Gaining System-Level Access To Vista 412
An anonymous reader writes "This video shows a method by which a user can use a Linux distro called BackTrack to gain system access to Windows Vista without logging into Windows or knowing the username or password for any accounts. To accomplish this, the user renames cmd.exe to Utilman.exe — this is the program that brings up the Accessibility options for users without sight or with limited vision. The attack takes advantage of the fact that the Utility Manager can be invoked before the user logs into the system. The user gains System access, which is a level higher than Administrator. The person who discovered this security hole claims that XP, 2000, 2003 and NT are not vulnerable to it; only Windows Vista is."
Long weekend... (Score:4, Interesting)
changing these TYPES of programs is vulnerable (Score:1, Interesting)
I've done this in 3.1/95 with the SHELL= variable, in 98 replacing explorer.exe, etc, and in 2000/xp by replacing the accessibility tools. (I forget the name, but try pressing shift 5 times before you login with windows XP - or after and use task manager to see what comes up)..
Writing this from linux or i'd check
very nasty in computer labs
Oddly enough... (Score:3, Interesting)
Re:physical access == game over (Score:3, Interesting)
Also interesting to note this hack works only with Vista but not XP or earlier versions of Windows. Why would Microsoft go out of its way to make a system less secure?
Re:physical access == game over (Score:2, Interesting)
Secondly, which moron in Microsoft would allow 'root' level programs to run 'before' the user has logged in as root? Pretty dumb, it seems to me. Maybe they did it on purpose?
Thirdly, why not validate the cmd.exe before actually allowing it to run as root? This appears to have been done in XP / 2000 etc. so why not in Vista?
The exploit seems to be just the tip of an iceberg.
System Access v. Admin? (Score:2, Interesting)
Also, how do I get "root" or the most powerful level of access to an XP machine?
Re:physical access == game over (Score:5, Interesting)
No kidding. I once "hacked" into a Linux machine that had an unknown root password by booting off a live CD, sudo bashing to become root, and then it's just mount, chroot and passwd to reset the root password. (I could have also manually edited /etc/shadow but this was easier.)
Linux is horribly insecure! I was able to reset the root password with just a live CD and complete access to the machine!
Now of course if the hard drive had been encrypted, this "attack" wouldn't have worked. (Although in this case at least, a different attack would have worked: reinstalling the OS. Resetting the root password was faster. The data on the machine wasn't important. We just needed a working Linux installation with a known root password.)
Multi-step process (Score:4, Interesting)
Your questioning follows the "who cares if water expands when it freezes?" line of thinking. You're missing the second part, the idea that you have to pour it into something before it freezes in order to break that something without effort.
Re:physical access == game over (Score:5, Interesting)
And what do you suppose is going to stop the attacker from overwriting whatever program performs this validation, absent full-disk encryption coupled with a hardware security module? (And even then, what if they take a soldering iron to the TPM?)
Face it, if an attacker already has physical access to a system -- to the extent that he can run his own Linux OS on it and mess with the contents of its disks -- then that computer is already, entirely owned. This is true for Linux, it's true for OS X, it's true for BSD, and it's true for Windows. That's just the way computers work.
The only iceberg here is the massive crashing reality that a physically unsecured computer system is, well, insecure. Surprise.
Two reasons (Score:4, Interesting)
However the other is that it seems that many geeks misunderstand security. They think that perfect security is something you can actually have, that a system can actually be invulnerable from attack. So any attack is news in their minds since they've never thought it through. This is quite evident from the comments any time a site gets hacked and there is the attitude of "It is your fault if you are stupid enough to get hacked." I always like to ask if they'd take the same view if I broke in to their house, which would be extremely easy (almost nobody has good home security).
As you noted: When there's physical access to the system, all bets are off. Any OS level security isn't any good since the drive can just be removed and accessed directly. Heck, that's how we do data recovery at work. We don't even try to figure out if the problem is OS configuration or an actual disk error. The disk comes out, goes in to our recover system, and we get the necessary data off. Data first, diagnosis later. Once the data is safely off, then I worry about what actually went wrong.
All security is just a matter of trying to be secure enough that anyone who wants at what you are securing can't or won't spend the effort to defeat it. There's no perfection. Even something like full disk encryption. Yes, this will defeat something like this, and also defeat someone grabbing the drive and reading it. However if they really want it, they just grab you too and force you to hand over your password. If the data was important enough that you had to plan for that contingency, you get some body guards to keep you safe. However then they simply kill your guards and get you... etc.
