Slashdot Log In
Gaining System-Level Access To Vista
Posted by
kdawson
on Sun May 25, 2008 11:51 PM
from the seems-too-simple-somehow dept.
from the seems-too-simple-somehow dept.
An anonymous reader writes "This video shows a method by which a user can use a Linux distro called BackTrack to gain system access to Windows Vista without logging into Windows or knowing the username or password for any accounts. To accomplish this, the user renames cmd.exe to Utilman.exe — this is the program that brings up the Accessibility options for users without sight or with limited vision. The attack takes advantage of the fact that the Utility Manager can be invoked before the user logs into the system. The user gains System access, which is a level higher than Administrator. The person who discovered this security hole claims that XP, 2000, 2003 and NT are not vulnerable to it; only Windows Vista is."
Related Stories
Submission: Another Security Problem for Vista by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Cancel.... (Score:5, Funny)
Cancel or Allow...
Nothing new? (Score:5, Interesting)
http://www.avertlabs.com/research/blog/index.php/2007/03/12/windows-vista-vulnerable-to-stickykeys-backdoor/ [avertlabs.com]
Only thing new is using Linux to rename the file.
Parent
Long weekend... (Score:4, Interesting)
Re:Long weekend... (Score:5, Funny)
Parent
Re:Long weekend... (Score:5, Funny)
Parent
physical access == game over (Score:5, Insightful)
Re:physical access == game over (Score:5, Insightful)
Parent
Re:physical access == game over (Score:5, Informative)
Physical access does always mean game over, bruting(most people keep thier FDE passwords around 4 characters) and the possibility of plain text attacks exist on certain blocks.
The interesting thing is that the utility for helping impaired people is run as SYSTEM when it really doesn't have to be. I had wondered this and thought about doing the same hack before ever even seeing this video, however didn't ever bother to do it, the possibility of messing something up and having to revert it after just seemed too annoying to me.
Parent
Re:physical access == game over (Score:5, Insightful)
My hunch would be that the utility has to insert some system level hooks into Windows in order to read text from every widget (window, control, or whatever you call them) in the system. This is why it needs elevated privileges.
But the whole article is stupid. I "hacked" into my coworker's Win2000 installation almost decade ago. He was on holiday and we needed something from his PC. I downloaded nice little program from the internet, copied it to disk, booted it and changed admin password. Then we just log on to his system using the new password. Wow! Maybe I should post an article to Slashdot about this!
Parent
Re:physical access == game over (Score:5, Funny)
Parent
Re:physical access == game over (Score:5, Funny)
Parent
Re:physical access == game over (Score:5, Funny)
Parent
I disagree (Score:5, Interesting)
Parent
Re:physical access == game over (Score:5, Insightful)
Parent
Re:physical access == game over (Score:5, Informative)
When vista says "activate now or die" tap shift 5 times, opt to go to accessibility panel, now you have an explorer window running as System, you can jump to control panel, start up all the networking and windows installer services, install those pesky Lan drivers, then exit back and activate windows.
This works so well now because of the heavy integration of explorer/iexplore and the configuration panel scripts.
Parent
Re:physical access == game over (Score:5, Informative)
Instead of using the incredibly painful phone activation, you can use this to install said LAN drivers and activate.
If you're using a pirate copy, there's no pesky activation dialog either, and if you're using a crack, you don't really need LAN drivers to use it, do you?
Parent
hooks should be in service or drivers (Score:5, Interesting)
That's how all hardware monitoring and similar tools do, to avoid triggering false alarams in UAC.
It's just strange how Windows can't even follow their own recommendations.
Parent
Meh, not so impressive (Score:5, Informative)
What you should have done that would have been more impressive would be to boot off a Linux CD and rename the SAM file. Then when the machine was booted again the Administrator password would have been BLANK. You could then have retrieved whatever information you wanted from your "friends" computer, renamed the SAM back to it's correct name, and when he returned his password would have been the same. This would have been much nicer for your "friend" and far more impressive since you would not have had to rely on someone reversing the password storage format of the SAM file - which BTW has changed a few times. Microsoft even started using SALT, the nerve!
