Slashdot Mirror
Gaining System-Level Access To Vista
An anonymous reader writes "This video shows a method by which a user can use a Linux distro called BackTrack to gain system access to Windows Vista without logging into Windows or knowing the username or password for any accounts. To accomplish this, the user renames cmd.exe to Utilman.exe — this is the program that brings up the Accessibility options for users without sight or with limited vision. The attack takes advantage of the fact that the Utility Manager can be invoked before the user logs into the system. The user gains System access, which is a level higher than Administrator. The person who discovered this security hole claims that XP, 2000, 2003 and NT are not vulnerable to it; only Windows Vista is."
How is this news?
This demonstrates that it's almost impossible to secure a machine when an attacker has unrestricted physical access. Any OS is vulnerable somehow. There are a few things that can be done (like encrypting the entire system partition), but mostly solutions are limited to restricting who has physical access.
Not a typewriter
The BIOS lets you run anything! Even a whole new operating system! Unrestricted access OMG!
Fascism trolls keeping me up every night. When I starts a preachin', he HITS ME WITH HIS REICH!
Really. If you have enough access to the machine to boot your own OS and rewrite the disk, of course you can take over the machine.
Now if someone manages to do this from the outside, that's news.
Wow, if I boot a *nix machine with a rescue disk (assuming /sbin isn't encrypted) I can replace all sorts of apps that run as root with my own!
danger will robinson.
Seriously, as many problems as I have with Microsoft's past security practices, this does not look like anything.
> While this does require physical access, running
> something as root before login is still incredibly
> stupid.
Every Unix/Linux system runs "something as root" before login. You should look at "top" some time and see what pid number 1 is and who ran it.
Sig Battery depleted. Reverting to safe mode.
3 things about computers: they're alive, they're self-aware, and they hate your guts.
If they have sufficient access to rename a file, why bother rebooting into windows? Just read/write whatever you want when you have the initial disk access. Hell, modify ntoskrnl etc if you really want to.
I.O.U One Sig.
With the ability to boot up a LiveCD, wouldn't retrieving the NTLM password hashes and cracking the passwords with rainbow tables a better idea? The process can be done with Ophcrack within minutes on a modern PC. That way, the attack gains access to the local Administrator account but leaves no traces behind (i.e. no modification of system files).
The Administrator account would then allow the attacker to login into Vista and launch cmd.exe at System-Level. This can be accomplished by using the Task Scheduler at.exe to run cmd.exe at the next minute.
w00t
Reason : You need access to the system to rename the system files in the first place. To rename system files you need Admin permission.
Definition of a security hole : A security hole allows you to gain system access when you don't have system access in the first place.
This is true and correct. As long as one can spin up a disk and read it, then it's game over. A bootable distro on a CD will easily do the job. You don't even need to build or replace the kernel to do it, since init and login are user-level as far as the kernel is concerned. You might need a few special drivers for volume mounting, reading, and decryption tho. Some really bare-bones disks come to mind as potentially useful, such as very early slackware (3.x) or Linux From Scratch/Busybox, all of which fit on a floppy or two. Recall that most boxes will seek the first possible bootable media.
C|N>K
Not really, the kernel is just a file or two. If you insist, then rename init to something else (e.g. a shell) and you'll get a similar effect on Linux. Or modify the inittab to run a logged-in root shell on one of the vty's. If you really think this is some special OMG VISTA IS SO INSECURE COMPARED TO EVERYTHING ELSE flaw, then you don't understand the "problem" at all.
However I have to wonder: once you have access to the filesystem, why exactly would you bother booting into Vista and getting yourself a privileged cmd.exe? Why not just access whatever data you want from the other OS? Or does "unencrypted hard drives can be read and modified using other computers" not make a good enough headline?
This whole thing is so completely and utterly pointless it's probably created a black hole.
I think this is a useful hack. iirc, unlike most other OS's, Vista doesn't give you "real" system level admin if you login as administrator. It reserves the highest privilege level for itself. This could be useful for disabling services, updating system files and so on, that Vista won't let you do normally.
Why, because lots of people aren't sure, and don't really care enough to check. And if you are only talking, you can get away, unless you spell it out of course.
Your comment is akin to saying "Ah, but what if someone finds a way to remotely append init=/bin/bash to Grub?" There's no weakness in Linux there, as you'd need to have root on the box in order to do such a thing, and then after the shutdown -r you'd be fucked anyway as it sat at a shell 1000 miles away waiting for someone to type into the console.
Slipping shoelaces ?
While using the Accessibility Options is a bit clever, it's not like Macs are any more secure against an attack where you boot another OS and mount the drive R/W. As a matter of fact, they are probably less secure with the target disk mode or whatever they have which would mean I don't even have to run the Linux disk on the machine I wish to compromise.