Microsoft has a workaround for 'HiveNightmare' flaw: Nuke your shadow copies from orbit
- Reference: 1626978427
- News link: https://www.theregister.co.uk/2021/07/22/microsoft_hivenightmare/
- Source link:
The solution? Use the icacls command to deal with the permissions set for the contents of system32\config , which are at the root of the problem, and then wipe any Volume Shadow Copy Service (VSS) shadow copies that were taken prior to the icacls fix.
It's hardly an ideal solution, since those shadow copies could have been taken for a good reason (rather than Microsoft just firing off the operation when it feels like it). As the CVE update notes: "Deleting shadow copies could impact restore operations, including the ability to restore data with third-party backup applications."
[3]
However, the issue is that those shadow copies could contain files to which miscreants might gain access, including private data such as credentials.
[4]
[5]
The latest Local Privilege Escalation (LPE) in Windows [6]turned up earlier this week (although it appears to have been lurking within the OS for a while) and means that an attacker without administrative rights could gain access to registry hives holding a range of important data. The access was gained by peering into the VSS shadow copies of the files, which had misconfigured ACLs.
The vuln has been amusingly dubbed by some as "HiveNightmare".
[7]
A successful exploit would then leave the attacker able to change data, install programs, and create new users. However, "an attacker must have the ability to execute code on a victim system to exploit this vulnerability," said Microsoft.
Microsoft also confirmed that all versions of Windows from 1809, including Windows Server 2019, and above were potentially vulnerable.
There is no patch for the issue as yet. However, Microsoft's "official feed for IT Pros" asked its followers for questions on how to better secure a Windows device.
Have questions about how to better secure your [8]#Windows devices? Come ask them at [9]#TechCommunityLive now until 12:00PM PT! [10]https://t.co/wA8Bgrz8a1 [11]#Windows11 [12]#Windows10 [13]#WindowsHello [14]#Passwordless [15]#ThreatProtection [16]pic.twitter.com/HWE3y7gK79 — Windows IT Pro (@MSWindowsITPro) [17]July 21, 2021
Either that's a coded a plea for help, or a question to which the inevitable answer is "fire it into the Sun". ®
Get our [18]Tech Resources
[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934
[2] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YPnqe54u-tpNtzOyZneYqQAAABY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YPnqe54u-tpNtzOyZneYqQAAABY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YPnqe54u-tpNtzOyZneYqQAAABY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2021/07/21/windows_linux_privilege_escalation/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YPnqe54u-tpNtzOyZneYqQAAABY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://twitter.com/hashtag/Windows?src=hash&ref_src=twsrc%5Etfw
[9] https://twitter.com/hashtag/TechCommunityLive?src=hash&ref_src=twsrc%5Etfw
[10] https://t.co/wA8Bgrz8a1
[11] https://twitter.com/hashtag/Windows11?src=hash&ref_src=twsrc%5Etfw
[12] https://twitter.com/hashtag/Windows10?src=hash&ref_src=twsrc%5Etfw
[13] https://twitter.com/hashtag/WindowsHello?src=hash&ref_src=twsrc%5Etfw
[14] https://twitter.com/hashtag/Passwordless?src=hash&ref_src=twsrc%5Etfw
[15] https://twitter.com/hashtag/ThreatProtection?src=hash&ref_src=twsrc%5Etfw
[16] https://t.co/HWE3y7gK79
[17] https://twitter.com/MSWindowsITPro/status/1417909506634256387?ref_src=twsrc%5Etfw
[18] https://whitepapers.theregister.com/
Re: That counter must be bored.
Nah, it just keeps overflowing because they forgot the bounds check, it's only vulnerable one in every 65,535 Windows Updates. So about twice a day.
Why ?
This is so dang pathetic. I mean .. i know it's used a lot , targeted a lot , but seems to me Windows is going to loose all credibility and be considered a PlaySchool OS not worthy of serious uses ... oh it already is .. sorry .. time for a cold pint ..
Re: Why ?
Have another beer on me, to your good health
AC Naturally
That CVE describes the attack vector as local, so I thought to myself meh... it's a big nothingburger, but wait a minute!!! How can this be described as local:
The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document)
I'm so glad they're looking after their customers, imagine how bad it could be if they weren't
Re: AC Naturally
"That CVE describes the attack vector as local, so I thought to myself meh"
I tend to have the same gut reaction to "local" attacks. Of course, there are also remote access vulnerabilities that are relatively harmless because at least you can't get admin access. Now combine the two and you've got big problems.
Re: AC Naturally
"Local" attack also means being able to, say, access the admin share on the machine in order to drop a script which leverages the vuln on it and have the machine execute it. Or from a phishing attack. Or any other way of getting the unwitting user to download and execute the payload...
That counter must be bored.
It finally manages to incriment itself up off zero only to be reset so fast it probably leaves friction burns on its backside. Poor poor counter.