Anyway, the rename method would have worked out of the box without any "boring" reverse work on someone else's part and would take advantage of a stupid oversight on Microsoft's work - just like this hack does. FWIW, I LIKE Vista and know that in general it's more secure than XP. That Microsoft was so STUPID as to allow something like this to work doesn't surprise me but it does dissapoint me. Hopefully they don't fix it before I've had a chance to show a "friend" how it works
Parent
Re:physical access == game over (Score:5, Funny)
Once you get used to it, it's not too annoying at all.
Parent
Re:physical access == game over (Score:5, Insightful)
Once you get used to it, it's not too annoying at all.
Parent
Re:physical access == game over (Score:5, Funny)
qwertyuiopasdfghjklzxcvbnm
but good guess!
Parent
Re:physical access == game over (Score:5, Insightful)
Physical access is not always game over....
With physical access you can reflash the firmware in either the BIOS or (eg) an ethernet NIC. The modified firmware will have full access to the system RAM, disks, and just about anything else (because it can DMA to/from memory and any device). So the next time the system is booted and the full-disk-encryption password is entered it is indeed game over.
Rich.
Parent
Re:physical access == game over (Score:5, Interesting)
No kidding. I once "hacked" into a Linux machine that had an unknown root password by booting off a live CD, sudo bashing to become root, and then it's just mount, chroot and passwd to reset the root password. (I could have also manually edited /etc/shadow but this was easier.)
Linux is horribly insecure! I was able to reset the root password with just a live CD and complete access to the machine!
Now of course if the hard drive had been encrypted, this "attack" wouldn't have worked. (Although in this case at least, a different attack would have worked: reinstalling the OS. Resetting the root password was faster. The data on the machine wasn't important. We just needed a working Linux installation with a known root password.)
Parent
Re:What idiots modded this up? (Score:5, Informative)
Parent
Multi-step process (Score:4, Interesting)
Your questioning follows the "who cares if water expands when it freezes?" line of thinking. You're missing the second part, the idea that you have to pour it into something before it freezes in order to break that something without effort.
Parent
Re:Multi-step process (Score:5, Insightful)
Your comment is akin to saying "Ah, but what if someone finds a way to remotely append init=/bin/bash to Grub?" There's no weakness in Linux there, as you'd need to have root on the box in order to do such a thing, and then after the shutdown -r you'd be fucked anyway as it sat at a shell 1000 miles away waiting for someone to type into the console.
Parent
Re:physical access == game over (Score:5, Informative)
Parent
Re:physical access == game over (Score:5, Informative)
The article wouldn't have been newsworthy if it had merely said "Vista just as vulnerable, nothing new." Especially since the old tricks are often the first things tried with the new OS.
Parent
Re:physical access == game over (Score:5, Interesting)
And what do you suppose is going to stop the attacker from overwriting whatever program performs this validation, absent full-disk encryption coupled with a hardware security module? (And even then, what if they take a soldering iron to the TPM?)
Face it, if an attacker already has physical access to a system -- to the extent that he can run his own Linux OS on it and mess with the contents of its disks -- then that computer is already, entirely owned. This is true for Linux, it's true for OS X, it's true for BSD, and it's true for Windows. That's just the way computers work.
The only iceberg here is the massive crashing reality that a physically unsecured computer system is, well, insecure. Surprise.
Parent
Re:physical access == game over (Score:5, Funny)
It's much much harder with Linux. First of all you have to work out how to lure the user out of their basement and away from their computer.
Parent
Re:physical access == game over (Score:5, Insightful)
But you still don't seem to understand. Surely you should see the folly in trying to protect the integrity of the contents of a disk, by performing verification using software stored on the same disk? It is a fool's errand, a fundamentally losing proposition.
It is a great security feature for keeping your data from being read by others if your laptop is confiscated or stolen. It is not a great security feature for keeping someone else from manipulating disk contents without special hardware support -- because in order for the computer to even boot there must be some amount of unencrypted code in the boot sector, and if you can modify that then there always exists a vector for attack.
These are two different types of security you're talking about; you can't just lump it all together.
