Code Published for Triggering a BSOD on Windows Computers -- Even If They're Locked (bleepingcomputer.com)
"A Romanian hardware expert has published proof-of-concept code on GitHub that will crash most Windows computers within seconds, even if the computer is in a locked state," writes BleepingComputer. An anonymous reader quotes their report:
The code exploits a vulnerability in Microsoft's handling of NTFS filesystem images and was discovered by Marius Tivadar, a security researcher with Bitdefender. The expert's proof-of-concept code contains a malformed NTFS image that users can take and place on a USB thumb drive. Inserting this USB thumb drive in a Windows computer crashes the system within seconds, resulting in a Blue Screen of Death (BSOD). "Auto-play is activated by default," Tivadar wrote in a PDF document detailing the bug and its impact...
Tivadar contacted Microsoft about the issue in July 2017, but published the PoC code today after the OS maker declined to classify the issue as a security bug. Microsoft downgraded the bug's severity because exploiting it requires either physical access or social engineering (tricking the user).
Tivadar contacted Microsoft about the issue in July 2017, but published the PoC code today after the OS maker declined to classify the issue as a security bug. Microsoft downgraded the bug's severity because exploiting it requires either physical access or social engineering (tricking the user).
Wake me up when someone publishes something that's guaranteed not to crash Windows...
Actually, no, Autoplay doesn't have to be enabled, what the researcher meant is that the OS auto-mounts the image anyway, guaranteeing the crash.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
USB is problematic anyway. Where I worked if you inserted a flash drive into a computer it would lock you out and send an alert to security. Good way to get fired.
I've found another similar exploit.
If you pull on the flexible plastic tube that link the computer to the wall, the computer will abruptly shutdown without warning. Sometimes, you may even *corrupt* the file system, if you time it right! And Microsoft refuses to acknowledge this as a severe vulnerability! Crazy!
That's strange. My computer always asks me what I want to do when I put a USB drive in, and I never changed the default.
Doesn't work, at least on a (since Jan 2018) unpatched Win7 Home Premium system. "The file or directory is corrupt and unreadable" when trying to access the drive even. Maybe I have to patch it?
It is pitch black. You are likely to be eaten by a grue.
even if the computer is in a locked state
I feel this bug won't be fixed by M$ because this is a very important feature for authorities. This is an intentional feature so TLA can just stick-in their USB toolkit and unlock any machines at will at checkpoints and airports.
Sorry, this is a secret feature and NOT A BUG.
Windows XP also doesn't know or understand what an NTFS filesystem is anyway
NTFS is XP's default filesystem.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
Well it is a way quick to turn off a Windows PC
Well makes for a great system lock
Well at least the screen looks scary, with that on the PC at Starbucks, no one will steal the laptop
I will be here all week, tip the waitresses
Date: September 28, 1999.
Weldon statement.
The full article.
Linux
Not by default. At least my Debian system won't. I get an icon and then I've got to mount it manually. If I lock my screen/keyboard, plugging in a USB drive does nothing.
Have gnu, will travel.
What is the point ? If I have physical access to the machine I can induce the equivalent of a BSOD by unplugging the fsck'n thing. Why bother with a USB stick to make it crash ? Seems like an exercise in stupidity. I've discovered that I can crash your computer even if locked if I can get physical access to it by picking it up off the shelf and throwing it to the floor. Rinse, repeat....
errr....umm...*whooosh* *whoosh* Is this thing on ?
So physical access and social engineering aren't problems now?
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
I run Fedora and Xfce and what happens is configurable. I think that automount is the default, but it's only a few mouse clicks to change it.
Good, inexpensive web hosting
Still Autoplay is one of the worst features ever from a security perspective.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Offtopic but racism damages society so the comment needs a response. Trump is not racist because he frowns at black people. Trump is racist because he encourages racism in his voting base. "Mexicans are rapists and drug dealers" "there are faults on both sides" "Ban on all Muslims until we figure out what is going on" etc.
