Slashdot Mirror
Researchers Show How To Take Control of Windows 7
alphadogg writes "Security researchers demonstrated how to take control of a computer running Microsoft's upcoming Windows 7 operating system at the Hack In The Box Security Conference (HITB) in Dubai on Thursday. Researchers Vipin Kumar and Nitin Kumar used proof-of-concept code they developed, called VBootkit 2.0, to take control of a Windows 7 virtual machine while it was booting up. 'There's no fix for this. It cannot be fixed. It's a design problem,' Vipin Kumar said, explaining the software exploits the Windows 7 assumption that the boot process is safe from attack. While VBootkit 2.0 shows how an attacker can take control of a Windows 7 computer, it's not necessarily a serious threat. For the attack to work, an attacker must have physical access to the victim's computer. The attack can not be done remotely." Which makes me wonder why I'm posting this :)
We hear about it all the time, laptops being stolen, left out, all with tons of sensitive data. Combine this with a lot of companies having very poor physical security this could be more than something to just write off.
The musings of just another geek and his junk.
If you got physical access already, it shouldn't be a surprise you can root the box.
If someone has physical control of the machine, all bets are off.
Rule 1 of computers is, if someone has physical access to your machine, it has already been compromised. I always design my security around this fact, and if a machine needs to be secure against attack, it will be physically secure.
It's been a long time.
You need full, physical control of a computer running Windows 7 in order to get software access to it?
This is barely a hack. I can steal any car in the world. Give me the keys, some gas, and park it in my drive way. Watch me steal it with ease! HA!
If you boot from a Live CD, since you have physical access to the machine, isn't it essentially the same thing? I'm confused about how this is a vulnerability.
-- NeilO
There's a rather important aspect of this that's not discussed - how does this code get onto the computer in the first place to be executed during boot ?
This is contrasted with Mac OSX which uses a combination of Gracie-style Brazilian Jiu Jitsu, Hapkido, and oratorical prowess to keep would-be haxors at bay while the police are enroute. Or the Linux lack of social skills which avoids "physical access" altogether.
THL phish sticks
OK, I'm not a Mac guy so I can say nothing about it. I've also not used Windows 7.
But, really. If you give me physical access to damned near any Windows or Linux machine, it's owned. And there are a lot of people out there a helluva lot better then me.
Sure, I won't be able to crack your encrypted archives. Nor your well-protected stored passwords. But hacking root/admin with physical access to the box isn't rocket science. Actually, it's much tougher with Vista than any Linux distro I've run into.
He's getting rather old, but he's a good mouse.
Im as anti-microsoft as the rest of you (at least the intelligent folk), but are you all seriously claiming that linux or unix distros are immune to tampering with the boot partition?
I would assume the only way to be immune against this type of attack would be encrypting the system partition, and a "bootkit" as they seem to be calling it that is aware of encryption may even be able to deal with that.
Whats the story here again? That booting into a secondary OS gives you full control of data on an unencrypted hard drive?
Also restarts kill it. This is Windows we're talking about here...
I was going to say... if you have physical access, you can take out the hard drive, put it in another box, muck around with the data in any way you want and put it back. I'm an Apple fanboi at heart, but, geeze, this seems like a big, honkin' "What-ever!" to me.
The CB App. What's your 20?
The attack involves patching particular Windows system files in RAM during the boot process, which explains why physical access is required, and why it doesn't work after a reboot. The attacker loads an app from a CD-ROM which then itself executes the normal Windows boot process while agressively patching software in memory. This also isn't a windows-specific vulnerability: any OS which does not checksum memory contents each time they're read is vulnerable.
No kidding!!! What do you say at this point?
'There's no fix for this. It cannot be fixed. It's a design problem,
There is always a fix. Every vulnerability is a "design problem". Sometimes the code to fix it is a separate app (e.g. firewall, virus protection), and sometimes it requires modification to the code. There is always a fix in software - it's just a matter of making it.
