Microsoft Helps Police Crack Your Computer 558
IGnatius T Foobar writes "Microsoft has developed a small plug-in device that investigators can use to quickly extract forensic data from computers that "may have been used in crimes." It basically bypasses all of the Windows security (decrypting passwords, etc.) in order to eliminate all that pesky privacy when the police have physical access to your computer. Just one more reason not to run Windows on your computer."
Flaw (Score:5, Insightful)
Re:Flaw (Score:5, Funny)
Re:Flaw (Score:4, Insightful)
linux-based livecd that will reset any password on your windows partition.
if you have physical access and it's not encrypted, any data is fair game, it doesnt have anything to do with microsoft (in fact, im pretty pissed at ms for making it such a hassle to reset a password)
Re: (Score:3, Insightful)
Re:Flaw (Score:4, Interesting)
The article says
Really? (Score:5, Insightful)
I'd just boot knoppix and mount the partition. There, I have access to all the files. That goes for windows AND unix/linux.
If you really depend on the password for anything other than stopping casual or remote access, you're just fooling yourself.
Re:Really? (Score:4, Interesting)
Police over here in WA have a special distro designed for forensics [zdnet.com.au].
Re: (Score:2, Informative)
Re: (Score:2, Funny)
Re:Really? (Score:4, Interesting)
I'd just boot knoppix and mount the partition. There, I have access to all the files. That goes for windows AND unix/linux.
If you really depend on the password for anything other than stopping casual or remote access, you're just fooling yourself.
Re:Really? (Score:4, Interesting)
http://en.wikipedia.org/wiki/FileVault [wikipedia.org]
I was in an Apple store once when someone brought in their file vaulted laptop computer. They had 'forgotten' their password (Their actual story was that the OS changed the password on them). Apple Genius told them they were SOL. There are ways, but none of them are easy and most require something like cooling the RAM immediately after shutdown or catching the computer when it is sleeping.
Re:Really? (Score:4, Informative)
There is no other back door. The only possible hack is if they have auto login turned on, which basically indicates they are a retard. Technically it's possible to recover the login password once booted and auto logged in, though I have yet to see anyone figure it out, and I do look periodically. But at that point the HD is mounted anyway so all your data is there for copying to ext HD. Just no access to passwords in the keychain, (as in to recover, but you can still use them since the keychain is probably unlocked) but as above that is technically possible but not seen it done yet.
If auto login is not on, they are not logged in, you don't know the password, and you don't know the master password, nobody can help you. Not the Apple store, not Steve, it doesn't matter who you are.
Re: (Score:3, Informative)
Certainly, NSA or some random botnet master would be able to recover your password in minutes if they needed to.
Re: (Score:3, Insightful)
If the NSA isn't freaking out about some kind of encryption trying to get it banned, it's because they can get into it.
Also, the more secure you think your files are, the more likely you'll put stuff there that might interest them.
Re: (Score:3, Interesting)
See: http://rentzsch.com/macosx/securingFirewire [rentzsch.com]
"Firewire provides direct memory access. So I can plug in my PowerBook into an Xserve, and arbitrarily read and write to all of the Xserve's RAM, sans any logical protection."
"Paul claims enabling the Open Firmware password also automatically disables Firewire DMA, preventing trick
Re: (Score:2)
I can't think it would take all that long anyway. I reset the admin password on my windows laptop the other day, and it was fairly trivial.
Re: (Score:3, Funny)
Re: (Score:3, Interesting)
http: [microsoft.com]
Re: (Score:3, Informative)
The whole point of encryption is that it cannot be easily bypassed. The only way to get past the encryption is to decrypt the encrypted information. Now obviously Microsoft may have included back door keys or other mechanisms as "safety valves" for law enforcement, but nobody who is serious about their cryptography is going to trust the Microsoft disk encryption services. The full disk encryption services provided by TrueCrypt [truecrypt.org] (free and open source), for example, are NOT going to be easily defeated by any external technical analysis.
The whole point of this is that they can use it as a tool to analyze live systems which still have the encryption key in memory from when the user opened the encrypted volume. Using Truecrypt or other third-party encryption software won't protect you - if the encrypted volume was open when the police got to you, the data can be extracted no matter what you were using.
