Slashdot Mirror
Researchers Show How To Take Control of Windows 7
alphadogg writes "Security researchers demonstrated how to take control of a computer running Microsoft's upcoming Windows 7 operating system at the Hack In The Box Security Conference (HITB) in Dubai on Thursday. Researchers Vipin Kumar and Nitin Kumar used proof-of-concept code they developed, called VBootkit 2.0, to take control of a Windows 7 virtual machine while it was booting up. 'There's no fix for this. It cannot be fixed. It's a design problem,' Vipin Kumar said, explaining the software exploits the Windows 7 assumption that the boot process is safe from attack. While VBootkit 2.0 shows how an attacker can take control of a Windows 7 computer, it's not necessarily a serious threat. For the attack to work, an attacker must have physical access to the victim's computer. The attack can not be done remotely." Which makes me wonder why I'm posting this :)
We hear about it all the time, laptops being stolen, left out, all with tons of sensitive data. Combine this with a lot of companies having very poor physical security this could be more than something to just write off.
The musings of just another geek and his junk.
If you got physical access already, it shouldn't be a surprise you can root the box.
If someone has physical control of the machine, all bets are off.
Rule 1 of computers is, if someone has physical access to your machine, it has already been compromised. I always design my security around this fact, and if a machine needs to be secure against attack, it will be physically secure.
It's been a long time.
You need full, physical control of a computer running Windows 7 in order to get software access to it?
Just have the initial virus/exploit write onto a bootable device, like a USB key - and then force a reboot. The user will just think "aww, crap, why'd it just reboot" - and you got em.
This is barely a hack. I can steal any car in the world. Give me the keys, some gas, and park it in my drive way. Watch me steal it with ease! HA!
If you boot from a Live CD, since you have physical access to the machine, isn't it essentially the same thing? I'm confused about how this is a vulnerability.
-- NeilO
There's a rather important aspect of this that's not discussed - how does this code get onto the computer in the first place to be executed during boot ?
You need physical access to the machine. Cant be done remotely. So nothing new.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
If you give me physical access to a Linux machine, I can have it doing as I please faster than Vista.
Having physical access to the box kind of takes away all the fun...
On the Oregon Cost born and raised, On the beach is where I spent most of my days
This is contrasted with Mac OSX which uses a combination of Gracie-style Brazilian Jiu Jitsu, Hapkido, and oratorical prowess to keep would-be haxors at bay while the police are enroute. Or the Linux lack of social skills which avoids "physical access" altogether.
THL phish sticks
OK, I'm not a Mac guy so I can say nothing about it. I've also not used Windows 7.
But, really. If you give me physical access to damned near any Windows or Linux machine, it's owned. And there are a lot of people out there a helluva lot better then me.
Sure, I won't be able to crack your encrypted archives. Nor your well-protected stored passwords. But hacking root/admin with physical access to the box isn't rocket science. Actually, it's much tougher with Vista than any Linux distro I've run into.
He's getting rather old, but he's a good mouse.
Im as anti-microsoft as the rest of you (at least the intelligent folk), but are you all seriously claiming that linux or unix distros are immune to tampering with the boot partition?
I would assume the only way to be immune against this type of attack would be encrypting the system partition, and a "bootkit" as they seem to be calling it that is aware of encryption may even be able to deal with that.
Whats the story here again? That booting into a secondary OS gives you full control of data on an unencrypted hard drive?
Get physical access to computer. Take computer.
Also restarts kill it. This is Windows we're talking about here...
...Windows 7 takes control of you!
"The difference between genius and stupidity is that genius has it's limits" - Albert Einstein
if it is a remote exploit that doesn't involve user interaction, I definitely want to hear about it (like homeland security's red=everybody panic)
If it is a remote exploit that requires user interaction, I still want to hear about it (condition=orange)
If it is a local exploit/privilege escalation that doesn't require root, it might be interesting (yellow)
If it is a local exploit that requires root privileges, leave it off the front page.
I was going to say... if you have physical access, you can take out the hard drive, put it in another box, muck around with the data in any way you want and put it back. I'm an Apple fanboi at heart, but, geeze, this seems like a big, honkin' "What-ever!" to me.
The CB App. What's your 20?
i have no love of M$, but come on. if you have physcal access to a computer and at boot time no less you can do what ever the #@!! you want.
if this is the biggest flaw redmond has in W7, that's not so bad.
Till i saw "physical access." if someone is _that_ determined to compromise a machine they will walk off with the HDD.
I can steal any car in the world. Give me the keys, some gas, and park it in my drive way. Watch me steal it with ease! HA!
Intersting idea. While the current version requires physical access, it doesn't strike me that one would need all that much to make it work via remote with a trojan or similar.
