HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

https://doublepulsar.com/hivenightmare-aka-serioussam-anybody-can-read-the-registry-in-windows-10-7a871c465fa5

by OMGWTF • 5 years ago

171 175 5 years ago

doublepulsar.com

woliveirajr• 5 years ago

There’s no patches, it’s a zero day.

Seems that MS just released articles on how to prevent it but no update/patch.

Perhaps it's hard to fix, i.e., too many things on windows rely on it?

withinboredom4• 5 years ago

Or perhaps, once someone installs untrusted software in the first place, you’re screwed anyway?

This is security 101. AFAIK, you can login as a local admin since forever and it’s never been fixed. I just used it recently to access a deceased relative’s computer.

user-the-name• 5 years ago

Every computer spends pretty much every hour of every day running untrusted software.

There is nothing more common than running untrusted software.

This kind of attitude is completely useless.

londons_explore• 5 years ago

I was surprised to find that a modern windows 10 machine (with all default security options) could have the user password bypassed easily with a Windows setup USB.

I could then read all the user's documents.

I thought the point of disk encryption and secure boot was to prevent that. Yet somehow the hole of allowing Windows setup to give you a privileged command prompt with a decrypted disk was never closed...

ptx• 5 years ago

If all the OS security measures are useless in the face of untrusted software, why were they introduced? Should we just run Windows 98 and FAT32 on our servers since it's apparently basic security knowledge that Windows NT's system of user accounts and permissions doesn't work?

wongarsu2• 5 years ago

Windows is a multiuser system and tries to give you a reliable security barrier between two (non-admin) users. And at least since Windows Vista it puts some effort into preventing non-elevated software from gaining admin rights, limiting the amount of damage it can do somewhat.

Of course in reality installing any untrusted software on a computer that's not airgapped from everything you care about isn't safe. But that doesn't mean we shouldn't at least try to give better security guarantees.

bottled_poe• 5 years ago

My first thought too. Too many layers upon layers of technical debt to deploy a timely patch.

alphadenied• 5 years ago

So one of the most wonderful things about relying on their proprietary closed source operating system is that you can't have external code audits. You just kind of wait for ethical people to come forward and explain bugs they've found and wonder, 1, how long has it been there, 2, how long have bad actors known about this, 3, how many other bugs are just like this or worse that they haven't found yet, 4, do I need to recreate VM images or can I trust the internal patch process to get it installed before I've been exploited, 5, does the patch actually fix the underlying security flaw or is it something they're calling a "feature" now that will always be an issue... I'm so grateful to not be a janitor for Microsoft Windows software anymore.

codetrotter2• 5 years ago

Microsoft Windows is proprietary software yes, but they have something called the Shared Source Initiative.

Through the Shared Source Initiative Microsoft licenses product source code to qualified customers, enterprises, governments, and partners for debugging and reference purposes.

https://www.microsoft.com/en-us/sharedsource/

I say this as someone who doesn’t like Windows and doesn’t run Windows. We still need to admit that Microsoft does indeed let others read the source code, only that they decide who gets to read it and not.

coliveira2• 5 years ago

The key question is: would they let people who want to find bugs? Because that is the point here, if you can read the software but not allowed to do an audit, it doesn't make any difference (for the issue that we're discussing).

squarefoot• 5 years ago

The problem is that it would be dangerous for any FOSS developer to be chosen among those who can see their sources for obvious legal reason. Anyone willing to be exposed to Microsoft's IP and NDAs that way is probably already so tied to them that we couldn't count on any independent security auditing and reporting without Microsoft authorizing it.

wutwutwutwut3• 5 years ago

You just kind of wait for ethical people to come forward and explain bugs they've found

And the same apply to open source software. It's not like all the bugs in open source software was fixed in audits or that you somehow magically know how long time the issue has been attacked by bad actors.

nolok• 5 years ago

You're mixing a lot of things for no reason, the problem you describe really have very little or even nothing with open source or proprietary or even OSes.

Points 2/3/4 are exactly the same on other OSes, even open sources ones.

Point 1 might be easier to answer by yourself/someone who is not the vendor with open source OSes, while for Windows or OSX you depend on the vendor to tell you with certitude "starting with X" (which they always do). But on the other hand the centralized and streamlined patching model makes it much much easier to identify just which patch caused it, compared to "which level of package mainter or upstream caused it, is it a flaw in SOFT or in debian's SOFT-up3 or what ?"

