Skip to main content

New Windows 11 and 10 flaw lets anyone take over your PC — what to do

Windows 11 Start Menu
(Image credit: Microsoft)

Updated later on July 20, and again on July 21, to include comment from Microsoft.

There's a new and very serious flaw in recent versions of Windows 10 and Windows 11 that could let any local user without an administrative password, including malware installed by other means, take full control of the PC. No fix from Microsoft is available yet.

This vulnerability stems from an apparent change in recent versions of Windows 10 that permits even unprivileged users to be able to read the Security Account Manager (SAM), SYSTEM and SECURITY files in the Windows Registry, reported security researcher Jonas Lykkegaard on Twitter yesterday (July 19). 

See more

Just a couple of hours ago today (July 20), Will Dormann of the CERT Coordination Center (CERT/CC) at Carnegie-Mellon University in Pittsburgh issued a security advisory about this flaw. 

Dormann believes that this flaw was introduced with Windows 10 build 1809, but in some cases it appears that how you install or upgrade Windows determines whether your machine is vulnerable. (Microsoft has since confirmed that it was introduced with 1809.)

See more

So what's up with this Windows flaw?

The SAM file in the Windows Registry contains "hashed" versions of all the user passwords on a given Windows system, including the passwords of administrative users. 

"Hashing" passwords means running them through a one-way encryption algorithm that cannot (in theory) be reversed. As an example, the hash of "password", using Microsoft's own NTLM algorithm, is "8846F7EAEE8FB117AD06BDD830B7586C".

The problem is that the NTLM algorithm is pretty weak, and hashes can often be "cracked," or reversed to give the original password. 

Even worse, some Windows-related functions, such as accessing a networked server, let you log in using the NTLM hash rather than the password itself. So it's not good when any piece of software or any user on a Windows system can suddenly see the NTLM hashes of all the other users' passwords. 

It's not easy for any user to access the SAM file while a computer is running. But Lykkegaard found that he, even as an unprivileged user, could access the backed-up version of the SAM file in the "shadow copy" that most Windows systems create.

A shadow copy is a backup, hidden on the main drive, of a Windows system's most important files. Your PC creates a shadow copy every time it installs a system update or upgrade. For most PCs, that means a new shadow copy every month.

A shadow copy isn't always that hidden. Even if it's using a unique file name, it's a predictable file name in a predictable location. 

So crafty malware that got onto a PC via a phishing email, pirated software, or a malicious web link would be able to locate the SAM file in the shadow copy, read the user password hashes and probably have a fair chance at cracking the hashes or using them to log onto remote servers.

Even the best Windows 10 antivirus software might not be able to stop all such attacks.

Update: Microsoft security advisory

In the hours after we first published this story, Microsoft issued a security advisory for this flaw and issued it the catalogue number CVE-2021-36934.

"An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database," said the advisory.

"An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights," it added. "An attacker must have the ability to execute code on a victim system to exploit this vulnerability."

The advisory promises future "mitigations and workarounds as our investigation progresses."

For the moment, the only mitigation for this flaw that Tom's Guide is aware of is outlined below. [UPDATE: Microsoft later on July 20 (in Pacific time) added a workaround to mitigate the flaw. See below.]

How to check if your PC is vulnerable

You can see if your PC is vulnerable to this flaw by checking two things. 

First, fire up the Windows command-prompt (type "cmd" into the search bar at the bottom of the screen), type this, then hit Enter:

icacls c:\windows\system32\config\sam

If you get a response that includes this line:

BUILTIN\Users:(I)(RX)

...  then it means unprivileged users can read the SAM file and your system may be vulnerable.

If so, then you'll want to check if shadow copies exist. For that, you'll need to be using the command-prompt as an administrator. 

If you're not already an administrator, type "cmd" into the search bar again and then right-click "Command Prompt" and select "Run as administrator" and enter your Windows password or PC PIN when prompted.

Once the command-prompt window is open, type this and hit Enter:

vssadmin list shadows

You may get a full report that looks like this. If so, then you have shadow copies:

Contents of shadow copy set ID: {d9e0503a-bafa-4255-bfc5-b781cb27737e}
   Contained 1 shadow copies at creation time: 7/19/2021 9:30:13 AM
      Shadow Copy ID: {5b5d02a8-44e9-420e-9ec9-a585cd991ed8}
         Original Volume: (C:)\\?\Volume{b7f4115b-4242-4e13-84c0-869524965718}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2
         Originating Machine: DESKTOP-CHOLLIMA
         Service Machine: DESKTOP-CHOLLIMA
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessibleWriters
         Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered

Here's what you might get if you don't:

No items found that satisfy the query.

If regular users can read the SAM file AND shadow copies exist, then your Windows system is vulnerable to attack. 

So I'm vulnerable. Now what?

CERT/CC's Dormann recommends taking the following steps to dodge the risk of attacks using this flaw. Note that this workaround will delete existing shadow copies, so your computer will temporarily be without a restore point.

1. Fire up an administrative command-line window, as above. (Windows PowerShell will work too.)

2. Block "Users" from accessing sensitive Registry files by typing in the following commands and hitting Enter after each one:

icacls %windir%\system32\config\sam /remove "Users"
icacls %windir%\system32\config\security /remove "Users"
icacls %windir%\system32\config\system /remove "Users"

2a. Update: Microsoft suggests a different command that should achieve the same result. In Command Prompt, it looks like this:

icacls %windir%\system32\config\*.* /inheritance:e

That should probably work in PowerShell too, but Microsoft suggests a slight variation for PowerShell:

icacls $env:windir\system32\config\*.* /inheritance:e

3. Delete existing shadow copies on each drive. For the C: drive, type this into the command line and hit Enter:

vssadmin delete shadows /for=c: /Quiet

4. Continue on other drives you may have, such as D:, E: and so on.

5. Check that all shadow copies have been deleted by typing this in again and hitting Enter:

vssadmin list shadows

You should get this as a response:

No items found that satisfy the query.

6. Reboot your machine. 

7. Create a new restore point by typing "create" into the search bar, selecting "Create a restore point" and clicking the "Create" button in the pop-up windows that appears.

After you make these changes, future shadow copies should have the proper read-write permissions so that unprivileged users cannot access them by any means.

Paul Wagenseil
Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. That's all he's going to tell you unless you meet him in person.
  • GM619
    admin said:
    A jaw-dropping dumb flaw in Windows 10 and Windows 11 lets any local user or program seize full control of a machine.

    New Windows 11 and 10 flaw lets anyone take over your PC — what to do : Read more
    Wow this is a major issue, thanks so much for a workaround.
    Reply
  • SJRouge91
    I know all OS has its fair share of problems; Linux had that issue with the University of Minnesota being banned from adding future contributions to the kernel, malware becoming more prevalent on both Linux and MacOS, but good grief when ISN'T Microsoft in the news about patches causing more problems, malware, or crippling vulnerabilities like the printer nightmare and now this.

    Thank you for this temporary fix, I also suggest creating a dedicated local admin account for additional protection (PC World has an article on how to do it), and it looks like I seriously need to go about transitioning to Linux soon.
    Reply