Basically, it's a revisit of the boot-sector virus of old, which will prove to be an issue for just about any OS, most likely.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
What I find interesting is the people who are trumpeting this as a horrible security vulnerability, despite needing physical access to the machine, are likely to be the same ones who discounted the Intel cache overflow exploit being easier to execute on Linux than other systems, but you need to run as root on Linux as "If someone has root, it's your fault anyways." So what makes this one more egregious in their eyes? You can run root over a network. That seems worse than needing physical access to the machine, imo. It just goes to show, no OS is completely safe, no matter what, and user education is the key. Not security through obscurity.
Canada: The US's more awesome sibling.
The problem goes even deeper. The bios is insecure. You can put bootable media in it and access your drives. They really should start epoxy potting the whole machine with a harddrive with windows preinstalled and no longer allowing any other bootable media.
The attack involves patching particular Windows system files in RAM during the boot process, which explains why physical access is required, and why it doesn't work after a reboot. The attacker loads an app from a CD-ROM which then itself executes the normal Windows boot process while agressively patching software in memory. This also isn't a windows-specific vulnerability: any OS which does not checksum memory contents each time they're read is vulnerable.
No kidding!!! What do you say at this point?
While uninteresting for worms, this is probably a nice way for pirates to hack Windows 7..
I'm not sure if they have cracked it already or not, since I'm still on XP.
"What I find interesting is the people who are trumpeting this as a horrible security vulnerability"
Where did you read that, from a quick browse most/all of them mention physical access. Where are all these nay-sayer comments?
"are likely to be the same ones who discounted the Intel cache overflow exploit being easier to execute on Linux than other systems"
That's what's knows as a straw man argument. As in making up imagionary quotes on another thread and addressing them instead of the current subject, which is researchers demo proof-of-concept code to take control of a Windows 7 virtual machine while it was booting up.
davecb5620@gmail.com
'There's no fix for this. It cannot be fixed. It's a design problem,
There is always a fix. Every vulnerability is a "design problem". Sometimes the code to fix it is a separate app (e.g. firewall, virus protection), and sometimes it requires modification to the code. There is always a fix in software - it's just a matter of making it.
This guy stating there is no fix, it can't be fixed is making statements about as dumb as those who say their favorite OS (e.g. OS X) is immune from any virus/worms/hacks.
I do not support "The Man". I also do not support your irrational stupidity
But, really. If you give me physical access to damned near any Windows or Linux machine, it's owned.
OK - Sorry in advance for the self-quote and self-reply, but I thought that I would correct myself before somebody else does. Total hard-drive encryption makes taking a box over significantly harder - Well beyond anything I've actually done. I've read about techniques more sophisticated than an in-line PS/2 or USB sniffer, but I'll leave it to the experts to freeze/remove/copy live RAM. I was talking about your standard office-building desktops.
He's getting rather old, but he's a good mouse.
If you have to be present to perform the hack, then you could always just hit the PC repeatedly with a hammer if for some reason it doesn't work.
At first glance at the thread title, my first thought was pop a Linux CD into the drive and reboot
Voila no more Win7
"Suppose you were an idiot...and suppose you were a member of Congress...but I repeat myself." Mark Twain
But who would want to take control of a computer with windows 7 on it? It is like hijacking a garbage scow.
Even if they do checksum/hash memory constantly, it doesn't make a damn bit of difference. If you can patch memory, you can patch the code to remove checks. In fact, the Vista/7 bootloader does not only checksums but signature checks.
even worse than those gaping security holes for linux that assume the attacker has root access.
"A cracker with physical access to a machine can take control of the computer during boot. News at 11."
Mod points: Guaranteed to remove your sense of humor.
Side effects may include gullibility and temporary retardation
"The attack involves patching particular Windows system files in RAM during the boot process, which explains why physical access is required, and why it doesn't work after a reboot"
'The latest version of VBootkit includes the ability to remotely control the victim's computer. In addition, the software allows an attacker to increase their user privileges to system level, the highest possible level. The software can also able remove a user's password, giving an attacker access to all of their files. Afterwards, VBootkit 2.0 restores the original password, ensuring that the attack will go undetected'
I thought BitLocker was supposed to defend against such exploits if the boot sequence was altered?
davecb5620@gmail.com
This also isn't a windows-specific vulnerability: any OS which does not checksum memory contents each time they're read is vulnerable.
Even that wouldn't matter, because the first thing I'd in-memory patch is the checksum algorithm to always return 'ok'.
The only real way to resolve this would be a-la console style 'trusted computing, and digital signatures through the whole bios and bootstrap process'. Of course, even this could be 'hacked' or 'modchipped' but at least it wouldn't be as simple as just putting in a disk.
There is no security if they have enough physical access.