Point 5 has nothing to do with open source either, on either you can easily test if it's fixed or not. Whether it's considered bug of feature-wont-fix is pretty much always answered so you don't have to actually ask yourself (but if they do consider it normal then you can't fix it yourself on closed source proprietary, though they usually give you a config change to get what you want).

pjmlp2• 5 years ago

OpenSSL code audits having been great, hence why it is such a good example of FOSS secure software.

formerly_proven2• 5 years ago

But why, yes. OpenSSL has seen vast improvements, not just in code, but also in processes, and multiple audits due to Heartbleed.

selfhoster113• 5 years ago

Microsoft can easily pay for external software audits. They just need them to sign an NDA or other agreement that the access to code is only to be used to audit the code, and nothing else.

staticman22• 5 years ago

At Microsoft's size it may make more sense to just hire an auditing team who works internally.

jaclaz7• 5 years ago

Possibly I am missing something, but the use of volume shadow copies or direct (RAW) disk access to retrieve particular files that are "in use" is a long time established possibility.

Extents and Rawcopy were initially written several years ago:

http://reboot.pro/files/file/316-extents/

https://github.com/jschicht/RawCopy

Or is there something new specific to Windows 10?

praseodym• 5 years ago

The vulnerability here is that regular non-administrator users can also read sensitive registry hives from the shadow copy. This allows for local privilege escalation exploits.

jaclaz7• 5 years ago

I see, thanks, I never tested the mentioned programs as a non-Admin user, though the mechanism (if the shadow copies are used) is seemingly the same, so if the BUILTIN/USERS are authorized, they may work as well (and not only on Windows 10).

jesboat2• 5 years ago

I guess one way to phrase it would be "the ACLs on the registry files were always overly permissive, but nobody noticed until now because trying to read them the obvious way failed with 'file in use'"

denton-scratch2• 5 years ago

Not willing to "sign in with Google". Didn't read (just the comments).

1023bytes• 5 years ago

https://archive.is/gn2Gj

nullwarp• 5 years ago

What is up with Medium requiring a google or facebook account to read posts now?

gogopuppygogo• 5 years ago

They need to make money. I guess they gave up on advertising directly and instead want to capture our info alongside what we read on the website to build profiles they can sell to marketers.

technion• 5 years ago

You appear to be able to bypass it by opening the page in incognito mode.

It does leave me more likely to skip content I find on medium - this particular blog has the type of content that would make it a rare exception.

Superblazer• 5 years ago

Checkout medium unlimited extension

throwaway092237• 5 years ago

I have the same strong feelings about walled sites and tracking. May I recommend installing an extension to disable paywalls/tracking? Something like https://github.com/iamadamdev/bypass-paywalls-chrome (supports firefox despite the project name) which automatically wipes cookies from sites like Medium which enable "sign on" requirements after so many visits. It really improves the browsing experience.

I used to open these sites incognito or delete the cookies manually but it's really such an annoyance. Better to automate the policy of disallowing these folks to store cookies.

tjoff• 5 years ago

Then why visit such sites? I deliberately do not install extensions that hide problems for me. I want it to be cumbersome. I want to get annoyed so that I get discouraged to use the site in the first place, and I get reminded of that fact with every single visit.

If the few that do care still visits there is no incitement for the site to not do it.

notorandit• 5 years ago

It's not a bug! It's clearly a feature!

nickdothutton• 5 years ago

An operating system can never fully escape its heritage.

altharaz• 5 years ago

TL;DR:

Some Windows configuration have bad permissions on their SAM database. If a standard user has access to shadow copies (VSS), this can lead to privilege escalation.

Microsoft recommends to [1]:

1) Restrict access to the contents of %windir%\system32\config: - Command Prompt (Run as administrator): icacls %windir%\system32\config*.* /inheritance:e - Windows PowerShell (Run as administrator): icacls $env:windir\system32\config*.* /inheritance:e

2) Delete Volume Shadow Copy Service (VSS) shadow copies: - Delete any System Restore points and Shadow volumes that existed prior to restricting access to %windir%\system32\config. - Create a new System Restore point (if desired).

