4 ms·
Inexcusable insecurity in Windows
- alkonaut 6y agoWouldn't an attacker that is able to edit the registry (to "initialize" the exploit) already have the privileges that the exploit would give them?
- jchw 6y agoIt’s in HKEY_CURRENT_USER as per the dzone article, so no.
- deleted 6y ago[deleted]
- MaxBarraclough 6y agoIt references a 2017 DZone article. Is this vulnerability still present?
- lights0123 6y agoNope. Windows 10 1909 18363.1082 just opens up the Optional Features section of Settings when running the exploit.
- amanzi 6y agoI just tried this on Windows 10 20H2 and it appeared to work. See here: https://news.ycombinator.com/item?id=25030076 https://news.ycombinator.com/item?id=25030076
- samberry 6y agoThe point the article is making is that this is a 2017 vulnerability and is still present on the lastest release of Windows 10
- mehrdadn 6y agoRelevant (though I don't know if this vulnerability exists for the non-strict UAC modes): https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94105 https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94...
- userbinator 6y agoMore specifically, this quote from the article: As Larry Osterman noted, UAC is not a security feature.
- userbinator 6y agoIMHO it's not a problem as you should treat Windows as a single-user OS anyway, and UAC is just a nuisance that gets in the way.
- snazz 6y agoA separation between root/Administrator and your normal user account is useful. On Windows, you often can't help but run semi-trusted proprietary software, so multi-user security technology (especially when combined with some type of mandatory access control) is very useful. I think that macOS Catalina does a better job of this: untrusted software running as your user account cannot read every file in your home directory by default.
- amanzi 6y agoInteresting - this only applies if your user account is already running as an administrator, but the risk here is that administrative functions could be run without user interaction or UAC prompts. I just tested this on my Windows 10 machine (running the latest 20H2 version of Win10), and I could successfully launch diskpart.exe and other executables without any UAC prompt. Although Windows Defender did block me from launching cmd.exe or regedit.exe. I would agree with the author that this is a risk that should be fixed.
- magicalhippo 6y agoWhat's your UAC setting?
- amanzi 6y agoIt's the default Windows 10 setting - "Notify me only when programs try to make changes to my computer"
- magicalhippo 6y agoThanks! Seems I bumped it up to "always" at some point, though guess I should just make a separate admin user.
- CawCawCaw 6y agoUnfortunately, the "UAC is not a security boundary" meme bears repeating here. There are many similar such UAC bypasses, e.g. https://github.com/rootm0s/WinPwnage#uac-bypass-techniques https://github.com/rootm0s/WinPwnage#uac-bypass-techniques and https://github.com/hfiref0x/UACME https://github.com/hfiref0x/UACME.
- solarkraft 6y agoWho's surprised? How can anyone assume Windows to be secure or have reasonable defaults? Have you looked at it?