This guy stating there is no fix, it can't be fixed is making statements about as dumb as those who say their favorite OS (e.g. OS X) is immune from any virus/worms/hacks.
I do not support "The Man". I also do not support your irrational stupidity
At first glance at the thread title, my first thought was pop a Linux CD into the drive and reboot
Voila no more Win7
"Suppose you were an idiot...and suppose you were a member of Congress...but I repeat myself." Mark Twain
"The attack involves patching particular Windows system files in RAM during the boot process, which explains why physical access is required, and why it doesn't work after a reboot"
'The latest version of VBootkit includes the ability to remotely control the victim's computer. In addition, the software allows an attacker to increase their user privileges to system level, the highest possible level. The software can also able remove a user's password, giving an attacker access to all of their files. Afterwards, VBootkit 2.0 restores the original password, ensuring that the attack will go undetected'
I thought BitLocker was supposed to defend against such exploits if the boot sequence was altered?
davecb5620@gmail.com
This also isn't a windows-specific vulnerability: any OS which does not checksum memory contents each time they're read is vulnerable.
Even that wouldn't matter, because the first thing I'd in-memory patch is the checksum algorithm to always return 'ok'.
The only real way to resolve this would be a-la console style 'trusted computing, and digital signatures through the whole bios and bootstrap process'. Of course, even this could be 'hacked' or 'modchipped' but at least it wouldn't be as simple as just putting in a disk.
There is no security if they have enough physical access.
Hi. I see you are making fun of a "security vulnerability". This vulnerability involves being physically present at a PC and being able to boot it. This is a security vulnerability in the same way that my house is insecure to folks who I invite over for dinner.
You obviously have no clue, and I would recommend not posting in security vulnerabilities discussions any more.
kthxbai.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
Because you are a Microsoft hating troll
There is no "-1 offended" or "-1 you don't agree with me" mod options for a reason.
... the reason you are posting this article is to spread anti-microsoft hate and FUD for no reason.
Why not post:
With a gentoo install CD you can gain control of any linux system by overwriting key /etc/ files to give yourself root access unless you use encrypted drives...
More useless propaganda from an MS-hater. I mean seriously, this is news? Next thing you'll post is the Windows 7 has a horrible exploit that crashes it every time you shoot the PC with a shot gun.
Don't we have a NO FUD policy for articles?
"Everyone is entitled to be stupid, but some abuse the privilege", as a result of this abuse, your Stupid License has been suspended for 60 days.
-=[ Who Is John Galt? ]=-
In the absence of physical security, taking over a vista, linux, mac os x or (insert vendor here) UNIX system is not difficult, providing you know the platform. No, the 'average gramma' can't do it, but most of us most likely can - with not much more than a google search and a quick download.
I'm not a microsoft (or apple, or linux) fanboi by any means, but a system is only as secure as you actually make it. Disk encryption helps - it's a great idea - so I've honestly never met anyone who's used it.
While this is certainly an interesting exploit, I doubt highly that many systems will be compromised in the wild with it.
http://www.bistolas.net
The standard method of securing the data on your machine, which is what's important, is to encrypt it. So even if someone rips open the box, takes out the disk and puts it in another machine, the data should be safe, assuming the encryption algorithm and the user authentication processes are secure.
However, if this exploit allows them access to the operating system on the disk, and allows them to subvert the user authentication process to grant themselves access to a user's account, then the data is compromised.
So this exploit may have an application, not as an attack vector for writing a propagating worm or virus, but as a means to gain access to otherwise secure data.
"The dew has clearly fallen with a particularly sickening thud this morning"
much tougher with Vista than any Linux distro I've run into.
And us linux users consider that a feature.
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
Everyone talking about this being irrelevant is missing the point. This attack does not make users significantly more vulnerable. Instead, it makes Windows more vulnerable to users.
Hacking your own machine sounds laughable. But as long as vendors restrict usage, we need to keep reminding them that DRM is a fool's quest.
