Slashdot Mirror
The Windows Flaw That Cracks Amazon Web Services
Nerval's Lobster writes "Developer and editor Jeff Cogswell decided to poke around the security of Amazon Web Services, and found a potential loophole that could theoretically allow anyone — a developer, an unscrupulous Amazon employee, the NSA — to access and copy data volumes stored on the system, using a slightly modified version of the popular 'chntwp' password tool. In this article, he breaks down how he did it, and suggests some ways for those who use cloud-hosting services to keep their data a little more secure in the future. 'The key here, of course, is that an unscrupulous employee might be able to make a copy of any existing Windows volume, and go to work on it without the customer ever knowing that it happened,' he writes. 'Now let's be clear: I'm not accusing anyone of having done this; in fact, I doubt anybody has, considering I was unable to find a working copy of chntpw until I modified it.' It's a security concern, and one that's particularly insidious to patch."
You had me at Windows
The cloud just gets more and more secure all the time. Maybe this is how Dilbert broke into the NSA servers and got all his company's data back.
No, really, if you ignore all the practical problems with hosting data by letting someone else do it, those practical problems disappear. It's magic!
Don't use them, problem solved. Better even, don't use windows at all, more problems solved.
People with access to your data are able to access your data.
If you mount your Windows harddrive in Linux without using Encryption you can access all your Data?
Not news at all. You can do this on any operating system of any type assuming your not using an encrypted system.
This is no different than booting a LiveCD and changing the Windows password from a Linux LiveCD running with access to the same storage device. This is not a flaw in AWS in any fashion, other than illustrating the trust you place in AWS having access to your physical devices. Why is this news? This is a standard if-you-have-access-to-hardware-you-can-have-complete-control-over-everything-on-it-not-encrypted problem.
The janitor at your company comes late night to clean. Using some bootcd copies the volume and takes it home and does the same thing. I am sure offline volume cracking can be done for all oses even linux and os x
Oh look, it's yet another case of "If you have physical access to the server, all bets are off.". If you can clone the volume, you effectively have physical access to the server. This isn't a new vulnerability. Just another case of "It's on the webz, it must a a completely novel thing!".
'Now let's be clear: I'm not accusing anyone of having done this; in fact, I doubt anybody has, considering I was unable to find a working copy of chntpw until I modified it.'
Cause he's the only one who can edit code or what?
Oh, wait... Is that what he means when he says he's an editor?
1. Take a Windows server on Amazon Web Services, make a copy of the hard drive (which Amazon calls a volume),
If you can do this, the system is already compromised in a dozen different, less-interesting, ways.
The question is whether you can do this without already having the passwords, with EC2's existing security. I see no evidence from the article he can.
Without that, the claim is half gratuitous cleverness, half FUD of an attention-grabbing vendor name, to my eyes.
~ Whence do you come, slayer of men, or where are you going, conqueror of space?
Going to need a copy of the VM's memory and some skill at finding the crypto keys in there in addition to the volume if you use TrueCrypt.
I use AWS and I truecrypt my source code database that I store there.
I lose automatic full reboot (I have to log in and manually mount that volume), but that's worth the additional privacy/security.
Seriously? If you have the drive or an image thereof of ANY computer/computing device out there, consider your data compromised. Most things don't encrypt by default (thankfully, as it makes disaster recovery near impossible), and those that do have a stupidly weak 4 digit PIN number and not a password.
How is that in any way specific to Windows? I'd say Windows actually makes it a lot more painful (but not more difficult) whereas against Linux it's just straightfoward. As other mentioned, having raw access to a volume is just the same as physical access. The evil Amazon employee has just as much power over your systems as the tech at your local datacenter.
Cloud is bad.
Don't do cloud.
This can all be done simply without Linux using Windows and without chntpw. Simply add the drive to a system you own, move Magnify.exe out of the way (for later restoration), and copy command.exe to Magnify.exe then boot of the modified drive and choose to use the "Accessibility Tool". Instant command shell with full priveledge escalation. I have personally done this on Windows Server 2008. I do not know if they finally got smart and added code to prevent this in Server 2012, but I wouldn't be surprised if it works on every version of Windows that has the "Accessibility Options" on the login screen.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
don't put your stuff on AWS.
```Now let's be clear: I'm not accusing anyone of having done this; in fact, I doubt anybody has, considering I was unable to find a working copy of chntpw until I modified it```
Because you're the only person that could possesses the skill to modify a program....
Unencrypted volumes can be easily modified when mounted on a different system; film at 11.
Good job, Jeff! Welcome to the exciting world of security research!
I applaud you for (re)discovering these techniques on your own. Your out-of-box thinking and problem solving are to be commended, but your research skills could use some polish. Please don't let the negative comments above discourage you from exploring this rewarding field of knowledge, however I would recommend you run your findings by some existing security folks before announcing your next big discovery, lest you find you're just rehashing something else that has long been known.