Parent
Re:physical access == game over (Score:5, Insightful)
A bit of a chicken-and-an-egg problem here: How do you propose you authenticate users without a) running the authenticating program as root, having privileges to say "okay, you're user X, let me shift the control over to you", or b) being just as exploitable by giving limited user Y the privilege of saying "okay, you're user X, let me shift the control over to you"?
Linux isn't any better, you know...
# ps axu | grep getty /sbin/getty 38400 tty3 /sbin/getty 38400 tty4 /usr/sbin/gdm /usr/sbin/gdm
root 4825 [...]
root 4826 [...]
[...]
# ps axu | grep gdm
root 10691 [...]
root 23736 [...]
A better question would be to ask, "why is the login application executing random programs anyway?" or, like you said, "why isn't the login application making sure that, when it executes a random program, it actually executes the program it was supposed to execute?" but I suppose the answer to these questions is simple: "sometimes the flexibility is warranted" and "this is getting way too elaborate, giving minimal gains in actual real security" - in short, if you want to make sure utilman.exe isn't messed around with before the boot, the more feasible and elegant solution is to use full-drive encryption (which solves far more problems at one single swat), not mess around with micro-granular annoyances.
Parent
Re:physical access == game over (Score:5, Insightful)
ts7000:~$ ps aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 1.7 1368 508 ? S May25 0:05 init [2]
Parent
Is this how it was planned? (Score:5, Funny)
Re:Is this how it was planned? (Score:5, Insightful)
Not really, the kernel is just a file or two. If you insist, then rename init to something else (e.g. a shell) and you'll get a similar effect on Linux. Or modify the inittab to run a logged-in root shell on one of the vty's. If you really think this is some special OMG VISTA IS SO INSECURE COMPARED TO EVERYTHING ELSE flaw, then you don't understand the "problem" at all.
However I have to wonder: once you have access to the filesystem, why exactly would you bother booting into Vista and getting yourself a privileged cmd.exe? Why not just access whatever data you want from the other OS? Or does "unencrypted hard drives can be read and modified using other computers" not make a good enough headline?
This whole thing is so completely and utterly pointless it's probably created a black hole.
Parent
Physical Security (Score:5, Insightful)
This demonstrates that it's almost impossible to secure a machine when an attacker has unrestricted physical access. Any OS is vulnerable somehow. There are a few things that can be done (like encrypting the entire system partition), but mostly solutions are limited to restricting who has physical access.
Re:Physical Security (Score:4, Informative)
Parent
PANIC (Score:5, Insightful)
Re:PANIC (Score:5, Funny)
Parent
If you can write the raw disk... (Score:5, Insightful)
Really. If you have enough access to the machine to boot your own OS and rewrite the disk, of course you can take over the machine.
Now if someone manages to do this from the outside, that's news.
Oh... (Score:5, Informative)
Re:Oh... (Score:4, Informative)
There isn't anything magical or hidden about a laptop hard drive.
Parent
DUH..... this works in 2000 and xp as well (Score:5, Informative)
This is news? (Score:5, Informative)
Linux distro named BackTrack? Who is this kdawson and how is he such a fucking idiot? All the "elite haxors" in the video are doing are mounting the Windows filesystem in offline mode and doing two simple file operations. Again, how is this news and why is slashdot consistently posting more crap these days? Slashdot: morons for editors, shit that doesn't matter (anymore).
Mastercard Ad (Score:5, Funny)
Disk access? (Score:5, Insightful)
This isn't a real security hole. (Score:5, Insightful)
Definition of a security hole : A security hole allows you to gain system access when you don't have system access in the first place.
This could be useful (Score:5, Insightful)
Re:WTF? (Score:5, Insightful)
Wow, if I boot a *nix machine with a rescue disk (assuming /sbin isn't encrypted) I can replace all sorts of apps that run as root with my own!
danger will robinson.
Seriously, as many problems as I have with Microsoft's past security practices, this does not look like anything.
Parent
Re:WTF? (Score:5, Insightful)
> something as root before login is still incredibly
> stupid.
Every Unix/Linux system runs "something as root" before login. You should look at "top" some time and see what pid number 1 is and who ran it.
Parent