...someone has physical access to my computer shouldn't mean they have access to the data stored on that computer. This is NOT acceptable. Users need to adjust their expectations and DEMAND better security. Tired of this BS, "If someone has physical access..."
Computer thefts are not rare occurrence to say it is acceptable if someone already has computer they might as well have the data!
I thought that was part of the bitlocker boot process, that the unencrypted boot files have their checksums stored in the tpm
Hi. I see you are making fun of a "security vulnerability". This vulnerability involves being physically present at a PC and being able to boot it. This is a security vulnerability in the same way that my house is insecure to folks who I invite over for dinner.
You obviously have no clue, and I would recommend not posting in security vulnerabilities discussions any more.
kthxbai.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
Because you are a Microsoft hating troll
There is no "-1 offended" or "-1 you don't agree with me" mod options for a reason.
... the reason you are posting this article is to spread anti-microsoft hate and FUD for no reason.
Why not post:
With a gentoo install CD you can gain control of any linux system by overwriting key /etc/ files to give yourself root access unless you use encrypted drives...
More useless propaganda from an MS-hater. I mean seriously, this is news? Next thing you'll post is the Windows 7 has a horrible exploit that crashes it every time you shoot the PC with a shot gun.
Don't we have a NO FUD policy for articles?
"Everyone is entitled to be stupid, but some abuse the privilege", as a result of this abuse, your Stupid License has been suspended for 60 days.
-=[ Who Is John Galt? ]=-
Please explain in detail how one would make this work without physical access to the box.
There is no "-1 offended" or "-1 you don't agree with me" mod options for a reason.
Reminds me of the Shatter attack, which was also "unfixable" until Vista fixed it.
But unlike the Shatter attack, we don't even have to wait for a fix. Just turn on Bitlocker. There, fixed that unfixable problem for ya. With a security feature already present in the OS. Kinda makes you wonder what their definition of "unfixable" is...
Jeeze, hyperbole much?
In the absence of physical security, taking over a vista, linux, mac os x or (insert vendor here) UNIX system is not difficult, providing you know the platform. No, the 'average gramma' can't do it, but most of us most likely can - with not much more than a google search and a quick download.
I'm not a microsoft (or apple, or linux) fanboi by any means, but a system is only as secure as you actually make it. Disk encryption helps - it's a great idea - so I've honestly never met anyone who's used it.
While this is certainly an interesting exploit, I doubt highly that many systems will be compromised in the wild with it.
http://www.bistolas.net
The remote access and priviledge level exploits are only possible after VBootkit has been patched into memory. Bitlocker protects against patching the OS on the disk but I don't think it offers any protection against changing the OS contents, beyond the "user input" requirement for boot (either a PIN or a physical device, which this software may or may not be able to bypass).
No kidding!!! What do you say at this point?
Oh my god, windows can be hacked! With physical access! THIS IS HUGE! WINDOWS SUCKS MICROFOSFT IS TEH DEVAL OOH NOES!!1!one
Linux... Mac OS, Windows, ANYTHING... can be hacked with physical access. Period. If you have the time and the access there is no security beyond encryption and even that can eventually be defeated. This seems like just another lame "bash microsoft" post. Yeah you hate them, sure we know it. Get over it. They didn't become one of the largest software providers on earth by use of magic and lolly pops (though it did take a few suckers here and there).
The worst part is that its a bunch of security researchers that blew time on this bullshit and then in the end said "but don't worry it doesn't matter." Then why the fuck did you bother with it? Congratulations for proving what the whole fucking security industry already knew captain obvious! Whats next, going to tell us that wireless routers have a physical switch vulnerability when the default password is used? Do us all a favor and fly out that window and save the world buddy.
The standard method of securing the data on your machine, which is what's important, is to encrypt it. So even if someone rips open the box, takes out the disk and puts it in another machine, the data should be safe, assuming the encryption algorithm and the user authentication processes are secure.
However, if this exploit allows them access to the operating system on the disk, and allows them to subvert the user authentication process to grant themselves access to a user's account, then the data is compromised.
So this exploit may have an application, not as an attack vector for writing a propagating worm or virus, but as a means to gain access to otherwise secure data.
"The dew has clearly fallen with a particularly sickening thud this morning"
I overlooked it, it's explained well below.
No kidding!!! What do you say at this point?
much tougher with Vista than any Linux distro I've run into.
And us linux users consider that a feature.
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
Everyone talking about this being irrelevant is missing the point. This attack does not make users significantly more vulnerable. Instead, it makes Windows more vulnerable to users.
Hacking your own machine sounds laughable. But as long as vendors restrict usage, we need to keep reminding them that DRM is a fool's quest.
If that's so then I imagine it would be a protection from this, assuming Windows is assiduous about checking those files' checksums. It's implied in the article that it is not, but I'm not sure if the exploit was tested against a system with a TPM.
