{"id":41958,"date":"2021-07-22T18:27:07","date_gmt":"2021-07-22T18:27:07","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/microsoft-has-a-workaround-for-hivenightmare-flaw-nuke-your-shadow-copies-from-orbit\/"},"modified":"2021-07-22T18:27:07","modified_gmt":"2021-07-22T18:27:07","slug":"microsoft-has-a-workaround-for-hivenightmare-flaw-nuke-your-shadow-copies-from-orbit","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/microsoft-has-a-workaround-for-hivenightmare-flaw-nuke-your-shadow-copies-from-orbit\/","title":{"rendered":"Microsoft has a workaround for ‘HiveNightmare’ flaw: Nuke your shadow copies from orbit"},"content":{"rendered":"

After setting the “days since a security cock-up” counter back to zero, Microsoft has published an official workaround<\/a> for its Access Control Lists (ACLs) vulnerability (CVE-2021-36934<\/a>).<\/p>\n

The solution? Use the icacls<\/code> command to deal with the permissions set for the contents of system32\\config<\/code>, which are at the root of the problem, and then wipe any Volume Shadow Copy Service (VSS) shadow copies that were taken prior to the icacls<\/code> fix.<\/p>\n

It’s hardly an ideal solution, since those shadow copies could have been taken for a good reason (rather than Microsoft just firing off the operation when it feels like it). As the CVE update notes: “Deleting shadow copies could impact restore operations, including the ability to restore data with third-party backup applications.”<\/p>\n