Presumably, this has backdoors to bypass things like the Windows screen locker (which would otherwise be a major obstacle to working with
Re:Flaw (Score:5, Insightful)
And, a scary precedent.
When the man kicks in your door, hooks up his thumb drive to your Linux box and doesn't get what he wants
The above is a deliberately absurd example. One which I fear is less far fetched than one would have previously hoped.
Mostly, I agree with some of the other posters here
Cheers
Re: (Score:2)
Someone HAS figured this out.
At least, that's the only safe assumption you can make about any Windows box now.
Re: (Score:2)
Re: (Score:2)
No, I'm not naively claiming Linux (or anything else is more inherently safe).
But, given that someone will likely put this into an ActiveX control and convince people to download it like they do all of the other windows malware out there -- it will be a fairly widespread problem if/when it does become known.
You want to hack into my FreeBSD box? You need to punch through my firew
Re:Flaw (Score:4, Interesting)
Wow. Just fucking wow.
So, either an AC is trolling by claiming to be a police officer who abuses due process. In which case I'm feeding trolls, and it's my bad.
Or, an actual police officer is pointing out how he can basically stomp over the intent of the law and your rights by pulling out an unsubstantiated claim of obstruction of justice.
If so, you're a perfect example of what is wrong in law enforcement, and why people have come to believe the cops are just thugs with authority. No wonder you posted anonymously. Thank you for demonstrating a new reason for increased cynicism about such things. No wonder people hate cops.
Cheers
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
No. That is exactly how Obstruction of Justice law is intended to be used. You destroy evidence, it's Obstruction of Justice. You don't hand over passwords, it is also.
Not necessarily. In United States v. Boucher [wikipedia.org] for example, a US district court ruled that the fifth amendment protections extend to encryption keys. The ruling has been appealed, of course, so we'll have to wait and see what happens there, but if it stands then there would seem that you can withhold your key in many cases.
Re: (Score:3, Funny)
Re: (Score:2, Interesting)
_NSAKEY [wikipedia.org]
Re: (Score:3, Funny)
What could possibly go wrong? (Score:4, Insightful)
Re:What could possibly go wrong? (Score:4, Funny)
Re: (Score:3, Informative)
Why do you have to reverse engineer it when tools already exist?
This works! (Score:3, Funny)
Here it comes... (Score:4, Funny)
Do not pass "go", do not collect... (Score:3, Funny)
Jail?
To save your time (Score:2)
FUD
Re: (Score:2)
Fear, Uncertainty and Doubt is how they sway you away from competing products. Here they are just selling one of their own, with no mention of a competing product.
LIAR! (Score:2)
Seriously. Does anyone here NOT know how to pull all the data off a windows machine without a password? I can think of a half-dozen ways to do it, and there is plenty of commercial software out there if you wanted to purchase some.
If someone has physical access to your machine, it is NOT secure. This is why people use encryption.
How the - (Score:5, Funny)
Re:How the - (Score:4, Funny)
Re: (Score:2)
By saying it bypasses *all* security, that would include full disk encryption and somehow obtaining admin access. I find it very hard to believe that this is the case.
I'd be real interested to see this USB key examined. There should be a bounty paid to the first person to get their hands on one.
Interesting thought (Score:2)
This article poses a question I've always wondered about. Do most criminal investigations of the computer-related nature have experts that are well-versed in multiple operating systems? Seeing as to how this is government, I would guess the answer is "no," and that is partly why we have this... uhh... "benefit" from Microsoft to aid our investigators.
Makes me curious as to what would happen if, for some reason, my computer were seized and the police booted up to an Ubuntu welcome screen... heh...
Re: (Score:3, Funny)
They would probably post questions to "Ask Slashdot".
Re: (Score:3)
They'll get my FreeBSD box, fail to understand it, probably reformat the RAID drives trying to run a 'disk checker' on them. Then use this as evidence of my wrongoing.
"He had a 'so called' open computer, that no 'normal' person can understand, breaking all Microsoft's standards and patents. It's made of Demons! burn the TERRORIST!!!"
