Windows 7 is quite possibly the most anticipated operating system at the moment; maybe even the most highly regarded one in the last few years, but that doesn't mean it comes without flaws. According to NetworkWorld, two security researchers have created an exploit for Windows 7 that they deem 'unfixable', which allows a hacker to take full control of a system.The researchers, Vipin Kumar and Nitin Kumar, have named their exploit 'VBootkit 2.0', and they demonstrated it on a Windows 7 virtual machine. Kumar said, "There's no fix for this. It cannot be fixed. It's a design problem." This may sound dangerous, but it's not entirely as bad as some would think. The exploit cannot be used remotely; the attacker has to have physical access to the target machine. However, if they can get access, it could be devastating. The file clocks in at a mere 3KB, and "allows an attacker to take control of the computer by making changes to Windows 7 files that are loaded into the system memory during the boot process."
Be careful, though; the latest version of VBootkit (which isn't fully ready yet) would allow remote access, can remove a user's password, and gives an attacker the highest level of privileges. This gives someone access to all of a victim's files, which, as you can imagine, is very dangerous. When the victim's computer is restarted, access is removed, but can easily be gained again by running the software.
Exactly. I guess I can now claim that reformatting a hard drive is an 'Unfixable' exploit as well.
The only reason these security exploits call it an 'Unfixable' exploit is because it generates hype.
Are you from the Department of Redundancy Department?
dude...i had to litterally LOL @ that comment. so damn funny!!!
I think you meant that it affects both Vista and 7, since is uses the new WINLOAD.EXE boot process that was introduced in Vista. And you might have also meant that this is more than "theoretical", since it has been demonstrated.
Other than that, your statement is pretty accurate.
I've heard that one before.
Now be a good little boy and fetch me a bucket of steam and some glass nails aswell please
Other than that, your statement is pretty accurate.
I think what he meant is that the idea that software can be made to harm any OS if it is installed/run locality by a user with root privileges. This is not a flaw in Windows, it is an example why real-time anti-virus software is important, especially for users who don’t understand the difference between safe attachments and executables.
Other than that, your statement is pretty accurate.
I meant you can also do this against XP, Linux, Mac OS, FreeBSD, OpenBSD, etc.
You clearly said:
This doesn't even have anything to do with Windows 7. That is untrue.
and
It's a theoretical "attack" that affects every OS ever. When it is not theoretical. It was demonstrated. It used the fact that Windows Vista & 7 use a boot loader that makes an incorrect assumption that loaded code = executed code = safe. Please demonstrate how their method can be used against, say OpenBSD. There is a PDF that shows their method linked in the article.
This doesn't even have anything to do with Windows 7. That is untrue.
No it isn't. The only reason Windows 7 was mentioned in the story was to have a more interesting headline. The actual "attack" is a theoretical one which affects any OS that I'm aware of. The proof-of-concept they have targets Vista and happens to have the same impact on the current builds of Windows 7, if the largely impactical preconditions are met.
Calling it "unfixable" is ridiculous, there are numerous ways to protect yourself from this attack, many of which are already employed commonly enough. My Vaio Z running Win7 is impervious to this kind of attack, for example, for several reasons.
It's a theoretical "attack" that affects every OS ever. When it is not theoretical. It was demonstrated. It used the fact that Windows Vista & 7 use a boot loader that makes an incorrect assumption that loaded code = executed code = safe. Please demonstrate how their method can be used against, say OpenBSD. There is a PDF that shows their method linked in the article.
It's theoretical because it makes assumptions which usually are not valid. For instance, "I can somehow alter the code loaded into memory, after it is loaded but before it is executed during the boot process without the OS noticing."
If you can do that, it will work against any OS. It won't work against Windows if you're using a TPM, as my laptop does for instance, because Windows continually verifies that the boot path has not been altered. I don't even think their POC works on EFI systems to begin with. And it won't work against any machine if you can't inject code via a boot device. So unless you can physically open the machine and attach a new drive and then edit the BIOS configuration (assuming there's no password protection on it) to boot to that device, you can't even get started with attempting this attack. You can't just leave a bootable CD in the drive even if the disc is bootable, because at power on the machine will say "press any key to boot to CD/DVD."
I can't think of any attack based on this idea that wouldn't be significantly less practical and effective than a simple hardware keylogger attached to the keyboard.
Big words.
*cough*Mac"*/cough*
Sorry, couldn't resist.
TPM has a hack out involving freezing the pc (no joke)
Yes, and it's a real attack, but it's ridiculously impractical and only effective some of the time.
maybe it`s hard to use that problem but that doesn't mean it`s impossible one day they would find a way
so they may need to remake some work in the code of Win 7 to fix the problem or what ?
Splitting of hairs...
