 wrote: post #86

Earlier quoted context omitted.

Totally removing defender as TI is the only option if you dont want it turning itself back on arbitrarily. I went through this hell yesterday for about 3 hours.

>Totally removing defender as TI is the only option if you dont want it turning itself back on arbitrarily I disabled it via group policy 2 years ago and just checked, still disabled.

What version/edition of Win10 are you on?

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#97

Post by shawnz »

rawoke083600 wrote: post #83
bob1029 wrote: post #23

I am legitimately not sure if this is a bug or a feature. I'll take all the side-channels I can get though. These "exploits" are really useful for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install.

>" for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install." I understand Linux, Mac, FreeBSD, Magic-Pony-OS is not everyone's cup of tea or they might not be in a position to choose their OS (Work etc) But DAMN that quote above is really showing me how bad it is out there ! Sure it can/does happen on oth…

If there was never an "old way" of doing things that didn't involve the new TrustedInstaller system, then would we even be thinking twice about these new restrictions? Or would we just see the restrictions as part of the design of the APIs?

Just because they took a part of the system that used to be externally facing and made it internally facing, I don't think that is the same as making "your PC not your PC anymore". If they were blocking administrators from executing arbitrary code or having arbitrary access to I/Os, that would be a different story.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#98

Post by jesboat »

cjones26 wrote: post #59
Asooka wrote: post #45

I am confused how having read access to the registry allows local privilege escalation. As a Linux user, having read access to the registry sounds like having read access to /etc, which every user already has. What sensitive data is stored in SAM that allows that?

Agreed. The article also does not seem to explain it. From what I understood the SAM only stores encrypted password hashes, nothing that could be readily exploited for local privilege escalation.

There's a video (bleh) which appears to extract the hash and then use a pass-the-hash. I'm not clear on exactly what the preconditions are (are NTLMv1/v2 hashes still stored by default? Does PTH work with newer hashes? Etc) or if there's another way to escalate

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#99

Post by jesboat »

jaclaz wrote: post #7

Possibly I am missing something, but the use of volume shadow copies or direct (RAW) disk access to retrieve particular files that are "in use" is a long time established possibility. Extents and Rawcopy were initially written several years ago: http://reboot.pro/files/file/316-extents/ https://github.com/jschicht/RawCopy Or is there something new specific to Windows 10?

I guess one way to phrase it would be "the ACLs on the registry files were always overly permissive, but nobody noticed until now because trying to read them the obvious way failed with 'file in use'"

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#100

Post by Wowfunhappy »

rawoke083600 wrote: post #83
bob1029 wrote: post #23

I am legitimately not sure if this is a bug or a feature. I'll take all the side-channels I can get though. These "exploits" are really useful for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install.

>" for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install." I understand Linux, Mac, FreeBSD, Magic-Pony-OS is not everyone's cup of tea or they might not be in a position to choose their OS (Work etc) But DAMN that quote above is really showing me how bad it is out there ! Sure it can/does happen on oth…

I’m not proud of it, but when the reporting on Pegasus came out last week I was thinking “I wonder if this could lead to a Jailbreak on iOS 15.”
Post reply on HN