Slashdot Log In
Researchers Show How To Take Control of Windows 7
Posted by
CmdrTaco
on Thu Apr 23, 2009 11:18 AM
from the hey-wait-a-minute dept.
from the hey-wait-a-minute dept.
alphadogg writes "Security researchers demonstrated how to take control of a computer running Microsoft's upcoming Windows 7 operating system at the Hack In The Box Security Conference (HITB) in Dubai on Thursday. Researchers Vipin Kumar and Nitin Kumar used proof-of-concept code they developed, called VBootkit 2.0, to take control of a Windows 7 virtual machine while it was booting up. 'There's no fix for this. It cannot be fixed. It's a design problem,' Vipin Kumar said, explaining the software exploits the Windows 7 assumption that the boot process is safe from attack. While VBootkit 2.0 shows how an attacker can take control of a Windows 7 computer, it's not necessarily a serious threat. For the attack to work, an attacker must have physical access to the victim's computer. The attack can not be done remotely." Which makes me wonder why I'm posting this :)
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Physical Security is a big issue (Score:4, Insightful)
Re: (Score:3, Interesting)
Given your mention of encryption-cracking clusters, I would be remiss not to post this XKCD comic [xkcd.com] in response.
Re:Physical Security is a big issue (Score:4, Insightful)
Even if you're using Windows to encrypt your hard drive, this exploit might still be effective. From the very few details in the article, it modified the Windows boot files in memory while it's booting. If they can do that, then they just wait for you to log in and decrypt your hard drive, and their tainted processes have access to all your data.
Parent
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
From what I've read, it verifies that the BIOS and MBR are untouched, but I haven't read that it checks what is in RAM. This exploit modified what is in RAM only.
Physical access = root (Score:2, Insightful)
If you got physical access already, it shouldn't be a surprise you can root the box.
Re:Physical access = root (Score:4, Insightful)
Linux boxes are rootable. They *should* be rootable. The only time they aren't are when you don't have control any more (because of DRM & etc). But then they are only Linux in as much as the Kernel goes, not as much as the kind of Linux that Linux users advocate. I've recovered a broken plenty of times by popping in a boot cd and chrooting it.
The only time a system can be protected from this type of stuff is if it's encrypted. But then again, that's only protecting someone from accessing information you want to keep private, not protecting from reinstalling your operating system.
Parent
Re: (Score:3, Interesting)
The only time a system can be protected from this type of stuff is if it's encrypted. But then again, that's only protecting someone from accessing information you want to keep private, not protecting from reinstalling your operating system.
funny how this kind of thing comes up at an appropriate moment ubuntu 9.04 on a fresh install asks do you want to encrypt your home directory and it will be seamlessly decrypted when you use it.
I thought about this, then decided against it, the risk of losing everything due to having it in an encrypted home folder out weighs the risk of my data being readable by someone having physical access to the machine. on the other hand having everything easily readable also doesn't appeal either so I compromised and
Yes, why post this? (Score:5, Insightful)
If someone has physical control of the machine, all bets are off.
Re:Yes, why post this? (Score:5, Interesting)
In today's Virtual world, physical access to the machine doesn't mean meatspace access. My company and several of my friend's companies are looking into virtualized desktops by using small desktop boxes and low-end PCs to connect to PCs in the datacenter over either RDP or other proprietary protocols.
With the proliferation of cloud-based applications, it's only a matter of time before someone offers a browser-based virtual desktop in the cloud. Once someone hacks into some server up there, they have physical access to the machines for all intents and purposes.
This is a very interesting threat from a virtual infrastructure security standpoint.
Parent
Re: (Score:3, Insightful)
If you think accessing a machine through a browser is the same as having physical access "for all intents and purposes", then you aren't actually considering nearly enough intents and purposes.
You cannot disconnect a drive or even insert a USB key (during boot) with RDP. It's not the same at all.
Re: (Score:3, Informative)
You cannot disconnect a drive or even insert a USB key (during boot) with RDP. It's not the same at all.
You are thinking at the wrong level. You can't do that from inside the -guest-. But you CAN do it from the -host-. And you -can- potentially access the -host- remotely. After all, vmware server 2's administration for example is web based...
So if you hire some company to allocate you a VM and you run Windows 7 on it. And I can get remote control of the HOST, I now effectively have physical access to YOUR W
Re:Yes, why post this? (Score:5, Insightful)
Some disk encryption solutions, such as Checkpoint, rely on windows authentication to decrypt the disk. If this can be bypassed easily, it makes this disk encryption worthless.
It was obvious to crypto pros that it is theoretically worthless, but this is a practical attack against it.
Real disk encryption DOES protect them machine even with physical access. But "enterprise" software companies like Checkpoint sell snake-oil encryption quite well because engineers can "prove" it's flawed to management without a working exploit.
Parent
Re:Yes, why post this? (Score:5, Funny)
OK, they're claiming that if they have physical access, they can take control while it boots.
