Monday, January 18th 2021
Critical Flaw in Windows 10 Could Corrupt Your Hard Drive
Windows OS security is taken seriously, as the OS is wide-spread across millions of PCs around the world, however, there may be issues where OS has some security flaw that is found by external researchers. Due to the sheer code base of the new OS like Windows 10, there are a plethora of bugs and security flaws waiting to get discovered by someone. And today, thanks to the team of cybersecurity researchers, we have found out that in Windows 10 file-system called NTFS, there is a bug that corrupts your hard drive by simply triggering a specific variable name in a file.
If the end-user inside Windows 10 tries to access the NTFS attribute called "$i30" in a specific way, the flaw is exploited. The NTFS search index attribute, specifically the string "$i30", is containing a list of files and subfolders in a directory, and there is even a log of deleted files and folders. After running a specific command inside the command line (CMD) or inside the browser, Windows will start to display warnings of "File or directory is corrupted and cannot be read". After that, the OS will prompt a user to restart the machine and repair the damaged drive, so the Windows disk check utility will start. Once corrupted, Windows 10 will start displaying a notification indicating that the main file table (MFT) on the particular disk is corrupted and thus can not operate. Starting from the build Windows 10 Build 1803 the OS is vulnerable until the current version and a possible fix is expected to be released soon.
Sources:
Jonas L (Twitter), Siam Alam (Twitter), via Security Newspaper
If the end-user inside Windows 10 tries to access the NTFS attribute called "$i30" in a specific way, the flaw is exploited. The NTFS search index attribute, specifically the string "$i30", is containing a list of files and subfolders in a directory, and there is even a log of deleted files and folders. After running a specific command inside the command line (CMD) or inside the browser, Windows will start to display warnings of "File or directory is corrupted and cannot be read". After that, the OS will prompt a user to restart the machine and repair the damaged drive, so the Windows disk check utility will start. Once corrupted, Windows 10 will start displaying a notification indicating that the main file table (MFT) on the particular disk is corrupted and thus can not operate. Starting from the build Windows 10 Build 1803 the OS is vulnerable until the current version and a possible fix is expected to be released soon.
124 Comments on Critical Flaw in Windows 10 Could Corrupt Your Hard Drive
You're still not selling your point. Would you like to continue trying?
superuser.com/questions/566113/does-windows-calculate-crcs-to-check-every-file-operation Says the guy who doesn't have his facts straight and who has an ass backwards view of copy on write. It's almost like you've never used a sparse disk image before. Maybe we should just store every zero for empty space in a disk image because you asked for a copy. :kookoo:
I wonder if these updates to spy programs have a direct or indirect impact as Windows keeps updating.
These are the former spy programs I've been notified of and kept tabs on. I don't know what they do. The last I think was in 2016.
NSAKEY_key2
ADVAP132
Does anyone have any clues on how they conduct passing information when asked to do so? If I uninstall them, what harm could it do? I could just say, if asked, "Oh it looked like a form of malware so I uninstalled it." On the other hand, could it lock Windows if I do?
ntfs.com/data-integrity.htm Typical straw-man argument. You need a mirror.
Regarding how the duplicate copies are handled depends on the filesystem, but btrfs for example simply makes a pointer that says that DuplicateFile uses the same blocks (clusters, disk sectors, etc.) as OriginalFile, which makes creating a duplicate an instant operation, regardless of the file size. As long as at least one of that set of files (Original and Duplicate/s) uses those blocks, they're not marked for deletion.
Let's say you change one of those files. The change is written down in new filesystem blocks and then the filesystem adds and/or changes pointers that for a human would read like "DuplicateFile uses the same blocks as Original File except it replaces block 5 for block 12879821 and discards blocks 50 and 51". So the filesystem shows the original file as it was and the duplicate that changed shows up with the changes you may have made to it.
CoW is also important for file system snapshots, as it basically saves the entire state of the filesystem in an instant. Say, you took a snapshot of the drive at 5:30:01 AM, July 4th 2019. The snapshot is instantaneous, as all changes after the snapshot are written down in new blocks, without changing the original ones. And this changes can be "atomic", that is that they don't have to save the whole file in new blocks, the file system writes down only the exact changes made and nothing more. So, if you "flip a bit" in a 400 GB file, the operation won't require writing down the full 400 GB file, it will simply save the change and add a pointer in the filesystem index so that it knows to look for the specific block of that file that was changed when reading said file.
EDIT: Ninja-ed by Aquinus, lol
ntfs.com/data-integrity.htm
You were saying?
As for corrupted data happening, I guess that the reasoning behind NTFS not having built-in checksums is because Microsoft doesn't believe that data corruption is as big of a deal as you may think it is on a consumer level. Perhaps at the data center level like in Microsoft Azure they have that kind of support but that's at the corporate level and that's the kind of stuff that one would expect at that level. Whereas at the home level, data corruption has happened to me twice in ten years and that's only because the drive itself was failing which at that point I assumed all the data was corrupt. But again, that's why you have data backups and why you should always have multiple copies of the same data that you can't lose. Don't trust one repository for your most important of your data, have it in multiple places.
I, myself, have the most important of data saved in the cloud in Microsoft OneDrive. Vacation photos mostly, the kinds of memories that I absolutely cannot lose. There's other data that I keep saved up in the cloud but that's a story for another day. Suffice it to say, if the data is that important to you, keep it in multiple places and most importantly, keep it off site so if a disaster happens like God forbid a house fire, robbery, flood, electrical damage, etc. that data is safely stored offsite where you can recover said data.
As for CoW, I really don't see a problem considering that drives are reaching absolutely ungodly high capacities so at this point, CoW is a bit of a moot point. When you have a ten TB drive, who gives a damn? Are you really going to care? Nope, not I.
Also, someone must be asking for CoW support, seeing as it is supported not just on ZFS and BTRFS, but also on APFS.
ReFS is the future for Windows anyways.
No one really uses that anymore though.