No kidding!!! What do you say at this point?
So these guys came up with a bootloader that screws with its child process (the OS), and they're calling that an exploit ? I guess "grub" would be considered an exploit too, by their chicken-little standards.
These two Kumar clowns are really just shills for Trusted Computing, fear-mongering in exchange for a little kickback from the related fascist orgs.
-Billco, Fnarg.com
This article is nonsense.
Yes, why? Makes me wonder why I'm reading this :(
No one will want or remember how to hack this old one...
I'll be safe in my cubie now.
Maybe someone can shed some more light on this, but I'd imagine this could be used to insert your own kernel-mode code, without the kernel detecting it. So how hard would it be to patch ati's driver to dump every frame to the hard drive, without any of their shit detecting you (since you already own kernel mode). You'd be able to dump the video off bluray/wmv easily (although you would just have video, none of the extra features/java menus). I'd imagine that ati's driver isn't obfuscated. The path between user space (Win dvd) and the kernel is obfuscated, and the path between kernel mode/ram and the pci card/pci bus is encrypted, but at some point in the kernel its going to be decrypted and easily accessible. Anyone able to share their thoughts on this?
Not all of us. Speak for yourself.
"If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
Would someone really so smart please take proper control of Windows 7's development?
That would be of greatest help!
Actually, I read the summary over and over, and I didn't see anything about linux or unix. I read again, and didn't see any microsoft bashing, either.
What makes you think someone made a claim about linux or unix, or that someone bashed microsoft? You might as well say, "I'm as anti-octopus as the rest of you, but are you all seriously claiming Jupiter orbits Venus?" and it wouldn't be any less of a nonsequiter.
Were you thinking of doing something more sophisticated then booting w/ a live CD to change the root password (or just work on the hard drive as root)? Becuase you could guard against that by setting passwords for your BIOS, which most BIOSes seem to support. Also, I don't see why Vista or a Macintosh wouldn't be vulnerable to this, but I haven't really used either much.
Given that this appears to be loaded via internal optical drive, I'm not completely understanding why this is such a threat. Discounting the fact mentioned by many others that if you're physically compromised you're already hosed (they can pull the hard drive, etc.), all BIOS renditions I've ever seen allow you to select which device the machine first uses to boot. So, set it to your hard drive. Machine boots from hard drive, doesn't boot from bad CD/DVD. Password protecting your BIOS access (which many, if not most, offer) prevents malicious user from setting the machine back to CD/DVD boot. Some BIOS flavors allow you to turn off CD/DVD boot all together, even.
End of "problem".
I mean really-- This is so simple I fear I must be missing something about this story... ?
" the software allows an attacker to increase their user privileges to system level, the highest possible level. The software can also able remove a user's password, giving an attacker access to all of their files. Afterwards, VBootkit 2.0 restores the original password, ensuring that the attack will go undetected."
So this is basically great if you want to break into your girlfriends laptop to check her email?
Can someone knowledgeable explain why this is news?
1 1 2 3 5 8 13 21 34 55 89 144 233 377 610 987 1597 2584 4181 6765
Yes - My first system breach (not counting MS systems that were completely unsecured - I mean actually circumventing security) in the wild was back in the early 90's - A university *nix system. The thing that made (makes) *nix such an easy target is that you can actually understand how it works. Windows is full of holes, but it's so frigging weird and hard to wrap your head around the bizarre OS that the casual cracker won't bother learning what's going on. If your only goal is to satisfy some childish desire to breach security and smugly toss your hands in the air and declare yourself an 31337 hacker (as was my case), Linux is the way to go.
Agreed - Being able to understand your OS is indeed a feature for people living in Linux world.
He's getting rather old, but he's a good mouse.
Relax Luther, it's much worse than you think. The only certified technician has to pass a series of security scans. First one is voice activated. Then, he has to put in a 6 digit code. That only gets him into the outer room. In order to get in the vault, he first has to pass a retina scan. Then, the door will unlock by only by two electronic keycards, which we won't have. In the vault, there are three security sensors that will activate at anytime the technician is out of the room. First is voice sensitive, anything above a whisper, will set it off. The second one senses the temperature even the body heat of an unauthorized person in the room can set it off if the temperature rises by a single degree. The temperature is controlled by an air duct system 30 feet above the floor. The vent is guarded by a laser net. The third one is on the floor, and it's pressure sensitive. Just the slightest increase in weight will set it off. If any of these 3 sensors are set off will trigger an automatic lockdown. Let me tell you, gentlemen, that all three systems, are state of the art.
Actually, it's much tougher with Vista than any Linux distro I've run into.
First time I didn't had the password for the Vista Admin account it took me 2 min to reset the password to blank. Including the minute and half to find Hiren's boot CD.