Also, please note that some authorities seem to adress this subject carefully. The French national cybersecurity agency (ANSSI) has for instance published a News bulletin [2] but no "real" Security bulletin of this vulnerability [3].

In its News bulletin, the ANSSI specifies that it also affects Windows Vista RTM :).

However, the ANSSI also says that deleting VSS entries (step 2 of Microsoft recommendations) "must be decided after evaluating the advantages and disadvantages with regard to the risks, in particular because there may be other possibilities for privilege escalation depending on the level of security of your information system."

[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

[2] https://www.cert.ssi.gouv.fr/actualite/CERTFR-2021-ACT-031/

[3] https://www.cert.ssi.gouv.fr/alerte/

bob10296• 5 years ago

I am legitimately not sure if this is a bug or a feature.

I'll take all the side-channels I can get though. These "exploits" are really useful for regaining control over my own PC.

Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install.

majkinetor10• 5 years ago

Yeah, it was the only way to remove defender. Then I used debloaters and shutup10 to remove all other "features". Windows didn't like it and returned ALL of them on update. Now I disabled update, and are totally motivated to go back to linux.

Luckily all the tools I use on Windows are x-platform and with PowerShell, vscode, sql server etc. on linux and games working nothing holds me any more. I will probably miss Autohotkey and Foobar2k (maybe total commander but Dobulecmd is decent alternative and much better in some domains).

gruez8• 5 years ago

Yeah, it was the only way to remove defender

Why not just disable it using group policy?

techrat4• 5 years ago

...and are totally motivated to go back to linux.

Windows 10 was what broke me and got me to using Linux full time. Before that, I barely knew how to even just get my way through debian to resume a disconnected screen session. Now I prefer to be in Linux. Even if the software that I can run using Wine/PlayOnLinux/Proton/Lutris isn't 100%... it's sufficient to where I don't miss being on Windows at all.

I recently upgraded my main system and used the extra parts to rebuild my Win 10 standby box. I grew up on Windows. Started with Win3.0/DOS and used every iteration except WinME and Vista... and the rebuild only reminded me how much of a pain in the ass Windows is to install. 10 still has a lot of the usability bugs I've encountered from way back in the Win98 days but all the extra crap we have to deal with now (most inconsistent and overencumbered UI ever) just makes it even more of a chore to use than it ever has been.

For what it's worth, Foobar2K runs great in Wine.

Datagenerator• 5 years ago

Due this feature or was this possible normally too? Any links?

gruez8• 5 years ago

I'll take all the side-channels I can get though. These "exploits" are really useful for regaining control over my own PC.

Not really? What does this exploit let you do that you couldn't already do with a local administrator account? Or are you making the general argument that "EoP exploits are features because they allow you to jailbreak your device"?

Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install.

They're not really comparable. You need admin to do it, which means you already crossed the security boundary[1]. This is in contrast to this exploit which allows you to cross a security boundary.

[1] https://devblogs.microsoft.com/oldnewthing/20121207-00/?p=58...

majkinetor10• 5 years ago

What does this exploit let you do that you couldn't already do with a local administrator account

There are some things that users in Administrators group still can't do. Hence the need for TrustedInstaller perms.

For example, try running this script:

https://github.com/W4RH4WK/Debloat-Windows-10/blob/master/sc...

You will get access denied since few months back:

https://github.com/W4RH4WK/Debloat-Windows-10/issues/273

chungy• 5 years ago

Feature, I'd say. Volume Shadow Copies are used to make consistent online backups of an NTFS file system. I don't think non-admin users are normally able to make them in the first place, and if admin is required, it's hard to see the fuss.

gruez8• 5 years ago

I don't think non-admin users are normally able to make them in the first place, and if admin is required, it's hard to see the fuss.

shadow copies are automatically created as part of system protection (enabled by default).

rawoke0836005• 5 years ago

" for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install."

I understand Linux, Mac, FreeBSD, Magic-Pony-OS is not everyone's cup of tea or they might not be in a position to choose their OS (Work etc)

But DAMN that quote above is really showing me how bad it is out there ! Sure it can/does happen on other OS as well, but I'm betting Windows is the leader in "my-pc-is-not-my-pc-anymore" :/

Sebb7675• 5 years ago

I'm betting Windows is the leader in "my-pc-is-not-my-pc-anymore" :/

There are PCs out there running ChromeOS and Android. Not to mention smartphones and game consoles.

