News for hackers. Stuff that matters.

A comment on Windows' Undocumented “Emergency Restart”. Parent comment

Re:Windows' Undocumented “Emergency Restart” by jkingsman on Tuesday July 05, 2022 @01:58PM (#31991550)
Ctrl+Alt+Del invokes WinLogon, the highest priority process, that then delivers the task manager. I believe this is a kernel invocation, so regardless of user land dysfunction, it will always work. Tthis is possibly attributable as much to convenience as it is to security -- the Secure Attention Sequence[1] is intended as a login-spoofind protection which will suspend other tasks (like a spoofed login screen) before continuing forward with user auth.

[1]: https://en.wikipedia.org/wiki/Secure_attention_key

[ Parent | on HN ]
Re:Windows' Undocumented “Emergency Restart” by rzzzt on Tuesday July 05, 2022 @02:42PM (#31992079)
A group policy can be enabled on most variants of Windows (dating back to around NT 4 or Windows 2000, I think) to start with a dialog saying "Press Ctrl-Alt-Delete to begin", and pretty much nothing else, exactly for the reasons you describe.
[ Parent | on HN ]
Re:Windows' Undocumented “Emergency Restart” by WorldMaker on Tuesday July 05, 2022 @03:00PM (#31992289)
Though Microsoft's current security recommendation is against setting that policy for accessibility reasons. [0]

Windows since 8 has worked on hardening/strengthening the "Secure Desktop" that login flows (and UAC prompts) happen on so that as much as possible malware shouldn't be able to run in those sandboxes.

[0] https://docs.microsoft.com/en-us/windows/security/threat-pro...

[ Parent | on HN ]
Re:Windows' Undocumented “Emergency Restart” by theevilsharpie on Tuesday July 05, 2022 @02:37PM (#31992025)
> I believe this is a kernel invocation, so regardless of user land dysfunction, it will always work.

It may always work from the kernel's standpoint, but this doesn't necessarily make it usable.

Anything that blocks the display of WinLogon (e.g., the GPU has crashed and is unresponsive) would render this emergency restart mechanism unusable, and typically, situations like this are usually the only time I would need such a feature.

[ Parent | on HN ]
Re:Windows' Undocumented “Emergency Restart” by AllegedAlec on Tuesday July 05, 2022 @03:17PM (#31992503)
So what if the keypresses never get registered?
[ Parent | on HN ]