Love many, trust a few, do harm to none.
you posted it because you were pissed about the Intel CPU hack for Linux that allows one to compromise ALL virtual machines on that server.
I would say, if you have physical access to my VM's host and you can't "hack" a rootkit into a VM, that you sir, suck.
bios passwords are a joke. on my hp pavillion, if i slide open the side cover and shake up the cell on the mobo, it forgets all bios settings and the password too.
Wealth is the gift that keeps on giving.
Or the attacker just needs to distribute a warez copy of Windows 7 with the exploit code slipstreamed... Oh the irony!
If you're going to be brazen enough to change the root password with a live CD, why not take the extra step of cracking open the case and resetting the BIOS? It might raise a couple of more eye-brows in an office environment, but a stranger sitting at a PC may even be less suspicious when he cracks the case open because he's "repairing" it for the regular user.
He's getting rather old, but he's a good mouse.
How did a boot-sector virus work?
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Physical access may not be necessary, they may be able to have the computer boot to an alternative media, which will in turn boot Windows with this hack. So, if you leave your USB stick or external storage drive connected, and they have a user-space attack that lets them put this exploit on that and force a reboot, you get the idea.
http://www.mhall119.com
If someone has physical control of the machine, all bets are off.
Ah, apparently you've never heard of Phil Zimmerman or have ever seen a James Bond movie, have you?
Point here is there is quite a bit that has and can be done even at the physical layer. Drive Encryption (PGP) is but one option, and given the track record of PGP, I'd say a pretty damn good one. TrueCrypt is a great free alternative too.
And I for one am glad this was posted. Just helps enlighten everyone on the importance of good security practice regardless of how shiny and new the OS is.
There are no foolproof Operating Systems out there, just fools who think there are.
How is it any different to shoving in a Linux Live CD, running BartPE or running Windows setup, doing a repair install and sticking your own account on?
I only please one person per day. Today is not your day. Tomorrow isn't looking good either. - Scott Adams
BIOS passwords are in no way secure. Resetting bios passwords is as easy as taking the backup battery off the motherboard, and unplugging it long enough to reset to its factory state. To prevent this you have to lock the hardware up from physical access.
...it's called a "locked room" with "security cameras". Deny physical access = deny vbookit 2.0. "Design problem" solved.
No. It CAN'T be done remotely, as is mentioned below the exploit is done by patching startup files in RAM as the machine boots.
There is no way to do this other than through a boot-CD... (or some other type of boot-able physically attached storage medium)
My thoughts exactly. People look at me weird when I say I prefer linux to windows because windows is far to complicated. What they don't understand is that there are more kinds of 'complicated' than just "what icon do I click to get internet?".
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
This should allow bypassing *some* of the Windows7 DRM features since it seems to be a way around part of the "trusted computing chain".
Your 'i' key is broken. ;-)
The thing that made (makes) *nix such an easy target is that you can actually understand how it works. Windows is full of holes, but it's so frigging weird and hard to wrap your head around the bizarre OS that the casual cracker won't bother learning what's going on.
What I find really strange is that a 'mixed bag' like a Linux distro with software from all over the place hodge-podged together actually does often make a lot more sense functionally than a complete in-house setup like Windows. I can understand my Linux box. Windows drives me freaking insane!
sudo mount --milk --sugar
If "Step 1" of your method of taking control of someone else's computer is "Gain physical access to the hardware," there's no reason for you to even talk about it.
I was personally very suprised at how easy it was for me to reset a password in Ubuntu.
My linux juju was pretty dusty at the time (I manage a Windows network, which takes all the fun out of playing with computers in my spare time). But a friend of mine brought me a Ubuntu computer that was property of a deceased relative and asked me to reset the password so he could get his relative's data off. I was able to boot to a Live CD, mount the hard drive into a temp folder, use "chroot" to change my root folder to the one on the hard drive, use "passwd" to reset their password. Done deal. Took me 10 minutes and again I reference that my Linux juju was very dusty.
I'm not bragging...there's tons of users (most of them here, probably) better at Linux than me. But having physical access to the system made it no problem.
With Windows, you just get a copy of "Ultimate Boot CD" and use the password reset utility.
As noted previously, though, changing password won't get you access to encrypted data.
Sorry...I just feel that this is a "non-story". More stuff to try and bash on Microsoft unreasonably. There's plenty of things you can beat up Microsoft over without having to make some more up.
Later,
-JJS
With physical access to any standard desktop machine, you can easily get into Windows, Linux, or Mac OS. This comes in very handy with an IT environment where there is no central authentication server of sorts, or when people bring PC's to your computer shop with forgotten passwords. I'm not sure about Mac OS, but for Windows or Linux, if you don't want their password changed... just back up the file before you change it, then copy it back when you're done. Encrypted hard drives is a different ballpark though... never messed with those.
