SeriousSAM bug impacts all Windows 10 versions released in the past 2.5 years
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-36934 | Local Privilege Escalation (SeriousSAM/HiveNightmare) in Microsoft Windows 10 CVE-2021-36934 is an elevation of privilege vulnerability in Windows caused by overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. A local attacker who already has the ability to execute low-privileged code on a victim system can leverage the misconfigured ACLs to gain arbitrary code execution with SYSTEM privileges, then install programs, view, change or delete data, or create new accounts with full user rights. Affected products per the CPE data are Windows 10 versions 1809, 1909, 2004, 20H2 and 21H1, with related coverage noting the bug impacts all Windows 10 versions released in the past 2.5 years and also references Windows 11. CISA added the flaw to its Known Exploited Vulnerabilities Catalog on 2022-02-10, confirming in-the-wild exploitation, and EPSS assigns a 67.3% probability of exploitation within 30 days (99th percentile). Mitigation is two-step: installing the security update alone is not sufficient — administrators must also manually delete all shadow copies of system files, including the SAM database, per KB5005357. Do: Apply Microsoft's security update per vendor instructions, then follow KB5005357 to manually delete all shadow copies of system files (including the SAM database), because the update alone does not fully mitigate the vulnerability. Restrict or verify ACLs on the System32 config directory and shadow-copy access if shadow-copy deletion cannot be done immediately, and prioritize patching given the flaw's listing in CISA's Known Exploited Vulnerabilities Catalog. | 7.8 | 67% | KEV |
| masshundreds of millions of Windows 10 devices (every supported feature update from mid-2018 through mid-2021 is in scope) |
Full article543 words · extracted from therecord.media · click to collapse
A security researcher has discovered a major vulnerability in the Windows 10 operating system that can allow threat actors to gain access to elevated privileges and user accounts passwords. Discovered by Jonas Lyk over the weekend, the vulnerability resides in how Windows 10 grants access to some OS configuration files. In particular, the vulnerability, nicknamed SeriousSAM, refers to how Windows 10 controls who can access folders like SAM, SECURITY, and SYSTEM. C:\Windows\System32\config\sam These are important Windows folders because they fold information such as hashed passwords for all Windows user accounts, security-related settings, data about encryption keys, and other core OS configuration details. A threat actor who can read files from these locations can extract crucial information that can allow them to gain access to user passwords and system settings that can be abused for malicious purposes. Because of the sensitive data they store, only Windows admin accounts are allowed to interact with these configuration files. However, while testing the upcoming Windows 11 release, Lyk discovered that while Windows was restricting low-privileged users from accessing those sensitive configuration files, copies of these files were also being saved in backup files created by Shadow Volume Copy, a Windows feature that creates snapshots of computer files during filesystem operations. While in older Windows OS versions, access to these files was restricted in the Shadow Volume Copy feature, Lyk and other researchers[1, 2, 3] discovered that since Windows 10 v1809, released in November 2018, Microsoft has been failing to block access to these configuration files in Shadow Volume Copy backups. This meant that malware or threat actors who gained a foothold on Windows 10 systems could abuse the SeriousSAM vulnerability to gain full control over Windows versions released over the past 2.5 years. Threat actors gaining access to the Security Account Manager (SAM) configuration file is considered the biggest issue, as this could allow them to steal hashed passwords, cracked the hashes offline, and hijack accounts. However, the other configuration files stored in the SYSTEM and SECURITY folders can also yield similarly dangerous data, such as DPAPI encryption keys and Machine Account details (data used in joining computers to Active Directories). Ho, and this is not only SAM, but also SYSTEM & SECURITY. In a security advisory published today, Microsoft formally acknowledged the issue, which the company is currently tracking as CVE-2021-36934. Currently, the OS maker recommended deleting all Shadow Volume Copy backups as a temporary mitigation. Security researcher Kevin Beaumont has published proof-of-concept code to allow sysadmins to test which of their systems are vulnerable to SeriousSAM attacks. Article updated at 6am ET with Microsoft's mitigations.
C:\Windows\System32\config\security
C:\Windows\System32\config\systemBug discovered by accident while testing Windows 11
So you can find "interesting" data, like:
- default windows install password (can be valid, trust me )
- DPAPI computer keys (decrypt all computer private keys, etc.)
- Computer Machine account (silver ticket)
- ... pic.twitter.com/TLbIHv20IhNo patch available
No previous article
No new articles
Catalin Cimpanu
is a cybersecurity reporter who previously worked at ZDNet and Bleeping Computer, where he became a well-known name in the industry for his constant scoops on new vulnerabilities, cyberattacks, and law enforcement actions against hackers.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/serioussam-bug-impacts-all-windows-10-versions-released-in-the-past-2-5-years