3 ms·

I can't believe they haven't fixed that. I discovered that the login prompt ran with system-level privileges in Windows 95. I used it to play Duke3D in computer

I can't believe they haven't fixed that. I discovered that the login prompt ran with system-level privileges in Windows 95. I used it to play Duke3D in computer class when I was 14. You could press Ctl+Alt+Del to bring up Task Manager, from Task Manager you could choose to run a command, and run explorer.exe. It would start Windows with full admin access.

judofyr 14y ago
Reminds me of http://i.imgur.com/fqjnK.gif http://i.imgur.com/fqjnK.gif
Deestan 14y ago
The article assumes you have enough access to boot the computer from an alternative medium. They can't just "fix" that short of forcing full disk encryption.
- antoncohen 14y ago
  I was referring to the login GUI running with full privileges, meaning any time someone finds an arbitrary code execution vulnerability in the GUI they can get full admin access. I wasn't referring to using a boot disk to reset a password. As far as I'm concerned that's a feature not a vulnerability, and it's a feature Windows makes unnecessarily hard to access.
  - bloblaw 14y ago
    The "GUI" is in the kernel (gdi32.ll, user32.dll, comdlg32.dll, etc). What you see at the CTRL+ALT+DEL screen is actually the "SYSTEM" user's desktop. You are, however, technically correct, but finding arbitrary code execution vulnerabilities in the "GUI" these days is not a trivial task. And if you've done that, you can do anything you want to the system. As Raymond Chen (Windows API developer) would say "that would involve being on the other side of this airtight hatchway".
  - UnoriginalGuy 14y ago
    The "login GUI" is actually the process that launches user's sessions and then passes control of the screen/input to that session. It has to have "better than" administrator level access to do so (since it has to broker administrator sessions). Even if you ran the actual GUI as some special user, that GUI would still have to be able to do a bunch of powerful things using SYSTEM level services, so any exploit would be equally as powerful if it went after the SYSTEM login GUI or the login service. What you're suggesting would be meaningful feel good security with no actual teeth. Attackers would just use the boot disk to alter a different file or process.
EvanAnderson 14y ago
Windows 95 had no security model. There are no "system-level privileges" in Windows 95. If you could execute any code on the machine you "owned" it. There were some contrivances in the shell to attempt to limit user access, but nothing serious like the security architecture of Windows NT.
- antoncohen 14y ago
  You are correct that Windows 95 did not have the security model of NT, but administrators could limit what users were allowed to do in the Windows shell. If I logged in with my user account I could not play the game I wanted to play. "You can restrict what users are allowed to do from the desktop and what they are allowed to configure using Control Panel." - http://technet.microsoft.com/en-us/library/cc751094.aspx http://technet.microsoft.com/en-us/library/cc751094.aspx
  - mganon 14y ago
    Because of the absence of an underlying security model, this very often did not work properly, i.e. you could workaround pretty much every kind of "restriction" on Windows 9x by smart mouse and keyboard only moves.
eli 14y ago
They did fix it. It's called BitLocker and it encrypts your drive. The password was never intended to stop people with physical access and the ability to boot to a disk. Consider the process for resetting your Ubuntu password: http://www.howtogeek.com/howto/linux/reset-your-forgotten-ubuntu-password-in-2-minutes-or-less/ http://www.howtogeek.com/howto/linux/reset-your-forgotten-ub...
drzaiusapelord 14y ago
Win95 is not built on the NT kernel, unlike Win2000+, and had no security groups. Everyone was admin all the time. Every process was admin.

judofyr 14y ago

Reminds me of http://i.imgur.com/fqjnK.gif http://i.imgur.com/fqjnK.gif

Deestan 14y ago

The article assumes you have enough access to boot the computer from an alternative medium. They can't just "fix" that short of forcing full disk encryption.

antoncohen 14y ago
I was referring to the login GUI running with full privileges, meaning any time someone finds an arbitrary code execution vulnerability in the GUI they can get full admin access. I wasn't referring to using a boot disk to reset a password. As far as I'm concerned that's a feature not a vulnerability, and it's a feature Windows makes unnecessarily hard to access.
- bloblaw 14y ago
  The "GUI" is in the kernel (gdi32.ll, user32.dll, comdlg32.dll, etc). What you see at the CTRL+ALT+DEL screen is actually the "SYSTEM" user's desktop. You are, however, technically correct, but finding arbitrary code execution vulnerabilities in the "GUI" these days is not a trivial task. And if you've done that, you can do anything you want to the system. As Raymond Chen (Windows API developer) would say "that would involve being on the other side of this airtight hatchway".
- UnoriginalGuy 14y ago
  The "login GUI" is actually the process that launches user's sessions and then passes control of the screen/input to that session. It has to have "better than" administrator level access to do so (since it has to broker administrator sessions). Even if you ran the actual GUI as some special user, that GUI would still have to be able to do a bunch of powerful things using SYSTEM level services, so any exploit would be equally as powerful if it went after the SYSTEM login GUI or the login service. What you're suggesting would be meaningful feel good security with no actual teeth. Attackers would just use the boot disk to alter a different file or process.

EvanAnderson 14y ago

Windows 95 had no security model. There are no "system-level privileges" in Windows 95. If you could execute any code on the machine you "owned" it. There were some contrivances in the shell to attempt to limit user access, but nothing serious like the security architecture of Windows NT.

antoncohen 14y ago
You are correct that Windows 95 did not have the security model of NT, but administrators could limit what users were allowed to do in the Windows shell. If I logged in with my user account I could not play the game I wanted to play. "You can restrict what users are allowed to do from the desktop and what they are allowed to configure using Control Panel." - http://technet.microsoft.com/en-us/library/cc751094.aspx http://technet.microsoft.com/en-us/library/cc751094.aspx
- mganon 14y ago
  Because of the absence of an underlying security model, this very often did not work properly, i.e. you could workaround pretty much every kind of "restriction" on Windows 9x by smart mouse and keyboard only moves.

eli 14y ago

They did fix it. It's called BitLocker and it encrypts your drive. The password was never intended to stop people with physical access and the ability to boot to a disk. Consider the process for resetting your Ubuntu password: http://www.howtogeek.com/howto/linux/reset-your-forgotten-ubuntu-password-in-2-minutes-or-less/ http://www.howtogeek.com/howto/linux/reset-your-forgotten-ub...

drzaiusapelord 14y ago

Win95 is not built on the NT kernel, unlike Win2000+, and had no security groups. Everyone was admin all the time. Every process was admin.