Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

doublepulsar.com

Post reply on HN
Print view View original

1–10 of 184 posts

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#3

Post by alphadenied »

So one of the most wonderful things about relying on their proprietary closed source operating system is that you can't have external code audits. You just kind of wait for ethical people to come forward and explain bugs they've found and wonder, 1, how long has it been there, 2, how long have bad actors known about this, 3, how many other bugs are just like this or worse that they haven't found yet, 4, do I need to recreate VM images or can I trust the internal patch process to get it installed before I've been exploited, 5, does the patch actually fix the underlying security flaw or is it something they're calling a "feature" now that will always be an issue... I'm so grateful to not be a janitor for Microsoft Windows software anymore.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#4

Post by codetrotter »

alphadenied wrote: post #3

So one of the most wonderful things about relying on their proprietary closed source operating system is that you can't have external code audits. You just kind of wait for ethical people to come forward and explain bugs they've found and wonder, 1, how long has it been there, 2, how long have bad actors known about this, 3, how many other bugs are just like this or worse that they haven't found yet, 4, do I need to…

Microsoft Windows is proprietary software yes, but they have something called the Shared Source Initiative.

> Through the Shared Source Initiative Microsoft licenses product source code to qualified customers, enterprises, governments, and partners for debugging and reference purposes.

https://www.microsoft.com/en-us/sharedsource/

I say this as someone who doesn’t like Windows and doesn’t run Windows. We still need to admit that Microsoft does indeed let others read the source code, only that they decide who gets to read it and not.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#5

Post by wutwutwutwut »

alphadenied wrote: post #3

So one of the most wonderful things about relying on their proprietary closed source operating system is that you can't have external code audits. You just kind of wait for ethical people to come forward and explain bugs they've found and wonder, 1, how long has it been there, 2, how long have bad actors known about this, 3, how many other bugs are just like this or worse that they haven't found yet, 4, do I need to…

> You just kind of wait for ethical people to come forward and explain bugs they've found

And the same apply to open source software. It's not like all the bugs in open source software was fixed in audits or that you somehow magically know how long time the issue has been attacked by bad actors.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#6

Post by nolok »

alphadenied wrote: post #3

So one of the most wonderful things about relying on their proprietary closed source operating system is that you can't have external code audits. You just kind of wait for ethical people to come forward and explain bugs they've found and wonder, 1, how long has it been there, 2, how long have bad actors known about this, 3, how many other bugs are just like this or worse that they haven't found yet, 4, do I need to…

You're mixing a lot of things for no reason, the problem you describe really have very little or even nothing with open source or proprietary or even OSes.

Points 2/3/4 are exactly the same on other OSes, even open sources ones.

Point 1 might be easier to answer by yourself/someone who is not the vendor with open source OSes, while for Windows or OSX you depend on the vendor to tell you with certitude "starting with X" (which they always do). But on the other hand the centralized and streamlined patching model makes it much much easier to identify just which patch caused it, compared to "which level of package mainter or upstream caused it, is it a flaw in SOFT or in debian's SOFT-up3 or what ?"

Point 5 has nothing to do with open source either, on either you can easily test if it's fixed or not. Whether it's considered bug of feature-wont-fix is pretty much always answered so you don't have to actually ask yourself (but if they do consider it normal then you can't fix it yourself on closed source proprietary, though they usually give you a config change to get what you want).

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#7

Post by jaclaz »

Possibly I am missing something, but the use of volume shadow copies or direct (RAW) disk access to retrieve particular files that are "in use" is a long time established possibility.

Extents and Rawcopy were initially written several years ago:

http://reboot.pro/files/file/316-extents/

https://github.com/jschicht/RawCopy

Or is there something new specific to Windows 10?

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#8

Post by praseodym »

jaclaz wrote: post #7

Possibly I am missing something, but the use of volume shadow copies or direct (RAW) disk access to retrieve particular files that are "in use" is a long time established possibility. Extents and Rawcopy were initially written several years ago: http://reboot.pro/files/file/316-extents/ https://github.com/jschicht/RawCopy Or is there something new specific to Windows 10?

The vulnerability here is that regular non-administrator users can also read sensitive registry hives from the shadow copy. This allows for local privilege escalation exploits.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#9

Post by pjmlp »

alphadenied wrote: post #3

So one of the most wonderful things about relying on their proprietary closed source operating system is that you can't have external code audits. You just kind of wait for ethical people to come forward and explain bugs they've found and wonder, 1, how long has it been there, 2, how long have bad actors known about this, 3, how many other bugs are just like this or worse that they haven't found yet, 4, do I need to…

OpenSSL code audits having been great, hence why it is such a good example of FOSS secure software.
Post reply on HN