Windows is not good in this regard, but it's by far not the worst (though the UX for administrative actions is really not great, IMO).

aftbit• 5 years ago

IMO if you expand PC to cover mobile computing, the real tragedy is iPhone. No sideloading, very restrictive app store policies, and no custom OSes at all. At least with a Windows desktop or laptop, you can run Linux or one of the other actually free OSes. Modern MacOS is also pretty unfriendly for developers and power users, but at least Apple is somewhat aligned with users on privacy and security, unlike Microsoft.

shawnz3• 5 years ago

If there was never an "old way" of doing things that didn't involve the new TrustedInstaller system, then would we even be thinking twice about these new restrictions? Or would we just see the restrictions as part of the design of the APIs?

Just because they took a part of the system that used to be externally facing and made it internally facing, I don't think that is the same as making "your PC not your PC anymore". If they were blocking administrators from executing arbitrary code or having arbitrary access to I/Os, that would be a different story.

Wowfunhappy4• 5 years ago

I’m not proud of it, but when the reporting on Pegasus came out last week I was thinking “I wonder if this could lead to a Jailbreak on iOS 15.”

majkinetor10• 5 years ago

But DAMN that quote above is really showing me how bad it is out there !

Actually Windows is quite awesome nowdays. I was using mentioned OSes for years during periods of Windows downs, and since Satya Nadella took the leadership I was very happy with Windows (I primarily spend my time in PowerShell, browser, vscode and using dev tools but have different dedicated installations for games, media etc.)

Now with this can't-turn-off-helicopter attitude I am really considering switching to some Linux variant again. Mac is totally out of question due to similar concerns.

bob10296• 5 years ago

I've been spending the last 48 hours strongly pondering Linux as a daily driver. If it wasn't for my crippling visual studio addiction, I'd probably be able to swap all my PCs over, with the exception of the one bastard stepchild win10 that I will keep in the closet for when BF2042 is released. Virtualization is another option that I am investigating actively now.

I could even see the path for getting our product off the Windows platform and onto Linux (while still using Microsoft's dotnet toolchain). There are only 2 DLLs keeping us locked to Windows and I have a very solid hypothetical answer for both.

All of this is so depressing because it doesn't have to be this way. A few small changes to the OS (that would incur negligible impact to Microsoft's cashflow or margins) could mean life changing improvements in the user experience.

If profit must be obtained, then Microsoft should consider a "hacker" build of windows that starts as a bare-ass powershell prompt that you have to tack on what you want to use. I'd pay a fucking premium. Microsoft, are you out there? Charge me $1000. I swear I'll pay it if you promise to not shove updates, telemetry, defender or cortana down my throat ever again.

jmnicolas3• 5 years ago

Magic-Pony-OS

and there I was thinking you were joking, but there's actually a PonyOS!

https://www.ponyos.org/

Godel_unicode• 5 years ago

Except this is in no way an exploit. Running processes as TrustedInstaller is no different than a user using sudo to run vim as root.

rootsudo• 5 years ago

Huge oversight, it renders and breaks previous GPO, meaning that the tech debt in Windows NT itself is huge.

Which makes you wonder really how comfy OSX POSIX is, but they had their own fun bugs lately too, sudo for example and other ones. Plus they're doing an CPU Arch jump.

Kinda feels like the 90's again, in a sense.

sveiss• 5 years ago

Definitely a bug. The Unix equivalent would be a package update silently making /etc/shadow world readable, exposing the hashed passwords of local users.

Not a big deal for a single user machine — there’s nothing you can do with this that you can’t do some other way as a local admin/root — but not good if you have untrusted, non-admin user accounts.

rwmj7• 5 years ago

It amazes me that Microsoft haven't replaced the Registry with a simple directory structure, not that it would help for this particular bug, but it would surely be an improvement. I maintain a library for accessing the registry from Linux (https://github.com/libguestfs/hivex) and after writing it I also wrote this screed about how it sucks in just about every way possible:

https://rwmj.wordpress.com/2010/02/18/why-the-windows-regist...

