Slashdot Mirror
Microsoft Researchers Reveal Remote Encryption-Bypassing 'Evil Butler' Exploit (softpedia.com)
A security researcher demonstrated a way to bypass the full disk encryption in Windows BitLocker last November -- but that attack required physical access. Inserting the PC into a network with a counterfeit domain controller with incorrect time settings "allowed the attacker to poison the credentials cache and set a new password on the targeted device."
An anonymous Slashdot reader writes:
Microsoft fixed this vulnerability, and then fixed it again when two researchers pointed out in February 2016 that the fix was incomplete. At this year's Black Hat security conference, two Microsoft researchers have discovered a way to carry out the Evil Maid attack from a remote location, even over the Internet.
The two researchers say that an attacker can compromise a PC, configure it to work as a rogue domain controller, and then use Remote Desktop Protocol to access computers (that have open RDP connections) on the same network and carry out the attack from a distance. This particular attack, nicknamed a Remote Evil Butler, can be extremely attractive and valuable for cyber-espionage groups.
The article points out that Microsoft's February fix prevents this exploit, adding "The reason the two Microsoft researchers disclosed this variation of the original attack is to make companies understand the need to keep their systems up to date at all times."
The two researchers say that an attacker can compromise a PC, configure it to work as a rogue domain controller, and then use Remote Desktop Protocol to access computers (that have open RDP connections) on the same network and carry out the attack from a distance. This particular attack, nicknamed a Remote Evil Butler, can be extremely attractive and valuable for cyber-espionage groups.
The article points out that Microsoft's February fix prevents this exploit, adding "The reason the two Microsoft researchers disclosed this variation of the original attack is to make companies understand the need to keep their systems up to date at all times."
to use dm-crypt. winsuckers.
Slashdot is FBI, everything on this site is FBI agenda.
Microsoft is US Government.
You have an OS that puts you on the Internet with all of your private data? That is your butler serving you Internets.
Spy? yes literally 100%
There are so many settings that I turn off on a new Windows installation. I really don't see why every back or front door has to be left open on a fresh install, upgrade, or update.
I read the article and the researcher's PDF and neither really points out which "February Fix" MS released that addresses this particular bug. Anyone know which one, specifically?
I have all Windows Updates turned off normally, so they can't pull a drive-by WinX install on me, but I would sideload this one KB if it was really worthwhile.
-- You are in a maze of little, twisty passages, all different... --
Windows is a hack that will take years to fix. All that simple linking functionality with every api with no regard to *who* is doing what to *whom*s data.
If it were not for the marketing assholes, I think many users would not even know that windows is a completely fucked up system.
...making the prospect of regularly upgrading a complete nightmare. Particularly for home users who don't have IT on hand to fix things when their machine won't boot.
Thank god for advertising abuse.
My grandmother now bitches. Lol
I'd like to see their outfits on Halloween, and see which one's the Maid (or butler).
Microsoft is adding new holes faster than it can (correctly close them, so the only waht to reasonably secure a Windows computer is to not connect a network cable. At that point the internet, cloud, software as a service, email, skype, etc. doesn't work anymore, so they may as well just give up. Just send me OS updates on CD-rom, and try to prevent all forms of autorun for USB drives this time, please..
If your bitlocker drive is unlocked, wouldn't anything be able to read the drive anyway?
If it can still read your bitlocker drive when you haven't unlocked it yet then can it still read pre-win8 bitlocker drives before microsoft dumbed it down? https://encrypted.google.com/s...