Gaining System-Level Access To Vista 412
An anonymous reader writes "This video shows a method by which a user can use a Linux distro called BackTrack to gain system access to Windows Vista without logging into Windows or knowing the username or password for any accounts. To accomplish this, the user renames cmd.exe to Utilman.exe — this is the program that brings up the Accessibility options for users without sight or with limited vision. The attack takes advantage of the fact that the Utility Manager can be invoked before the user logs into the system. The user gains System access, which is a level higher than Administrator. The person who discovered this security hole claims that XP, 2000, 2003 and NT are not vulnerable to it; only Windows Vista is."
physical access == game over (Score:5, Insightful)
Physical Security (Score:5, Insightful)
This demonstrates that it's almost impossible to secure a machine when an attacker has unrestricted physical access. Any OS is vulnerable somehow. There are a few things that can be done (like encrypting the entire system partition), but mostly solutions are limited to restricting who has physical access.
Re:physical access == game over (Score:5, Insightful)
PANIC (Score:5, Insightful)
If you can write the raw disk... (Score:5, Insightful)
Really. If you have enough access to the machine to boot your own OS and rewrite the disk, of course you can take over the machine.
Now if someone manages to do this from the outside, that's news.
Re:WTF? (Score:5, Insightful)
Wow, if I boot a *nix machine with a rescue disk (assuming /sbin isn't encrypted) I can replace all sorts of apps that run as root with my own!
danger will robinson.
Seriously, as many problems as I have with Microsoft's past security practices, this does not look like anything.
Re:WTF? (Score:5, Insightful)
> something as root before login is still incredibly
> stupid.
Every Unix/Linux system runs "something as root" before login. You should look at "top" some time and see what pid number 1 is and who ran it.
Re:Is this how it was planned? (Score:2, Insightful)
Re:ethics? (Score:1, Insightful)
Disk access? (Score:5, Insightful)
Why not crack the Administrator password? (Score:2, Insightful)
The Administrator account would then allow the attacker to login into Vista and launch cmd.exe at System-Level. This can be accomplished by using the Task Scheduler at.exe to run cmd.exe at the next minute.
This isn't a real security hole. (Score:5, Insightful)
Definition of a security hole : A security hole allows you to gain system access when you don't have system access in the first place.
Re:Is this how it was planned? (Score:3, Insightful)
Re:Is this how it was planned? (Score:5, Insightful)
Not really, the kernel is just a file or two. If you insist, then rename init to something else (e.g. a shell) and you'll get a similar effect on Linux. Or modify the inittab to run a logged-in root shell on one of the vty's. If you really think this is some special OMG VISTA IS SO INSECURE COMPARED TO EVERYTHING ELSE flaw, then you don't understand the "problem" at all.
However I have to wonder: once you have access to the filesystem, why exactly would you bother booting into Vista and getting yourself a privileged cmd.exe? Why not just access whatever data you want from the other OS? Or does "unencrypted hard drives can be read and modified using other computers" not make a good enough headline?
This whole thing is so completely and utterly pointless it's probably created a black hole.
Re:physical access == game over (Score:2, Insightful)
Physical access to encrypted file systems with bitlocker means your going to have to be a lot more creative. TPM provides a trust relationship at the BIOS level so cheap crap like replacing the hard drive and waiting for the user to login is not going to work. You will need to first hide a small camera next to the keyboard or tap the keyboard or use tempest to collect the users password.
Re:physical access == game over (Score:5, Insightful)
My hunch would be that the utility has to insert some system level hooks into Windows in order to read text from every widget (window, control, or whatever you call them) in the system. This is why it needs elevated privileges.
But the whole article is stupid. I "hacked" into my coworker's Win2000 installation almost decade ago. He was on holiday and we needed something from his PC. I downloaded nice little program from the internet, copied it to disk, booted it and changed admin password. Then we just log on to his system using the new password. Wow! Maybe I should post an article to Slashdot about this!
This could be useful (Score:5, Insightful)
Re:physical access == game over (Score:2, Insightful)
Re:physical access == game over (Score:3, Insightful)
If the "interesting" files on a FS are cryptographically signed with a signature that also covers at least some of their FS info (name, fs, allocation, etc) you can happily read them, but you cannot modify them and move them around.
The funniest bit here is that Vista has the relevant crypto framework in place and has everything it needs to do this. Windows has been cryptographically verifying stuff for ages. As the video shows, it however, does not use it everywhere.
