4

Last few days I noticed a really annoying problem with Windows 10 (not sure if it is caused by last update).

After computer is turned off gracefully, on next startup it loads completely session of the last user (I think the last) before anyone signs in!

Way to replicate:

  1. turn off browser with playing music (in my case Firefox with Youtube)
  2. turn off the computer gracefully
  3. start the computer and wait on logging screen
  4. after few minutes, the music from web browser starts to play (even though the browser/tab was not active on shutdown).

I tried to log in with another user, and the music stopped playing sometime during the login process, so I guess it abandons the loaded session at this point. On the next startup, the music started playing again.

It seems to me, that Windows 10 is trying to predict what user will log in next and preload his session before he logs in (or maybe it is just a terrible bug).

My question:

Has this feature (or bug) some security issues or is it just extremely annoying?

Edit By security issue I mean for example case that some user will introduce running keylogger to login screen from his account extremely easily.

  • 1
    This feature can be disabled: Settings > Accounts > Sign-in options > Privacy > second slider (... reopen my apps ...) – NL_Derek Jan 22 at 21:39
  • You could have an interesting reading regarding Ring levels and LSASS process. – bradbury9 Jan 25 at 11:29
1

Short answer: no it is not safe, it is speculative authentication.

This function is conceived to improve user experience and save him time on the session starting process. This function is a speculative anticipated application run based 2 strong hypothesis:

  1. most of the time a PC is used by one uniq user: its owner,
  2. most of the time the owner is the only user attempting to authenticate on his PC.

Then there is no problem to run applications under the identity of this anticipated user before his successful authentication.

To give you a simple image, this is exactly what any Intel processor is doing all the time with speculative execution of code to keep the processor at full speed all the time whatever the hardware instruction is doing.

You are right, this function is creating a real security problem as soon as one of these 2 hypothesis is wrong. Because the OS is running processes under the identity of a user who isn't authenticated on the system right now and who didn't explicitly allowed or asked some processes to run outside of his session and control.

Here is a practical example (shamelessly copied on your own one) to show an impact on legitimate user privacy.

  1. I am at home looking at a video of a scene of crime of a rape,
  2. it’s too late and I close my session as quickly as possible to sleep,
  3. next day I bring my computer at my office,
  4. I make a break for a coffee and let my computer off in our next meeting room,
  5. seeing I am tired and late for the meeting, my best colleague, Alice, starts my computer in advance because everyone is already ready,
  6. 30 seconds later all my colleagues sitted waiting for our meeting to start will hear the sound of the video I had started in private context,
  7. upon my arrival at the meeting my boss ask me deadly cold "Could you please turn off your PC ASAP, and leave the meeting now.”.

I won’t describe here scenarios of attacks leaded with some applications running without the user consent, knowledge and authentication. I foresee many.

I advise you to report to Microsoft the risk of: application running before user authentication, and without user consent and knowledge.

To avoid leaks, and bad uses, I suggest to avoid communicating on scenarios of attacks.

  • 1
    This answer does not provide any additional information to what OP already has stated in the question. The example is just dramatized. The question still stands: What other implications are there, besides that you are able to hear the sound? – Tom K. Jan 16 at 12:09
  • Would you prefer a scenario enabling a more serious attack? For example where the user could fire a network pen test without looking like using his computer during a meeting in front of potential witnesses? – daniel Azuelos Jan 24 at 20:23
1

One of the many small changes in Windows 10 Fall Creators Update is that the operating system can now automatically reopen programs that were running before shutdown or restart. If you shut down Windows 10 with some apps open, some of them are relaunched at next startup just like what is happening to you.

It usually opens the app or the window you didn't close when you hit the shutdown button by bookmarking that specific window or the application so that it automatically open when you restart or power on again.

If you want to start with no apps open (other than those set to auto-start via Task Manager/Start), you’ll need to ensure all apps are closed before shutting down or restarting the PC.

Though there is no way to turn the feature off in the user interface, there is a way to prevent Windows 10 from restoring previously opened programs after a restart.Microsoft suggests exiting programs manually before shutdown, so that they won’t be be relaunched after reboot. That’s the best practice.

You need not worry about the security of windows as it is the update officially from Microsoft itself.

  • Thanks for a lot of valuable informations! My worry is more about if some other user of the same computer can introduce some malicious software for other users on logging screen (for example keylogger to catch password of other user). Is it possible? Any dark scenario that can happen? – matousc Dec 17 '18 at 8:33
  • 4
    Only because the update was from Microsoft doesn't make it secure/insecure. – Lithilion Dec 17 '18 at 8:33
  • 2
    @matousc The login screen runs as SYSTEM on an isolated desktop. Running software, even if not sandboxed in an AppContainer, has no ability to interact or interfere with the login process unless that software is also running as an Administrator / SYSTEM-level user. If it is, you're already hosed - admin-level malware means the computer and everything the user does on it is already completely compromised - so there's no additional risk gained by having it running before login. (Additionally, I'm pretty sure this feature doesn't work for admin processes.) – CBHacking Dec 17 '18 at 12:08
  • @Lithilion : fool’s trust! 😎 – daniel Azuelos Jan 16 at 11:50
  • @matousc Keyloggers/credential theft are discarded. The only potential keylogger in this scenario I can think of would be a malicious usb keyboard driver because of LSASS isolation, but if that were the case there are a couple of things to take into consideration. a) It could be done regardles that feature. b) I suppose (i hope) LSSAS would load only trusted/signed drivers. – bradbury9 Jan 25 at 11:21

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.