Gaining System-Level Access To Vista

An anonymous reader writes "This video shows a method by which a user can use a Linux distro called BackTrack to gain system access to Windows Vista without logging into Windows or knowing the username or password for any accounts. To accomplish this, the user renames cmd.exe to Utilman.exe — this is the program that brings up the Accessibility options for users without sight or with limited vision. The attack takes advantage of the fact that the Utility Manager can be invoked before the user logs into the system. The user gains System access, which is a level higher than Administrator. The person who discovered this security hole claims that XP, 2000, 2003 and NT are not vulnerable to it; only Windows Vista is."

Comments

Cancel....

[FriendSite.com]

Allow full root access

Cancel or Allow...

Is this how it was planned?

[websters]

A conversation amongst the developers: Dev 1: "You see - we can just rename the exe and then get the job done!" Dev 2: "Is there a risk?" Dev 1: "How? Users without sight or with limited vision will have a hard time getting to cmd.exe to rename it - dumbass!"

Mastercard Ad

[this great guy]

• Getting Camstasia Studio to record your BackTrack & Vista sessions: free (you got the free trial version)
• Downloading a James Bond music to put it in your flash demo: free (you have got crazy peer-to-peer skillz)
• Showing the world the amazing things you can do with physical access to a box and that it takes you 60 long secs to painfully rename cmd.exe to utilman.exe: ...priceless

Re:PANIC

[jhdevos]

Right... They should think of some system where the BIOS will only load code that was digitally signed somehow, so these atrocities are no longer possible. Personally, I will only feel safe when I know that Microsoft completely controls what goed on on my PC!

Re:Long weekend...

[Tubal-Cain]

[badpun]Why not just call it a NIC like everyone else?[/badpun]

Re:physical access == game over

[debatem1]

Maybe if you did it to a Vista machine a decade ago, it would have.

Re:physical access == game over

[Count Fenring]

I think we can all agree that any hack involving a time machine is newsworthy.

Re:physical access == game over

[debatem1]

For a while, anyway.

Re:physical access == game over

[Kugrian]

Face it, if an attacker already has physical access to a system -- to the extent that he can run his own Linux OS on it and mess with the contents of its disks -- then that computer is already, entirely owned. This is true for Linux, it's true for OS X, it's true for BSD, and it's true for Windows. That's just the way computers work.

It's much much harder with Linux. First of all you have to work out how to lure the user out of their basement and away from their computer.

Re:Long weekend...

[WI2822]

maybe you should shop for a MAC over the weekend Do you know of any good MAC addresses?

Re:physical access == game over

[Anonymous Coward]

Not all cripples are crippled all of the time. Sometimes they appear quite normal and then have "spak attacks" which renders them unable to function like real humans. In these cases it is imperative that they can activate sticky keys with their flailing limbs so they can save their work and exit gracefully (well, you know what I mean) from the program.

Your ignorance and intolerance of cripples and mongs astounds me.

Re:physical access == game over

[Oktober Sunset]

I use a 26 char password on a laptop that locks every 5 minutes.

Once you get used to it, it's not too annoying at all.

Re:physical access == game over

[deimtee]

abcdefghijklmnopqrstuvwxyz ?

Re:physical access == game over

[ConanG]

No, it's
qwertyuiopasdfghjklzxcvbnm

but good guess!

Re:Long weekend...

[menace3society]

c0:ld:de:ad:be:ef:15:f0:0d

Re:Long weekend...

[CanisMajor]

That's amazing. I've got the same combination on my luggage!