Sounds like they simply waited for it to finish booting. Ta-dah! They have control of it!
Parent
Not necessarily (Score:5, Interesting)
The standard method of securing the data on your machine, which is what's important, is to encrypt it. So even if someone rips open the box, takes out the disk and puts it in another machine, the data should be safe, assuming the encryption algorithm and the user authentication processes are secure.
However, if this exploit allows them access to the operating system on the disk, and allows them to subvert the user authentication process to grant themselves access to a user's account, then the data is compromised.
So this exploit may have an application, not as an attack vector for writing a propagating worm or virus, but as a means to gain access to otherwise secure data.
Parent
Agent Phil has something to say... (Score:3, Insightful)
If someone has physical control of the machine, all bets are off.
Ah, apparently you've never heard of Phil Zimmerman or have ever seen a James Bond movie, have you?
Point here is there is quite a bit that has and can be done even at the physical layer. Drive Encryption (PGP) is but one option, and given the track record of PGP, I'd say a pretty damn good one. TrueCrypt is a great free alternative too.
And I for one am glad this was posted. Just helps enlighten everyone on the importance of good security practice regardless of how shiny and new the OS is.
There are no foo
Who cares? (Score:5, Insightful)
Rule 1 of computers is, if someone has physical access to your machine, it has already been compromised. I always design my security around this fact, and if a machine needs to be secure against attack, it will be physically secure.
To recap... (Score:2, Funny)
A hack! (Score:5, Insightful)
This is barely a hack. I can steal any car in the world. Give me the keys, some gas, and park it in my drive way. Watch me steal it with ease! HA!
Boot from Live CD? (Score:5, Insightful)
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
If they did secure it, you can get the same end result WITHOUT HACKING it.
No, you can't.
The end result of this attack is a machine which is booted from the regular hard drive, in the user's usual account... but is *remotely* accessible.
So, in your typical office environment with fairly pathetic physical security, you could slip in at 5:00 a.m., boot someone's computer with this doohickey, then leave. When they get to work in the morning, they thing "Huh, thought I shut my machine down last night... oh well" and go on about their day. You capture every username and password they
Re:Boot from Live CD? (Score:4, Informative)
It's a 'vulnerability' in the sense that the idiots at Microsoft came up with this Trusted Computing notion that the computer is supposed to be secured against the owner'.
Trusted Computing, Digital Rights Management, the new Windows model for the operating system, it is considered a 'vulnerability' if the owner is able to take control of his own computer. Of course the Trusted Computing party line, and the way this article was written, is to to call this anti-owner system a "security" system and to spin any attack on it as evil, but as virtually everyone here has already commented, this issue is about 'attacking' and gaining control over a computer you already physically control. And in general what 'attacker' already has physical control of the computer? The owner. An owner-attacker who wants to control his own computer, and override DRM or Trusted Computing lockouts against the owner. The entire new Windows driver model is that the owner is forbidden to run unapproved drivers, because such drivers could be used to break DRM or gain control of other Trusted Windows systems. If/when Windows does permit you to run unapproved drivers, it dumps you down into an unTrusted unprivileged state. As I recall, Windows Vista even locks you out of the entire Aero mode Aero interface if you try to load an unapproved driver.
-
Parent
Critical information missing (Score:4, Insightful)
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
sheeeet, negro. that's all you had to say! (Score:5, Funny)
Re: (Score:3, Funny)
Are you kidding? All I need to hack your system is a razor blade and a roll of masking tape!
Attack requires editing RAM contents during boot (Score:5, Informative)
Re:Attack requires editing RAM contents during boo (Score:5, Interesting)
'The latest version of VBootkit includes the ability to remotely control [networkworld.com] the victim's computer. In addition, the software allows an attacker to increase their user privileges to system level, the highest possible level. The software can also able remove a user's password, giving an attacker access to all of their files. Afterwards, VBootkit 2.0 restores the original password, ensuring that the attack will go undetected'
I thought BitLocker [wikipedia.org] was supposed to defend against such exploits if the boot sequence was altered?
Parent
Re: (Score:3, Insightful)
This also isn't a windows-specific vulnerability: any OS which does not checksum memory contents each time they're read is vulnerable.
Even that wouldn't matter, because the first thing I'd in-memory patch is the checksum algorithm to always return 'ok'.
The only real way to resolve this would be a-la console style 'trusted computing, and digital signatures through the whole bios and bootstrap process'. Of course, even this could be 'hacked' or 'modchipped' but at least it wouldn't be as simple as just puttin
For a smart guy, dumb statement (Score:3, Insightful)
'There's no fix for this. It cannot be fixed. It's a design problem,
There is always a fix. Every vulnerability is a "design problem". Sometimes the code to fix it is a separate app (e.g. firewall, virus protection), and sometimes it requires modification to the code. There is always a fix in software - it's just a matter of making it.
This guy stating there is no fix, it can't be fixed is making statements about as dumb as those who say their favorite OS (e.g. OS X) is immune from any virus/worms/hacks.