Root kits can be OS level or sub OS level. As the hardware BIOS/EFI/etc can also be affected by a 'root kit', and thus becomes invisible to the OS, no matter what OS.
There is also several specific sub-OS root kits out there already, so this story is NOT new, and the one making the biggest news as of late is the one that can be created under Linux via Linux's own calls that can NOT be removed from the mainboard or HD once it happens.
The whole 'root kit' definition gets fuzzy, but it basically means below the 'root' of the computer OS, which can be either in the OS's itself at Ring 0 or even below that at a hardware level.
It is just in how far you stretch the definition, especially when dealing with non-technical readers...
For example:
http://www.networkworld.com/community/node/41180
Could be called a root kit, though technically, it is more intrusive than an average root kit, but is the best way to talk about it to end users or basic security IT people.
Cache posisioning is the point of injection, but the lingering effects are what a root kit would do, so is it a root kit? Yes and No...
to be fair, there aint too many new operating systems about to be released...
Snow Leopard, the new version of Ubuntu just came out...
Yeah, because we're used to getting so many OS's every day.
Yeah, but that's one from each major player... Once you've covered Windows, OS X and Linux... there's not much left.
Well duh.. if the attacker has physical access then he/she can basically do anything with machine that's worst then devastating. Wouldn't this apply to any OS...!
Well duh.. if the attacker has physical access then he/she can basically do anything with machine that's worst then devastating. Wouldn't this apply to any OS...!
I was thinking the same exact thing. Isn't the point of any exploit to give remote control over the computer without the hacker even needing to physically be there. I mean if you had the computer write in front of you that whole step is removed. You could just load the key logger or whatever yourself.
Well duh.. if the attacker has physical access then he/she can basically do anything with machine that's worst then devastating. Wouldn't this apply to any OS...!
There's a IT security idiom that states: "if a hacker has physical access to your computer, it's no longer your computer"
I also have an "unfixable" exploit. I can track you down and torture you until you give me your password.
Law #3
This Technet article's content is old enough, I thought people knew all that already....
Law #3
This Technet article's content is old enough, I thought people knew all that already....
Lol: "He could mount the ultimate low-tech denial of service attack, and smash your computer with a sledgehammer."
"Once you have physical access to the machine you can pretty much do anything. I mean, they might as well be complaining that a hacker could swap your HDD with one that has been compromised" -- lol well said.
It isn't a hack?
Try reading their 2007 whitepaper on their earlier version, and you will see how technical it is, and how it works. It truly is a "hack", and does an amazing job.
This discussion sub-thread is about whether it was a "hack" or not.
It is a classic example of an interesting hack.
Maybe you meant to post a reply to someone else? (and, yes, I agree it is fixable, but would require changing their boot loader again)
And fixing it wouldn't require changing the bootloader. The fix shipped with Vista, you just need compatible hardware (TPM).
Yeah whatever, Mr. Researcher.
What-freaking-ever.
Last edited by Breach on 24 Apr 2009 - 09:29
Read the others here The 10 Immutable laws of Security
It may not me yours, but it doesn't have to be his either.
Are you sure? I can give you physical access to my PC which has encrypted HD - good luck
and my axe will comprimise your box in seconds!
Sure. I'll just turn it on, freeze the memory with an upside down can of cold air, dump it to disk to get the key, and Tada! Instant HDD access.
Only if you force me to enter password, first, but that's always an option, of course.
I could also just wait for you to log in then knock you out or kill you and now I have everything required to get your data!
Oh well that's a relief.
OSX and Linux are too easy to hack these days.
OSX and Linux are too easy to hack these days.
OSX fell in Pwn2own. Not sure where your evidence and supporting information for your Linux claim is.
This is an exploit that doesn't involve access to the internals (plus all the stares for using a screwdriver and opening a PC case up and pulling a hard drive out).
This just boots off CD/USB and you don't get any stares like you are doing anything unusual. Rebooting Windows happens quite often, you know.
The real hack is that they are able to use and remain in the windows environment.
This just boots off CD/USB and you don't get any stares like you are doing anything unusual. Rebooting Windows happens quite often, you know.
While you're correct in theory; someone needs BIOS access to set the machine to boot from removable media. Assuming you can not open the case the reset the BIOS (and subsequently the password), unless you find the BIOS password you won't be able to make the machine to boot from your infected removable media.
Thus in essence, if BIOS is password protected and PC is set to boot only from its boots HDD its impossible to install this unless you have access to the internals.
I don't think theres a way to reset the BIOS fiddling with jumpers and batteries on the mobo, right?
Well, actually - it does not. Perhaps if you run XP. At work, for example, the only reboots that my machines EVER get are monthly patch days. Same was on Vista (Win 7 now).
...
Are you aware how very FEW of these machines are set with BIOS passwords and to not boot from CD?
It seems you are not.
umm not really. unless you still use XP.
