Here's how it worked, there's a Windows security feature called UIPI (User Interface Privilege Isolation) that prevents processes from sending messages to more privileged processes. That's critical, otherwise an unprivileged process can just send input to explorer and make it delete all your files or whatever. This was used to keep Internet Explorer sandboxed, so that if IE got compromised, it couldn't take over your computer.
UIPI didn't prevent processes from triggering key combinations registered with RegisterHotKey() though, which is what explorer uses for things like Alt+Tab and so on. Turns out, there was a way to send input to cmd.exe windows, but it literally only worked on cmd.exe. That sounds bad, but an unprivileged process can't spawn a highly privileged cmd.exe, when you create a new process it just inherits your privilege level. That means you can't make it do anything you couldn't already do on your own.
But.... you can spawn a low privileged cmd.exe, which gets added to the taskbar... then use the Win+Shift+Number shortcut registered with RegisterHotKey() to tell explorer to create a new window (Try it!). Explorer is already privileged, so the new window is spawned with privileges (technically, medium integrity) and then you can take it over!
It's crazy, but that was a real bug.
Here's a video of it working: https://twitter.com/Meatballs__/status/365233323406143489
And it's really in Metasploit: https://www.rapid7.com/db/modules/exploit/windows/local/ms13...
You might be aware of this already, but if anyone isn't this aware, this picture from the article has a number of Windows-/Super- key shortcuts that works already:
https://github.com/microsoft/PowerToys/blob/master/WindowsKe...
Who needs a shortcut to Ease of Access settings, or to the narrator? Who needs Start+, if you already have Start+D?
Start+Ctrl+D opens a new virtual desktop? Despite me never using virtual desktops? And now I have to learn all about virtual desktops (while I don't need them) to correct my accidentally pressing the Start button too when I was typing Ctrl+D. Thanks guys, for making every key-combo some or the other shortcut for stuff I don't need. My windows experience is quite good but for the growing fear of accidentally hitting some unknown shortcut and screwing things up.
Microsoft, please start removing shortcuts that no one needs, you surely must have all the telemetry data to support my point by now.
Happy to see you aren't working at Microsoft.
This constant push to remove everything that someone doesn't see the value of is really annoying for me.
Most of these shortcuts has been there for years.
The fact that you weren't even aware probably shows that this isn't a problem at all.
So please Microsoft: continue to "just work".
I far prefer Linux, but there is something to be said for "just working" for a very long time. (Feels crazy to say and I have a fair number of annoyances with Windows, but even if Windows never made me happy like a good KDE 3 or 5 setup, even Vista and 8 was kind of usable for me after some configuration, this is something I cannot say certain alternatives at that time)
(Now, there is one really crazy shortcut IMO, and that is alt + shift + space; enabled by default at least until Windows 8. Will change you keyboard layout with next to no visual feedback. Why this needs to be there by default on machines that will never be used for more than one language is beyond me, but I'll leave that to the experts, I'd rather have too many options than to few.)
Seriously? Those are probably the most important shortcuts on there. Having a way to immediately jump to accessibility settings is critical for all of the people who need those tools when they sit down at an unfamiliar computer, or even their own computer.
As for all of the others, yes, they should all be there. If you use it, dictation is something that's done frequently, as is use of the Game Bar (how else would you call it up during a full screen game?) and virtual desktops.
> Microsoft, please start removing shortcuts that no one needs, you surely must have all the telemetry data to support my point by now.
The fact that they haven't removed them should be enough evidence that they are, in fact, used.
(Furthermore, the updates to the Game Bar currently in Xbox Insider Preview right now add a ton of new useful widgets including things like direct access to your Xbox Friends list without needing to jump to the Xbox App. It's becoming an even better PC-world equivalent to the Xbox Guide blades on an Xbox One. Bringing things closer to what you can do with the Discord or Steam overlays, but universal across all your games rather than developer or launcher specific. [Hopefully the widgets will be extensible in the future and maybe help us move to a world where it can eat those other two overlays; one overlay to rule them all.])