Whereas with Linux you just boot into single user mode & use passwd to set the root password.
Not a sentence!
If you are able to gain access to the iLO card on an HP server that is remote... one can mount ISOs and remote console etc. Don't need to be in front of the machine at all.
Don't install it.
Geeze these guys really are on the mainstream conference ciruit
I'll correct you a bit further -- there are different kinds of physical access. For instance, a public computer lab might have machines which have their case locked, both to prevent it from being opened and to prevent it from being locked down, BIOS locked and configured to boot only from hard disk, bootloader locked, etc.
On such a machine, there's really not a lot you can do to compromise it without some sort of actual software vulnerability or misconfiguration. You might be able to add a physical keylogger -- maybe -- depends how kiosk-ified it is.
However, this does not appear to be such an attack. Rather, it seems this is an attack which requires you to boot the machine off of some other media. Most machines are wide open to this in many ways -- the more frightening one was PXE; just plug a laptop into the same network and own every machine as it boots.
But Vista is not unique in this respect, and I cannot imagine how an OS could protect itself against such an attack. And even network boots can be secured, if you can add just a kernel and initrd to local storage.
Don't thank God, thank a doctor!
Unless, of course, the admin has set the box up to require a password for single user mode as well.
This is a rather stupid article. You can boot ANY computer with a Linux live CD and take control of someones computer and/or access unencrypted files/folders. Fail..
You can hackz0rs the lock with a credit card and a knife. The bios lock isn't going to do any good either because you could humanly brute force it with manufacturer mother passwords.
Here be signatures
If you're going to be brazen enough to change the root password with a live CD, why not take the extra step of cracking open the case and resetting the BIOS?
A lot of cases support an external physical lock, and for those that don't, there's aftermarket products available.
Again, though, it gets back to making the computer physically secure.
Don't you wish your girlfriend was a geek like me?
Comment removed based on user account deletion
Depends how well you know Vista when you are running Linux daily... but if he knows Vista as much as his Linux distro's, then that is defenately a feature, hands down.
Here be signatures
Actually, it's much tougher with Vista than any Linux distro I've run into.
If you can change the boot device, you pop in your favorite LiveCD and you don't even need to know what you just broke. If not, a passworded GRUB is as good as it gets.
I'm seriously wondering what you meant by that.
Actually, it's much tougher with Vista than any Linux distro I've run into.
Well, this does Vista in a split second although encrypted files remain protected until you "remember" the old password.
I'm confused, did they take control of Windows 7 running in a VM or did they take control of the VM that runs in Windows 7 (the one that handles UAC)? I'm obviously not an expert in Windows' security model so I could be misunderstanding
A boot CD (Hirens or Windows) wont do you any good if there is no local administrator account on the system.
You'd have root on the box, but not necessarily root on the OS. This could theoretically defeat Bitlocker, though I'm no expert on that and the article doesn't specify.
http://www.mhall119.com
My case came with one of those case locks. The manufacturer forgot to ship the key. Turned out the key to my luggage is about the same size and I was able to get into it in a few minutes. While there are probably more secure solutions than the one on my PC, picking a lock isn't much of a roadblock.
Most Windows and Mac machines (I've never checked Linux, but probably there, too) can be booted to a USB drive and with the right configuration, pretty much full access to the drive unless it's encrypted. Sometimes this can be disabled in firmware (e.g. BIOS, EFI, etc), however.
The exploit you're describing is the same kind I used to get past Foolproof on the mac with a zip (and later jaz) drive 15+ years ago. It can be beaten partially by encrypted drives (you can still erase the drive and install your own OS, but you can't steal data or use programs).
This is a bit different - if I read it correctly, it may even work on a hardware encrypted drive because it is a runtime exploit and doesn't require admin. That is a bit more akin to a non-root exploit on *nix - the user that is infected has to do the bidding of the master program, but a reboot clears it up. Just because it is memory resident in user-space doesn't mean it isn't dangerous - it could, say, rewrite the startup part of any user-space applications with malicious code and always start when that user runs that program, or infect something like Word macros by identifying them and injecting code.
Sounds like the attack could be used to subvert just about any operating system if it can modify files as the OS is booting.
try leaving a bootable cd in a bitlockered system. vista wont boot with it in the drive. bitlocker is pretty tough
Thank you. That saved me reading the article. Nowadays, when in a hurry, I read Slashdot comments backwards :) Saves me reading the initial thread (which always becomes too long) and the funny comments.
In all seriousness, resetting the root password is trivial on most desktop type linux distros, but it really isn't all that hard to find ones where this isn't the case. Or at least is harder than resetting the administrator password in XP. I haven't had to look into how to do so in Vista yet.
(Also, in all seriousness, I do find most every task I use a computer for easier with linux than windows. YMMV.)