Yes - My first system breach (not counting MS systems that were completely unsecured - I mean actually circumventing security) in the wild was back in the early 90's - A university *nix system. The thing that made (makes) *nix such an easy target is that you can actually understand how it works. Windows is full of holes, but it's so frigging weird and hard to wrap your head around the bizarre OS that the casual cracker won't bother learning what's going on. If your only goal is to satisfy some childish desire to breach security and smugly toss your hands in the air and declare yourself an 31337 hacker (as was my case), Linux is the way to go.
Agreed - Being able to understand your OS is indeed a feature for people living in Linux world.
He's getting rather old, but he's a good mouse.
bios passwords are a joke. on my hp pavillion, if i slide open the side cover and shake up the cell on the mobo, it forgets all bios settings and the password too.
Wealth is the gift that keeps on giving.
If someone has physical control of the machine, all bets are off.
Ah, apparently you've never heard of Phil Zimmerman or have ever seen a James Bond movie, have you?
Point here is there is quite a bit that has and can be done even at the physical layer. Drive Encryption (PGP) is but one option, and given the track record of PGP, I'd say a pretty damn good one. TrueCrypt is a great free alternative too.
And I for one am glad this was posted. Just helps enlighten everyone on the importance of good security practice regardless of how shiny and new the OS is.
There are no foolproof Operating Systems out there, just fools who think there are.
How is it any different to shoving in a Linux Live CD, running BartPE or running Windows setup, doing a repair install and sticking your own account on?
I only please one person per day. Today is not your day. Tomorrow isn't looking good either. - Scott Adams
Whereas with Linux you just boot into single user mode & use passwd to set the root password.
Not a sentence!
I'll correct you a bit further -- there are different kinds of physical access. For instance, a public computer lab might have machines which have their case locked, both to prevent it from being opened and to prevent it from being locked down, BIOS locked and configured to boot only from hard disk, bootloader locked, etc.
On such a machine, there's really not a lot you can do to compromise it without some sort of actual software vulnerability or misconfiguration. You might be able to add a physical keylogger -- maybe -- depends how kiosk-ified it is.
However, this does not appear to be such an attack. Rather, it seems this is an attack which requires you to boot the machine off of some other media. Most machines are wide open to this in many ways -- the more frightening one was PXE; just plug a laptop into the same network and own every machine as it boots.
But Vista is not unique in this respect, and I cannot imagine how an OS could protect itself against such an attack. And even network boots can be secured, if you can add just a kernel and initrd to local storage.
Don't thank God, thank a doctor!
Unless, of course, the admin has set the box up to require a password for single user mode as well.
My case came with one of those case locks. The manufacturer forgot to ship the key. Turned out the key to my luggage is about the same size and I was able to get into it in a few minutes. While there are probably more secure solutions than the one on my PC, picking a lock isn't much of a roadblock.
try leaving a bootable cd in a bitlockered system. vista wont boot with it in the drive. bitlocker is pretty tough
This is a very old news. A similar article was posted about a year ago. New guy - same shit. The attacker needs a physical access to the PC, which is absolute no-fair. Why the fukc you need to fuss around, when you just can take the whole thing home?
The same can be said about any OS -- if you allowed to mess with its files, you can make a rootkit. How dumb one have to be to make a story out of this nonsense?
OMG, "There is no fix for this, it is a design problem". You damn right, it is a design problem. IN YOUR HEAD.
From an interview with authors:
http://www.securityfocus.com/columnists/442/2
"How can an attacker deploy it?
Nitin & Vipin: An attacker doesn't need to install, that's the way it has been designed. Just boot the system by placing the vbootkit media (containing vbootkit in bootsectors) in the drive, and start booting. After Vista boots, you can verify that you are running vbootkit, by checking the privilege of any running cmd.exe, the sample converts all low-privileged cmd.exe process to SYSTEM privileges. It also supports system compromise via PXE booting.
It doesn't need any privileges only physical access to the machine. It can also be installed to a remote system under some conditions (without physical access)."