His administration goes all out to increase conflict just like a tooth and claw business does in the capitalist economy. Politics is not like business in the capitalist economy because crushing your enemy does not just inconvenience another bunch of shareholders - it kills people in genocides. Whatever good Trump does is undone by this pointless increase in fear and hatred.
Re the NTFS vulnerability, does anyone know if and when Microsoft can provide a bug fix for it?
Facts are history now plebs have politics for religion on social media.
Still this isn't auto play, and every modern desktop OS mounts the image when plugged in. Happens on Macs, happens on Linux too.
I'm fully aware of that this was automount, but Autoplay is even worse.
It's also one thing to crash a computer another to inject malware. If it had been possible to inject malware through the automount then it would be really bad.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Some peoples children. My thoughts when I read it was "Windows XP was the first consumer OS from microsoft to have NTFS" And maybe even the first period? i was kind of young when it came out.
Actually, I run Debian, and have ran variants for years. They do not automount, they read the disk structure, and you have to actually click mount to mount the drive. And from command line you have to also be root.
I said modern desktop OS :-P
Mind you the entire topic really is quite moot. If someone can get to a position where they can insert the USB stick to crash your system they could just as well simply turn off the power and move on with their lives :)
Incidentally Debian used to offer auto-mounting via udev but systemd broke that functionality ...
Do you not consider it modern because its stable? Modern hardware(R7-1700 + GTX1070 + NVME Drive) handles anything i can think of throwing at it. I know its popular to rip on Systemd, I personally have never had an issue with it. Sure I don't like the way it logs. Pain in the ass IMO. Other than that its pretty stable. And if you don't like it, you can spend the time to remove it and use whatever you wish. Power of Linux!
But seriously I don't think I have ever had a Linux OS that would mount a USB drive on its own if you inserted it, unless you previously set it up that way.
I remember how much I flamed Linux for not auto mounting removable media back in 90s. Now, almost all of them does.
Do you not consider it modern because its stable?
It was a joke. Lighten up a bit man, you'll work yourself up a stroke at this rate.
But seriously I don't think I have ever had a Linux OS that would mount a USB drive on its own if you inserted it
Shit Mandravia did it back before the USB days for CDs. It blew my mind to think Linux at the time was trying to be user friendly. Anyway I grew up since then.
Pretty much every desktop with Gnome does it too since it's a Gnome default to automount CDs and USB. You can control it via dconf: org.gnome.desktop.media-handling.
Then return it, it's defective hardware. Oh, you thought you were being funny? Shit man, you're hilarious! Can't wait for your comedy special.
Mint automounts USB drives, although Mint is very much a desktop/ease-of-use focused distro.
I never liked mandrake much and rarely used it. normally stuck with RHEL's and Debian based distros.
Pretty much every desktop with Gnome does it too since it's a Gnome default to automount CDs and USB
That makes sense why I haven't noticed it, I haven't used Gnome since the late 90's. Im a KDE Fan. And KDE would never mount anything I didn't explicitly tell it to. Gnome has been worthless since version 2. Gnome 3 IMO isn't even usable. Worse than windows 10.
The closest I have come to "Easy As Windows" Linux Distros is Ubuntu with KDE. I have never personally used mint past an install for a friend/family member. And that was just to get them started on something I heard was easy to learn on to keep the headache off of me lol. It worked rather well I guess as i rarely get the call of "How do I do this, I have already googled and cant figure it out" You know what they say. Set a man on fire, He will think you're Microsoft, Teach a man to Fire, And he will Compile on his own. well im paraphrasing. but you get my drift. I currently use Debian 9, with KDE. I would guess the main reason I dont rage at this behavior is because i have basically exclusively used KDE for so long, that I didn't notice some of the stupid crap other DE maintainers are doing on the linux platform. For anybody not wanting stupid crap like Auto Mounting on by default, I strongly suggest try KDE.