Ideology: A tool used primarily to avoid the bother of thinking.
Uh no.
Being a Mac guy, I can own a Mac box with physical access as well. Now you can too, here's how:
1. Boot up Mac OS X into single user mode (root prompt): Hold down Command-S while booting.
2. If there's a firmware password set, opening up the box and changing the RAM will clear it.
That's it.
If I have the machine in my hands I can do worse things than corrupt the boot process. I can take the damn hard drive out and do whatever the hell I want with it. Not much of a hack.
In the labs I used to work at:
You need to get to the motherboard to reset the password. No master password for you.
You need a hackz0rs saw to get through the locks we use in order to open the case or remove the machine.
Have fun under that desk for 20 minutes.
Windows 7 lets you run without an account with admin access? What?
I think the main thing that made this news is that it is apparently "unfixable". And the way that it is completely undetectable makes it more troublesome. I'd rather know that MS is looking at some sort of way to counter this issue.
If attached to AD...
They are spread through ... wait for it ... the use of infected removable media which requires physical access to the machine.
There is no "-1 offended" or "-1 you don't agree with me" mod options for a reason.
I used to hack Linux boxes thanks to a flaw in Lilo back in the day. You could locally get root with a 1 line command through the bootloader. It freaked the hell out of this one CS professor I had...good times.
This is a great problem if you cannot open the box (because of locks on the housing) but have access otherwise. Situations like you have in enterprises, government or banks.
Avoiding detection of such a crack is important. TFA is not explicit about the prerequisites of the attack though.
nosig today
nt
I can think of several ways around the PoC's physical-access requirement. If the boot loader can be modified by malware, then the malware can drop the neccesary code into the boot loader and force a reboot of the machine. If the BIOS is in flash and can be modified, then malware can re-flash the BIOS to include the neccesary code. And I'm remembering an old BIOS soft-boot option that did not clear RAM before rebooting, leaving a way for malware to leave parts of itself in memory across a reboot. I'm not too worried about anything that requires physical access, but this thing looks like it could be extended to not require physical access as long as there's another vector available to bootstrap the infection through.
I'd note that it's not just Windows 7 that's vulnerable to this, any OS is theoretically vulnerable to in-memory patching during the boot process. But OSes other than Windows have far fewer other vectors available to bootstrap the initial infection through, so would be harder to attack this way.
One could still seem some uses for this. For example consider some bios based infection. While it theoretically could do a lot of harm, in practice it is going to be really hard to implement a lot of things from the bios. So why not infect the OS itself on every boot? In principle no new capabilities in theory, but it might still be a really convenient vector for an attack.
One might also use this to hack systems that one nominally has physcial access to but no actual control. For example if some future Xbox 420 is running a windows 7 kernel, maybe you could use this as a way to bust in to the locked down device in a generic way.
Some drink at the fountain of knowledge. Others just gargle.
Why would any of these said places of PXE boot enabled, and not have the BIOS locked, and the boot order properly configured? This seems to be another instance where if you have a less than capable user, they will be in trouble. 95% of machines built do not come with PXE enabled, or as the first boot preference. If you have to get to the orginal box to edit the VM who cares. Lock it up.
Because you are troll hating Microsoft
"The attack involves patching particular Windows system files in RAM during the boot process, which explains why physical access is required, and why it doesn't work after a reboot"
'The latest version of VBootkit includes the ability to remotely control the victim's computer. In addition, the software allows an attacker to increase their user privileges to system level, the highest possible level. The software can also able remove a user's password, giving an attacker access to all of their files. Afterwards, VBootkit 2.0 restores the original password, ensuring that the attack will go undetected'
I thought BitLocker was supposed to defend against such exploits if the boot sequence was altered?
BitLocker plus TPM plus PIN should stop this attack as the system takes "measurements" (SHA hashes) of each boot component before it runs it starting from the BIOS. These measurements are passed to the TPM which releases the disk encryption keys if all measurements are correct out. If someone modifies a boot file then the boot fails.
It gives you the full list of all the user and you select which one do you want to reset.
Love many, trust a few, do harm to none.
Actually, it's much tougher with Vista than any Linux distro I've run into.
Actually, there are a number of Linux-based recovery disks that can null or change a Vista password easily within 3-5 minutes.... but as pointed out, with physical access, all bets are off.
Don't tell me to get a life. I'm a gamer; I have LOTS of lives!
oblig xkcd reference
This is a very old news. A similar article was posted about a year ago. New guy - same shit. The attacker needs a physical access to the PC, which is absolute no-fair. Why the fukc you need to fuss around, when you just can take the whole thing home?
The same can be said about any OS -- if you allowed to mess with its files, you can make a rootkit. How dumb one have to be to make a story out of this nonsense?