Randor• 5 years ago

Hi,

Actually you can use the Windows Projected File System to project the registry into the file system, making registry keys and values appear as files and directories.

https://github.com/Microsoft/Windows-classic-samples/tree/ma...

rwmj7• 5 years ago

Something is still translating the virtual files back and forth to the half-arsed hive format. Would recommend reading the link I posted since I have actually reverse-engineered the hive format.

ape4• 5 years ago

I imagine that the registry is optimized for many small values (eg a DWORD - 4 bytes). Most filesystems wouldn't be very efficient with tons of 4 byte files.

throwaway092237• 5 years ago

A registryfs would be. The data structures underpinning access would not need to change.

The importance of using a filesystem interface is reuse of the access control mechanisms and filesystem API. It would avoid the type of bug above, due to nesting a hierarchical permissioned structure inside a file.

wongarsu2• 5 years ago

Just naively translating the registry into a NTFS directory structure would require 1kb per value, simply because that's the size of a file record (NTFS already has an optimization to store small files directly in the file record if it fits in next to all the attributes and ACLs).

Also the Windows Filesystem driver stack is not very efficient for accessing many small files. It's built for flexibility and security, not speed.

anthk2• 5 years ago

Wine exposes the registry as a file.

Current machines aren't the ones as Windows 98 with 32MB of RAM requiring binary configs for the OS everywhere.

zamadatix8• 5 years ago

The Windows registry is certainly a database, perhaps just not the type you're used to https://en.wikipedia.org/wiki/Hierarchical_database_model

Most of the actual technical issues you list have more to do with it being extended for the last 30 years in a backwards compatible way than anything to do with it being a hierarchical db instead of a filesystem.

throwaway092237• 5 years ago

Yes but a filesystem is also a hierarchical database.

A filesystem solves these issues specifically because it avoids reimplementation. As the registry has been extended as you say it approaches parity with filesystem functionality, but on a parallel track.

At a high level, avoiding multiple implementations of similar metaphors is ideal in terms of security. Reuse what you have.

jaclaz7• 5 years ago

I still see it as a file system, very similar to NTFS (similar in the sense of having similar features), apart the (recent) project just mentioned (ProjFS) there existed a file system like driver for it, only for the record:

http://reboot.pro/topic/7681-the-registry-as-a-filesystem/

https://web.archive.org/web/20090413131629/http://czwsoft.dy...

https://web.archive.org/web/20140401212651/http://pasotech.a...

And:

https://github.com/jbruchon/winregfs

Sebb7675• 5 years ago

Technically a file system is just a special database. I think a better formulation of the authors point would be "the registry is a lot like a file system, even though a more traditional database approach or fully embracing it as a file system would have probably worked out better".

Also, they would have been able to at least improve the on-disk format with a major version; I highly doubt that the registry itself is backwards-compatible anyway and there are probably very few programs that access it directly.

garaetjjte2• 5 years ago

for the last 30 years in a backwards compatible way

There's nothing that has to be backwards compatible in registry internal storage format, they could just design new sane format and keep old API.

anthk2• 5 years ago

Wine exposes the registry as a file.

rurban• 5 years ago

Cygwin also. Extremely trivial implementation

rwmj7• 5 years ago

Implementing the registry APIs, but backed by a regular filesystem (as Wine does) would be the sensible thing for Windows to do. (I looked at the source of Wine just now and I'm fairly sure nowhere does it process hive files.)

shawnz3• 5 years ago

Certainly there is a lot of legacy with the registry, but how would any of these issues be improved by moving to a file based config? All these issues could still exist under that model, and there would be new issues too.

Like for example, you already point out how the type system in the registry is very limited. But isn't the filesystem even worse? Everything there is binary blobs with no types at all. So how does that improve things?

It seems like your complains don't really have to do with the "directory" structure of the registry much, so I don't think moving to a file based model would really change anything. You'd just end up with the same legacy issues, but spread across more files.

Finally, AppData wasn't introduced with Vista, but rather it's always been there if applications need to store file-based data rather than individual configuration values. That is not a new or improved way of doing things as you seem to imply in the post.

rwmj7• 5 years ago

The problem with hive is that the type has to be set correctly yet several types have no established meaning. For example it's totally random whether a number will be stored in binary with type DWORD or stored as a string (with who knows what type and encoding). However store it in a different way when writing to the registry and Windows or whatever app wants to read that field will break. In a way it's worse than if it wasn't present at all.

NTFS specifically has file forks ("Alternate Data Streams") and I guess you could use those to store a type, although whether using forks would be a good idea or not is up for debate.

