Slashdot Mirror
Code Published for Triggering a BSOD on Windows Computers -- Even If They're Locked (bleepingcomputer.com)
"A Romanian hardware expert has published proof-of-concept code on GitHub that will crash most Windows computers within seconds, even if the computer is in a locked state," writes BleepingComputer. An anonymous reader quotes their report:
The code exploits a vulnerability in Microsoft's handling of NTFS filesystem images and was discovered by Marius Tivadar, a security researcher with Bitdefender. The expert's proof-of-concept code contains a malformed NTFS image that users can take and place on a USB thumb drive. Inserting this USB thumb drive in a Windows computer crashes the system within seconds, resulting in a Blue Screen of Death (BSOD). "Auto-play is activated by default," Tivadar wrote in a PDF document detailing the bug and its impact...
Tivadar contacted Microsoft about the issue in July 2017, but published the PoC code today after the OS maker declined to classify the issue as a security bug. Microsoft downgraded the bug's severity because exploiting it requires either physical access or social engineering (tricking the user).
Tivadar contacted Microsoft about the issue in July 2017, but published the PoC code today after the OS maker declined to classify the issue as a security bug. Microsoft downgraded the bug's severity because exploiting it requires either physical access or social engineering (tricking the user).
Actually, no, Autoplay doesn't have to be enabled, what the researcher meant is that the OS auto-mounts the image anyway, guaranteeing the crash.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
I've found another similar exploit.
If you pull on the flexible plastic tube that link the computer to the wall, the computer will abruptly shutdown without warning. Sometimes, you may even *corrupt* the file system, if you time it right! And Microsoft refuses to acknowledge this as a severe vulnerability! Crazy!
That's strange. My computer always asks me what I want to do when I put a USB drive in, and I never changed the default.
Doesn't work, at least on a (since Jan 2018) unpatched Win7 Home Premium system. "The file or directory is corrupt and unreadable" when trying to access the drive even. Maybe I have to patch it?
It is pitch black. You are likely to be eaten by a grue.
Pff what a joke. Where I worked if you inserted a flash drive into your computer they sent in Droidekas to exterminate everyone in the room.
sudo rm -r -f --no-preserve-root /
Windows XP also doesn't know or understand what an NTFS filesystem is anyway
NTFS is XP's default filesystem.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
That's because we have real security in place and we can easily handle trivial things like the use of flash drives. Your network administrator and IT department need to be fired and replaced with people who know what they are doing.
Where the parent works and where you work probably have drastically different security, privacy and regulatory requirements.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
Microsoft downgraded the bug's severity because exploiting it requires either physical access or social engineering (tricking the user).
So physical access and social engineering aren't problems now?
Theft and idiocy are not things that can be fixed with software updates.
"Your network administrator and IT department need to be fired and replaced with people who know what they are doing."
You go into any casino talking that nonsense and the Gaming Commission of almost every state, if not the Feds, would utterly rape you in court and then bar you from ever working in that field ever again.
There are places where full physical security of the device is an absolute requirement, right down to every port being behind a physically-locked plate and literally every cable tied down and locked.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Offtopic but racism damages society so the comment needs a response. Trump is not racist because he frowns at black people. Trump is racist because he encourages racism in his voting base. "Mexicans are rapists and drug dealers" "there are faults on both sides" "Ban on all Muslims until we figure out what is going on" etc.
His administration goes all out to increase conflict just like a tooth and claw business does in the capitalist economy. Politics is not like business in the capitalist economy because crushing your enemy does not just inconvenience another bunch of shareholders - it kills people in genocides. Whatever good Trump does is undone by this pointless increase in fear and hatred.
Re the NTFS vulnerability, does anyone know if and when Microsoft can provide a bug fix for it?
Facts are history now plebs have politics for religion on social media.