Basically there isn't a be-all, end-all of security, where you are safe against everything. There is only being secure to the point that anyone who wants what you have, doesn't have the ability to get it.
Re:Is this how it was planned? (Score:3, Interesting)
That's not the point
Linux doesn't try to be secure against physical access, just add init=/bin/sh to the kernel command line.
OTOH: Windows has always had this weird naivety that passwords will protect the OS from the guy sitting infront of the PC.
Re:physical access == game over (Score:3, Interesting)
Nope. Know how most worms don't actually care about the data on the machine? They just want enough control to make the machine join a bot-net and start spamming.
In this scenario I don't care about the data on the machine. All I want to do is run programs on the machine. Sadly, the OS is password protected and I don't know the password. So I can't run programs. But if I were to replace the existing OS with a new one that I do have access to, I've done a successful attack: I now have the access I desired. I've started with no access and ended with full access.
Yes, all encrypted data would remain unknown. But for this "attack" I don't actually care about the data. I just want to be able to run programs on the machine. (Specifically in this case, it was a lab machine that had been moved from one project to another. Whoever originally set up the machine either couldn't be contacted or had forgotten the password, I don't remember which. There's no useful data on the machine, but the machine is still useful - if only we could access it.)
The entire point is that this is a somewhat lame attack - just like the attack in the article. It starts by assuming you manage to gain full read/write access to the drive. Amazingly enough, if you have full read/write access, gaining root access isn't terribly difficult...
Re:Physical Security (Score:3, Interesting)
The best way to block this attack, on ANY OS, is a cage with a padlock. Linux, OS X, and Windows all have single-user diagnostic modes that can easily be used with a boot disk.
Re:physical access == game over (Score:2, Interesting)
I remember at the time, Microsoft said this wasn't a security issue; a few weeks later, however, a patch was issued and this trick would no longer work.
If you read the article, it specifically says this Vista trick will not work on XP. The patch for the sticky-keys 'exploit' on XP implemented some sort of parameter to verify that, for example, sticky-keys was sticky-keys and not cmd.exe. It appears that this patch hasn't made its way to Vista.
That's just speculation though. It's not really a dead-horse issue, to be honest, but it's hardly a major threat. You need admin privileges to overwrite the original files anyway. Besides impressing your friends, it really isn't good for very much.
I disagree (Score:5, Interesting)
Re:physical access == game over (Score:4, Interesting)
Old trick? (Score:2, Interesting)
hooks should be in service or drivers (Score:5, Interesting)
That's how all hardware monitoring and similar tools do, to avoid triggering false alarams in UAC.
It's just strange how Windows can't even follow their own recommendations.
Re:Apple / OS X (Score:3, Interesting)
On PowerPC it's possible to set a CD boot password in Open Firmware. (use command-option-O-F at startup to get the Open Firmware command prompt) However, Open Firmware's settings can be reset by changing the amount of RAM in the system (adding/removing a DIMM), so physical access is a problem even there.
I don't even know if there's an equivalent to the Open Firmware command prompt in EFI.
Re:physical access == game over (Score:2, Interesting)
Re:physical access == game over (Score:3, Interesting)
Physical access is always the end of the game.
It requires something like 360's hypervisor to prevent this, and then gaining physical access to the actual die, without destroying it, could render this useless.
You can secure against this to some extent. (Score:2, Interesting)
Enable chasis intrusion in the BIOS
Password protect the BIOS
Put a lock on the case.
Not perfect, but it makes this a lot harder and a lot easier to detect.
Fake or real? Camtasia? (Score:3, Interesting)
But that product is only available for Windows, so how was it used to capture a screen video of a Linux computer? And how was it used to show a Vista computer booting (since presumably the Camtasia ScreenCam software cannot be loadet at that time)?
No flaming intended - this is an honest question.
- Jesper
Nothing new? (Score:5, Interesting)
http://www.avertlabs.com/research/blog/index.php/2007/03/12/windows-vista-vulnerable-to-stickykeys-backdoor/ [avertlabs.com]
Only thing new is using Linux to rename the file.
Comment removed (Score:3, Interesting)
TPM sets the bar damned high (Score:3, Interesting)
Re:Meh, not so impressive (Score:3, Interesting)
Yeah, and there's men that go to work in women's frilly underwear, but most don't brag about it on the internet!
hawk