Also lots of machines (especially laptops) have BIOS passwords that cannot be reset. And if your machine has a power-on password set via the BIOS that will also foil this attack. Basically there are lots of protective measures that will make this attack impractical or impossible.
There are freely available programs out there that will reveal and/or reset any password on the machine without booting into windows.. one of those gives unrestricted access to any machine running any version of windows AND compromises your password so they might be able to access other machines, as we know a lot of folks use the same password for different things..
Which is obviously a major security hole since it renders local passwords useless. Vista should have fixed this but didn't; Win7 probably won't fix it because it's Vista-like, but hopefully the next one will.
I agree. Win 7 will be huge. Good luck to the so called competitors out there.
Microsoft took a dump on our lawns (Vista) and we hardly called it jaw-dropping.
Win7 right now for still being beta and far from being RTM IS jaw-dropping. Its a very polished, rich and blazing fast OS. What else do you want?
Personally for me the only thing missing is native .mkv support but thats a tiny minor detail.
windows crypts the files so they can't be accessed unless you log and type correct pass.
the thing nobody notices here is that it removes the user pass which means decrypts the crypted files too.
windows crypts the files so they can't be accessed unless you log and type correct pass.
the thing nobody notices here is that it removes the user pass which means decrypts the crypted files too.
Clone the drive. Then take it home boot off a cd that removes the login password and your golden.
format all drives and go home - also unfixable exploit ey?
You have your windows 7 laptop secured with user pass and all files encrypted and you think if it got stolen nobody will get any data.
What if he use VBootkit 2.0 ???
Also, what if a student got access to the school computer ? or worse, to the company admin computer while he is not there but he thinks nobody is able to bypass the passwords and cryptions he put on his data ???
the thing nobody notices here is that it removes the user pass which means decrypts the crypted files too.
Protection against physical attacks is not that trivial thing, it is as important as protection from remote attacks imho.
Last edited by kInG aLeXo on 24 Apr 2009 - 16:32
You have your windows 7 laptop secured with user pass and all files encrypted and you think if it got stolen nobody will get any data.
What if he use VBootkit 2.0 ???
Also, what if a student got access to the school computer ? or worse, to the company admin computer while he is not there but he thinks nobody is able to bypass the passwords and cryptions he put on his data ???
the thing nobody notices here is that it removes the user pass which means decrypts the crypted files too.
Protection against physical attacks is not that trivial thing, it is as important as protection from remote attacks imho.
If I had a laptop and if it got stolen I'd automatically assume that my personal data is pretty much exposed, no matter the OS or encryption.
I guess your best bet would be to be running an encrypted hidden partition inside a dummy one. Assuming no one knows you were running a hidden one you'd be safe.
Havent tried it yet but since the RC is out i might install it, maybe i am paranoid lol, but should i worry about this?
Havent tried it yet but since the RC is out i might install it, maybe i am paranoid lol, but should i worry about this?
Every operating system out there is vulnerable to this style of attack, which requires physical access to the computer. Don't worry about it.
Havent tried it yet but since the RC is out i might install it, maybe i am paranoid lol, but should i worry about this?
If you worry about this, you sould just not even have a computer, because if someone can get access to your computer in your house without your knowladge, then you have bigger problems then this
Oh wait, the difference with this thing is that it loads with Windows... And the point being? Yes, you can do these things while the system is 'live'. But this is also seeming to run as a driver would. In fact, why didn't they just make this a kernel-mode driver? Then it'd work EVERY boot without a problem.
As people have pointed out... If you're in FRONT of the PC, and can bring outside code in to the machine, the machine is NEVER 100% secure. If that was the case, there wouldn't be a need for computer technicians but instead require disposable computers when your OS took a ****.
Exploits like this are why we have BIOS passwords. Of course, if you have the time and physical access you could always clear the CMOS by opening the case and removing the battery/using the reset jumber/button, but if you let an attacker have that level of physical access you're sunk no matter what you do...
Last edited by JonathanMarston on 24 Apr 2009 - 20:25
I R 31337
And besides, you could probably rape any computer quite well with a fork-bomb and its output piped into a file
"Dude...do you just wanna borrow my computer?"
"Oh ok, sure."
:facepalm:
How hard is that to understand?
BTW people removing user pass this way does NOT decrypt encrypted files. >.>
:facepalm:
DO NOT LET THIS CRAP DETER YOU FROM USING 7, THIS CAN BE EASILY DONE TO ANY OS. Anyone gets physical access your screwed. I doubt anyone would bother using 'Vbootcrap 2.0' anyway.
Last edited by omnicoder on 27 Apr 2009 - 07:30
C: del *.*
Crazy flaw, you can delete the entire drive!!! All these years and Microsoft has done nothing about it!
I am currently working on another windows flaw. Code name: "format drive" it also requires physical access
Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!
Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.