OMG, "There is no fix for this, it is a design problem". You damn right, it is a design problem. IN YOUR HEAD.
XP + AD doesn't let you do that (without a bunch of hacking that breaks stuff ). And you can always get the account back easily.
Remotely control the machine once the rootkit is in place, yes, but it can't remotely install itself. The process requires booting off of a CD to modify the contents of the RAM while the OS is booting. So, if you disable booting from CD in the BIOS and require a supervisor password, then problem solved.
If some idiot runs an executable for you, you might as well have physical access to the machine.
You've confused me. How do you leave your USB stick or external drive connected to a box you DON'T have physical access too?
Anonymity of the internet is responsible for the views expressed in my post.
If the box owner leave's his own USB drive connected, and a remote attacker gains user-level access to his box, he can write to that drive and force a reboot. If the user's system is configured to boot from USB, then the remote attack might be able to use this exploit, no physical access was necessary.
http://www.mhall119.com
Except that it cannot reset Domain accounts. If you haven't got any local accounts (not recommended) there's not much you can do.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
Dude, it's "unfixable" for ALL operating systems. Linux. Mac OS. Windows. Unix. Solaris. Novell. ALL. This isn't news in any sense of the term.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
You damn right, it is a design problem. IN YOUR HEAD.
Thanks. Made me shoot beer out of my nose.
"It's the Law of the Universe, and I'm the sheriff." Slash-cott 2/10-2/17
If you don't have Coreboot then you have a master password. What's the manufacturor of that motherboard?
Since the lock can be opened with a key, you can open it with an identical key. You can make an identical key with a credit card and a knife.
There are lockpicking hobbyists who do it just for fun of it and not for criminal intent. I remember reading an article (I thought it was on /. but I'm not sure) that there was only one lock in the world that these guys could not open. You could buy it somehere in Denmark or Sweden if I am not mistaking. In any case it was in some European country.
Here be signatures
Call me when it gets OVER 9000 Mhz
From an interview with authors:
http://www.securityfocus.com/columnists/442/2
"How can an attacker deploy it?
Nitin & Vipin: An attacker doesn't need to install, that's the way it has been designed. Just boot the system by placing the vbootkit media (containing vbootkit in bootsectors) in the drive, and start booting. After Vista boots, you can verify that you are running vbootkit, by checking the privilege of any running cmd.exe, the sample converts all low-privileged cmd.exe process to SYSTEM privileges. It also supports system compromise via PXE booting.
It doesn't need any privileges only physical access to the machine. It can also be installed to a remote system under some conditions (without physical access)."
I like to use a mouse.
They're mostly Dells bought in large quantities, and the master passwords either do not exist, or are not universal to a model/motherboard.
They can be obtained (if they exist) only by calling Dell with a service tag, and possibly reading off a stamp on the BIOS chip. Oh, you'll have to prove you're the owner of the machine as well.
There are various other machines as well - some you would have to open the case to find out the motherboard, and some are Macs.
You can't make an identical key without seeing the original, can you? If you have the original, you have no need to make a copy. Credit cards are the wrong thickness anyway. We're not talking about shitty bike-lock style "keys".
Yeah, because they've opened EVERY OTHER LOCK in the world? I have no doubt the locks are easy to pick. I have no doubt that anyone trying to do so would be caught, as they are visually monitored, and would be seen crawling under desks and getting in the way of other people using the labs.
I have no doubt that the magic lock you speak of can be picked as well.
The building is locked and alarmed at night. The police arrive quickly, with guns drawn. Each machine bought has it's serial numbers recorded and the machines are physically engraved with the serial number and name of the labs, as soon as they are received.
Yes, you could get around all of those things.
No, no one has ever deemed it worth the risk.
Fuck that, even the most experienced programmers will give you the keys to their system if you fucking ask nicely.
Helps if you delegate the task to one of your lady assistants though.
Sometimes they just start spewing binary.
If you can read this, I forgot to post anonymously.
I haven't had to look into how to do so in Vista yet.
by mjm1231 (751545) Alter Relationship on Thursday April 23, @03:28PM (#27692705) I know that replacing the SAM file under %windir%\system32\config with a SAM that has no password assigned is a way to blow by the password security in Windows NT variants. SysInternals NT locksmith (or their graphical bootup recovery disk) pretty much do the same thing but make it simpler in that you don't need a bootable Linux or DOS Operating System to do it from (which also means they would need an ntfs filesystem read/write capable driver also in order to do so). Hope I am correct on this, as it has been years since I read of and tried some of these things.
See subject line & this url http://it.slashdot.org/comments.pl?sid=1198841&cid=27622135 because as you can see at that url? He is just a noob that operates only on the surface of things, but has little to no understanding of what is really going on in Windows (or any other Operating System).
I have no experience with Win7.
Love many, trust a few, do harm to none.