Seriously; good job! I enjoyed reading how you worked your way up to your conclusions, even though I knew from the start how it would end...
NSA: There's no such things as *flaws*. We, the NSA, and btw, any other illegal (lawful) organizations consider all security-flaws as features.
In short, this guy just figured out that VM image files can be modified directly. He also just figured out that you can modify VM images too and do nasty things to them. My question is, why is something so fucking basic a /. story. This is no different than pulling out the hard drive of a machine, changing the admin password in another server and booting back up. You could do this with Windows, Linux, FreeBSD etc, but this is certainly not new, or news for that matter.
For years via Swiss-cheese Java/Dalvik front ends & infected faster than Win9x was in the same timeframe. So much for Linux security. Wait until you find out what I already know: SeLinux is NOT your friend (courtesy of the NSA).
Newsflash: If you run servers in Amazon's cloud, you have to trust Amazon.
There's no flaw in AWS that enables this hack by untrusted parties. You have to have access to the AWS account in order to clone a volume, just like you'd have to have physical access to a physical server to clone a volume.
The only interesting point here is that an Amazon employee could do this without you knowing it. But come on, how obvious is that? Their sysadmins could do a lot more than just clone your hard drive and change the password, you know.
Thanks for updating chntwp, though.
Attacker with full access to an unencrypted system volume has full access to the data stored on it.
Too true. Sadly, most people - even on /. these days, it seems - don't know a damn thing about OS security. If the idiot of an article author had pulled a Linux volume and gone fucking about in /etc/shadow to do exactly the same thing, though, then it wouldn't have appealed to the general /. groupthink nearly so well...
There's no place I could be, since I've found Serenity...
The commentary on resetting passwords in windows is useful/interesting, but this article really doesn't have any special relevance the cloud. Whether or not the storage is a local physical volume or "floating around on dem internets" doesn't make a difference.
Evolution: love it or leave it
That you can "own" the system when you have complete access to overwrite te storage volume and program code ?? No fucking shit.
Replacing the SAM with one that has a BLANK (or predefined) password does the job too... it's how SysInternals' "ERD Commander" works in fact.
This is NOT "genius level" stuff @ all, easy in fact... here's how:
In other words - once you have the harddrive in question, you mount it on another booting NT based OS of the same build as a secondary harddisk if needed, on another system (putting the hdd into another IDE/EIDE/SATA type slot), & even minus SysInternals tools, reassign yourself as an NTFS FULL Admin rights level user to the disk you want to get to, & boom - you can replace the ORIGINAL password bearing SAM as noted above with 1 of your own (blank pwd), & in you go, once you make THAT disk you wanted "in" to, the bootable one (& if diff. hardware were on the original system it was in, no biggie - "Plug-N-Play" will make up for it)!
APK
P.S.=> Of course, you CAN do the Linux route if you wish, but it's more work imo... apk
Wow, you mean if someone can get a copy of your unencrypted hard drive they can get your data? And this even includes _system administrators_ (who can get your data anyway)?
What in the world is this person going on about, and why is this posted as an article? It's infantile.
The author should remove the article ASAP, for its own benefit.
You see the world through your cynical eyes
You're a troubled young man I can tell
You've got it all in the palm of your hand
But your hand's wet with sweat and your head needs a rest
And he's fooling himself if he doesn't believe it
He's kidding himself if he doesn't believe it
How can you be such an angry young man
When your future looks quite bright to me
How can there be such a sinister plan
That could hide such a lamb, such a caring young man
He's fooling himself if he doesn't believe it
He's kidding himself if he doesn't believe it
Get up, get back on your feet
You're the one they can't beat and you know it
Come on, let's see what you've got
Just take your best shot and don't blow it
Fooling Yourself - Styx
There is no a vulnerability nor is it a flaw in Windows, nor is this in any way news to anyone.
If you want your volumes encrypted.... do so, otherwise of course who ever has physical ( or in this case virtual) access to them can get at them.
What kind of BS is this?
slashdot go home, You are drunk
s/$TFS/Jeff Cogswell doesn't know shit.
s/$TFA/Jeff Cogswell is a fucking clueless moron./
I've seen the 100's of news articles involving ANDROID exploited, 1 way or another, faster than Windows 9x was in the same timeframe. Wait till you find out how "NSA Secure" SeLinux really is too (soon enough).
I expected better on stack overflow. This is incorrect and misleading, and is in no part a valid security concern.
They actually use Windows on a production server connected to the internet? Then they got what they deserved.
Any why does it specifically call out AWS? There would be the same vulnerability with any hosting service where someone other than you has access to the hardware. Rule #1 of system security has been all bets are off if someone has physical access to the system for quite a while.