TheRealPomax• 5 years ago

No thanks: the registry is a truly huge simple key/value store, which is something files-in-dirs are terrible for because almost every single one of them would take up a full block on disk instead of the fraction of a block they actually need.

A better solution would be a simple database (like sqlite3) but then the immediate counter-argument is "okay, so we're done: it's already a simple database", because the registry hive is literally a file-backed database in the same vein as sqlite =)

tenebrisalietum• 5 years ago

I feel this mattered much more in the mid 90's when 4GB disks were common in PCs, but with today's modern storage sizes this is trivial. Besides, the NTFS MFT already stores small files directly in the indexes.

rwmj7• 5 years ago

The Windows registry is not a "simple key/value store" by a long shot. It is hierarchical, there are many different types of value, and there's a complex system of security attributes. These are simple facts.

You're right that a file per value would take a whole block on disk given the way some filesystems are currently implemented, but that's not an immutable feature of all filesystems - some Unix filesystems store small files in the inode. A real database is possible, but also the registry must be available very early in Windows boot (actually it's used by the bootloader, but also by the critical device database) so you'd want something that's at least easy to read with a smallish amount of code.

naikrovek4• 5 years ago

It amazes me that Microsoft haven't replaced the Registry

how does this amaze anyone? how do people think backwards compatibility works?

Microsoft, supporting Windows, promises to make every effort to maintain backwards compatibility wherever possible so that programs compiled for, say, Windows 95 will run unmodified on Windows 10.

Not every program from 20+ years ago runs, but a lot do! That's a very hard thing to do if you wish to continue to advance the technology you use in your operating system. Apple doesn't even try.

Microsoft have taken steps to break backwards compatibility a few times in the name of progress and every time I talk to people during those transition periods, it is a 50/50 split between people who don't know that they've been given a decade of notice and now their "tried & true" software development paradigm doesn't work anymore, and people who are angry because most of the old ways are still supported.

The registry wasn't even supposed to be what it is today. it was a small stop-gap thing to stand in place while a better solution was developed. Developers discovered it, started using it, and now Microsoft has to support it. Of course it's rubbish; metaphorically, it's a piece of a whiteboard used as a doorstop until the real doorstop is delivered, except for some reason people started using it for important stuff and now everyone needs it.

garaetjjte2• 5 years ago

how does this amaze anyone? how do people think backwards compatibility works?

That doesn't have anything with backwards compatibility. Nothing forces MS to stick to old ad-hoc memory dump format. Neither there is anything that would suggest registry is deprecated, new Windows components keep using it and adding piles of junk into it.

Asooka• 5 years ago

I am confused how having read access to the registry allows local privilege escalation. As a Linux user, having read access to the registry sounds like having read access to /etc, which every user already has. What sensitive data is stored in SAM that allows that?

cjones26• 5 years ago

Agreed. The article also does not seem to explain it. From what I understood the SAM only stores encrypted password hashes, nothing that could be readily exploited for local privilege escalation.

jesboat2• 5 years ago

There's a video (bleh) which appears to extract the hash and then use a pass-the-hash. I'm not clear on exactly what the preconditions are (are NTLMv1/v2 hashes still stored by default? Does PTH work with newer hashes? Etc) or if there's another way to escalate

aj3• 5 years ago

Password hashes. /etc/shadow isn’t world readable in Linux dither

ylyn• 5 years ago

It seems like there are some cases where Windows accepts a password hash for authentication as a user though. So by having the hash of an administrator, you can escalate privileges.

I don't think there are such cases in Linux.

tyingq• 5 years ago

I thought there was also a way to schedule a copy of a file at boot time...something that installers use to copy/delete locked files.

bencollier49• 5 years ago

Paywalled. I don't understand why people published to Medium.

bitwize• 5 years ago

"To keep reading this story, get the free app or log in." FUCK. YOU. Remember when people just published informative and thoughtful stuff online without expecting monetization? Yeah, I and Pepperidge Farm remember, but it seems to have become a lost art. It's worth it to forgo this article, no matter how interesting it seemed to me, to encourage the author and others to publish their blogs to be readable by all.

grayhatter• 5 years ago

First commit was 5 days ago. july 15 which wasn't patch Tuesday... Which means it wasn't an 0day... Stop getting this wrong!

HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

Related Stories