IMO it is a classic lesson on security design which can be summarised using one of my high school CS prof quotes. He used to say: "Miss, there is no such thing as a bit pregnant". You either do something everywhere or you do not bother.
Re:physical access == game over (Score:3, Insightful)
Re:Physical Security (Score:3, Insightful)
You ALREADY have unrestricted access to the drive by booting into an alternative OS with R/W access to the unencrypted HD. You want to install a rootkit or keylogger, just do it. You don't need to boot windows at all.
This is possible in any OS. Windows, OSX, Linux.... hell even OS9.
Re:physical access == game over (Score:5, Insightful)
Re:Long weekend... (Score:3, Insightful)
Re:Physical Security (Score:3, Insightful)
You have unrestricted access at that point of time.
You may want unrestricted access forever.
Re:Multi-step process (Score:5, Insightful)
Your comment is akin to saying "Ah, but what if someone finds a way to remotely append init=/bin/bash to Grub?" There's no weakness in Linux there, as you'd need to have root on the box in order to do such a thing, and then after the shutdown -r you'd be fucked anyway as it sat at a shell 1000 miles away waiting for someone to type into the console.
Re:physical access == game over (Score:5, Insightful)
But you still don't seem to understand. Surely you should see the folly in trying to protect the integrity of the contents of a disk, by performing verification using software stored on the same disk? It is a fool's errand, a fundamentally losing proposition.
It is a great security feature for keeping your data from being read by others if your laptop is confiscated or stolen. It is not a great security feature for keeping someone else from manipulating disk contents without special hardware support -- because in order for the computer to even boot there must be some amount of unencrypted code in the boot sector, and if you can modify that then there always exists a vector for attack.
These are two different types of security you're talking about; you can't just lump it all together.
Re:physical access == game over (Score:5, Insightful)
A bit of a chicken-and-an-egg problem here: How do you propose you authenticate users without a) running the authenticating program as root, having privileges to say "okay, you're user X, let me shift the control over to you", or b) being just as exploitable by giving limited user Y the privilege of saying "okay, you're user X, let me shift the control over to you"?
Linux isn't any better, you know...
# ps axu | grep getty /sbin/getty 38400 tty3 /sbin/getty 38400 tty4 /usr/sbin/gdm /usr/sbin/gdm
root 4825 [...]
root 4826 [...]
[...]
# ps axu | grep gdm
root 10691 [...]
root 23736 [...]
A better question would be to ask, "why is the login application executing random programs anyway?" or, like you said, "why isn't the login application making sure that, when it executes a random program, it actually executes the program it was supposed to execute?" but I suppose the answer to these questions is simple: "sometimes the flexibility is warranted" and "this is getting way too elaborate, giving minimal gains in actual real security" - in short, if you want to make sure utilman.exe isn't messed around with before the boot, the more feasible and elegant solution is to use full-drive encryption (which solves far more problems at one single swat), not mess around with micro-granular annoyances.
Re:physical access == game over (Score:5, Insightful)
ts7000:~$ ps aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 1.7 1368 508 ? S May25 0:05 init [2]
Re:physical access == game over (Score:5, Insightful)
Physical access is not always game over....
With physical access you can reflash the firmware in either the BIOS or (eg) an ethernet NIC. The modified firmware will have full access to the system RAM, disks, and just about anything else (because it can DMA to/from memory and any device). So the next time the system is booted and the full-disk-encryption password is entered it is indeed game over.
Rich.
Re:Long weekend... (Score:2, Insightful)
Re:physical access == game over (Score:2, Insightful)
Besides, you can be there legitimately. You may even have an account on the machine. Employees, contractors, etc. can also be attackers. This way they have a simple, fast and reliable privilege escalation ability.
Anything that makes breaking security with physical access faster and relatively inconspicious is a threat. So, yeah, restrict physical access all you want, but since this is never foolproof... If it's sensitive, it should be encrypted, period.
Re:physical access == game over (Score:3, Insightful)
Re:physical access == game over (Score:3, Insightful)
Our final solution ended up being fairly simple (for the users, it was a pain for me to implement) - Smart Cards.
We disallow "stupid" passwords (1234, etc.), and the cards are set to lockout after 3 incorrect tries. When you only get 3 guesses, even a 4 character password is secure.
Re:physical access == game over (Score:5, Insightful)
Once you get used to it, it's not too annoying at all.
Re:Long weekend... (Score:1, Insightful)