Re: (Score:3, Insightful)
He is right there is no fix .... however the workarounds are pretty good ...
If you are booting, then load the boot software at a random location, like they do with other programs once the system is running, and this hack will be *much* more difficult
It's just that, as he says, Windows 7 assumes that during the boot process no user program can change things and it has complete control....
If you are running in a virtual machine you *never* have complete control and so this will always work on any OS, but you
Misleading title (Score:3, Insightful)
Voila no more Win7
Why you are posting this (Score:4, Informative)
Because you are a Microsoft hating troll
The reason (Score:5, Insightful)
... the reason you are posting this article is to spread anti-microsoft hate and FUD for no reason.
Why not post:
With a gentoo install CD you can gain control of any linux system by overwriting key /etc/ files to give yourself root access unless you use encrypted drives...
More useless propaganda from an MS-hater. I mean seriously, this is news? Next thing you'll post is the Windows 7 has a horrible exploit that crashes it every time you shoot the PC with a shot gun.
Don't we have a NO FUD policy for articles?
"Everyone is entitled to be stupid, but some abuse the privilege", as a result of this abuse, your Stupid License has been suspended for 60 days.
Missing the point folks... (Score:3, Interesting)
Everyone talking about this being irrelevant is missing the point. This attack does not make users significantly more vulnerable. Instead, it makes Windows more vulnerable to users.
Hacking your own machine sounds laughable. But as long as vendors restrict usage, we need to keep reminding them that DRM is a fool's quest.
Re:I cannot believe it... (Score:5, Insightful)
OK, I'm not a Mac guy so I can say nothing about it. I've also not used Windows 7.
But, really. If you give me physical access to damned near any Windows or Linux machine, it's owned. And there are a lot of people out there a helluva lot better then me.
Sure, I won't be able to crack your encrypted archives. Nor your well-protected stored passwords. But hacking root/admin with physical access to the box isn't rocket science. Actually, it's much tougher with Vista than any Linux distro I've run into.
Parent
Re:I cannot believe it... (Score:5, Insightful)
I'm not a microsoft (or apple, or linux) fanboi by any means, but a system is only as secure as you actually make it. Disk encryption helps - it's a great idea - so I've honestly never met anyone who's used it.
While this is certainly an interesting exploit, I doubt highly that many systems will be compromised in the wild with it.
Parent
Re: (Score:3, Insightful)
much tougher with Vista than any Linux distro I've run into.
And us linux users consider that a feature.
Re: (Score:3, Insightful)
Yes - My first system breach (not counting MS systems that were completely unsecured - I mean actually circumventing security) in the wild was back in the early 90's - A university *nix system. The thing that made (makes) *nix such an easy target is that you can actually understand how it works. Windows is full of holes, but it's so frigging weird and hard to wrap your head around the bizarre OS that the casual cracker won't bother learning what's going on. If your only goal is to satisfy some childish d
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Re:I cannot believe it... (Score:5, Informative)
I'll correct you a bit further -- there are different kinds of physical access. For instance, a public computer lab might have machines which have their case locked, both to prevent it from being opened and to prevent it from being locked down, BIOS locked and configured to boot only from hard disk, bootloader locked, etc.
On such a machine, there's really not a lot you can do to compromise it without some sort of actual software vulnerability or misconfiguration. You might be able to add a physical keylogger -- maybe -- depends how kiosk-ified it is.
However, this does not appear to be such an attack. Rather, it seems this is an attack which requires you to boot the machine off of some other media. Most machines are wide open to this in many ways -- the more frightening one was PXE; just plug a laptop into the same network and own every machine as it boots.
But Vista is not unique in this respect, and I cannot imagine how an OS could protect itself against such an attack. And even network boots can be secured, if you can add just a kernel and initrd to local storage.
Parent
Re: (Score:3, Informative)
My case came with one of those case locks. The manufacturer forgot to ship the key. Turned out the key to my luggage is about the same size and I was able to get into it in a few minutes. While there are probably more secure solutions than the one on my PC, picking a lock isn't much of a roadblock.
Re:I cannot believe it... (Score:5, Funny)
Hi. I see you are making fun of a "security vulnerability". This vulnerability involves being physically present at a PC and being able to boot it. This is a security vulnerability in the same way that my house is insecure to folks who I invite over for dinner.
You obviously have no clue, and I would recommend not posting in security vulnerabilities discussions any more.
kthxbai.
Parent
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
Re: (Score:3, Funny)
This is a very old news. A similar article was posted about a year ago. New guy - same shit. The attacker needs a physical access to the PC, which is absolute no-fair. Why the fukc you need to fuss around, when you just can take the whole thing home?
The same can be said about any OS -- if you allowed to mess with its files, you can make a rootkit. How dumb one have to be to make a story out of this nonsense?
OMG, "There is no fix for this, it is a design problem". You damn right, it is a design problem. IN Y