Slashdot Mirror

← Back to Stories (view on slashdot.org)

Aging Security Vulnerability Still Allows PC Takeover

Posted by Zonk on from the there-are-issues-here-and-perhaps-they-should-be-investigated dept.

Jackson writes "Adam Boileau, a security consultant based in New Zealand has released a tool that can unlock Windows computers in seconds without the need for a password. By connecting a Linux machine to a Firewire port on the target machine, the tool can then modify Windows' password protection code and render it ineffective. Boileau said he did not release the tool publicly in 2006 because 'Microsoft was a little cagey about exactly whether Firewire memory access was a real security issue or not and we didn't want to cause any real trouble'. But now that a couple of years have passed and the issue has not resolved, Boileau decided to release the tool on his website."

5 of 282 comments (clear)

  1. host memory! by Spazmania · · Score: 5, Insightful

    So why exactly is it a desirable feature for a firewire node to be able to access another node's memory unsolicited?

    --
    Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
  2. Re:The hard part is... by MPAB · · Score: 5, Insightful

    Many laptops have Firewire ports, and most modern desktop mainboards do also thanks to te growing popularity of digital video cameras.

  3. Re:Breathtaking Arrogance or Stupidity? by goddidit · · Score: 5, Insightful

    But this works with crypted drives.

    --
    This .sig is exactly 120 characters long.
  4. Re:Breathtaking Arrogance or Stupidity? by LingNoi · · Score: 5, Insightful

    That's not exactly the same.. Take my library for example all machines are set to boot correctly and the cases are physically locked to their location. Also looks a lot less suspicious when you're not ripping the guts out of a machine that it's obvious you don't own in public..

  5. Re:Breathtaking Arrogance or Stupidity? by Anonymous Coward · · Score: 5, Insightful

    Doesn't that also mean that Linux is also vulnerable to Apples firewire design faults?