Many users are living firsthand Microsoft's new update policy for Windows 10. Essentially, Redmond forces them to give up control of Windows Update to ensure all hotfixes are installed, which has backfired on the company more than once. Now a bug has been discovered that during a major update allows access to the local drive with administrator privileges, regardless of whether it was encrypted with BitLocker.
The Bug in Windows 10
When we say Windows is a sieve, we're not exaggerating. Unless the user takes some precautions and disables several aspects of the operating system, bypassing the administrator password takes only a few minutes. The trick of replacing the sethc.exe file with a copy of cmd.exe or explorer.exe to access the drive's contents has been circulating on the web for a long time, and it can still be reproduced easily simply because it requires physical access to the terminal. We all know that's the most critical point, but it wouldn't hurt if Windows resisted probing by users who lack proper credentials. The latest "hole" of this kind appears in Windows 10.
How the Exploit Works
According to researcher Sami Laiho, a theoretical attacker with physical access only needs to wait for the next major Windows update, such as builds 1511 and 1607, though this is more common in Insider editions. Windows 10 prepares part of the content before restarting the computer, but the installation process itself is handled by the well-known Windows PE (Preinstallation Environment). During installation of the new update, simply pressing Shift+F10 opens a recovery console without asking for passwords or anything like that. As if that weren't enough, this console also allows access to the hard drive even if it was protected with BitLocker.
Mitigations
Microsoft is supposedly working on a patch to fix the error, but it will take some time. Until then, Laiho's recommendations are three: Do not allow unattended installations (i.e., stay with the computer while it updates), closely monitor all Insider builds, and thirdly use Windows 10 LTSB, the "slowest" edition in terms of receiving new updates, since it was designed for critical environments where stability is a priority. Other sites suggest that Windows 10 installations managed with System Center Configuration Manager can block the call to the recovery console by placing a tag file called DisableCMDRequest.tag in the %windir%\Setup\Scripts folder.
For more details, click the link below (there is a video on Vimeo but it doesn't allow embedding).