Re: (Score:2)
Re: (Score:2)
They don't just give up if they get a unix shell and let the killer go.
Re: (Score:2)
This article poses a question I've always wondered about. Do most criminal investigations of the computer-related nature have experts that are well-versed in multiple operating systems?
From what I've seen, no. According to an FBI guy I know, as of a few years ago when the FBI found a Mac during an investigation, they shipped it to the RCMP (canadian mounties) for analysis. There is also a fairly well known computer forensics program at the university nearby (one of the largest of such programs in the country). They do cover Linux and NTFS but very sparsely. Most of the Linux stuff is about setting up a and using a Linux box as an investigative tool, not investigating other Linux machi
Re:Interesting thought (Score:4, Insightful)
They wouldn't boot your machine, though. They'd remove the drive, duplicate it, and then look at the duplicate through a hardware write blocker. Software would probably indicate that the majority of the disk was ext2/whatever Unix format you use partitions, and the layout of the root partition would make it fairly clear you were using a Unix variant. If they really wanted to "boot" your machine, they'd boot an image of your drive using a VM.
I dunno... (Score:3, Informative)
The article is extremely vague, but I don't see where this assertion came from. It sounds like they're distributing USB drives with a collection of cracking and monitoring tools; like what any self-respecting 1337 h4x0r carries around with him. If that's correct, there's no reason to think the same thing couldn't be done for Linux.
Re: (Score:2)
Re: (Score:2)
Could you please point out the part of the story where you and the submitter are getting this "bypassing security" thing from?
Re: (Score:2)
Re: (Score:2)
The ultimate zero-day exploit (Score:2)
This is very smart on Microsoft's part... (Score:3, Insightful)
I'm sure some lobbyist is sitting with a Congressional staffer right now, explaining how requiring Windows on every computer is essential to the War on Terrorism.
Re: (Score:2)
Physical access equals ownage under any OS (Score:3, Insightful)
This has always been true.
Re: (Score:2)
Dude. Even Windows (Vista) supports encrypting your disk these days. Assuming it was turned off when seized, that does not mean your data has been compromised or is realistically recoverable, especially by your average cop shop.
wow (Score:2)
Then i'd be running ubuntu on my cracked and pwned vista machine right now, instead of runnung ubuntu on my purchased and formatted vista machine.
Required? (Score:2)
Simple Protection (Score:2)
And if the USB software interacts with the computer while the OS is running, how can that be considered untainted evidence? AFAIK computer forensics rely on having snapshots of the machine with no possible interference from the OS and running programs.
Jonah HEX
Re: (Score:2)
Re: (Score:2)
Not new (Score:5, Interesting)
Anyone can boot from a Knoppix live CD and mount NTFS drives in Linux and poke around. NTFS security is not applied under Linux so you can have a look at anything you want. I don't see how this is a big deal.
The only thing that might be a problem is browsing the registry, but I wonder if wine's regedit can load native Windows registry hives. If so, then all Microsoft has done is taken existing Linux functionality and made it user friendly for the police.
Speaking of which, anyone wanna place bets as to how long it takes for this tool to spread across p2p and torrent sites?
Re: (Score:2)
Offline NT password and registry editor? (Score:2)
It's quite easy, boot up the computer from that disk and you can reset the passwords in a few minutes. Linux-based too for that matter.
FTFA:
The device contains 150 commands that can dramatically cut the time it takes to gather digital evidence, which is becoming more important in real-world crime, as well as cybercrime. It can decrypt passwords and analyze a computer's Internet activity, as well
Re: (Score:2)
TFA very light on details (Score:2)
User login passwords for Windows itself is something else and you can't "just decrypt" them.
Apart from that, it just sounds like MS have provided a bunch of analysis tools.
Is this really news or am I missing something here?
Customs (Score:2)
Re:Customs (Score:4, Interesting)
Well, why am I not surprised? (Score:2)
The only thing I use Windows for is to run TurboTax and games. And I'm wondering about the TurboTax even.
But all hope is not lost -- running Windows on a hypervisor would be a bit more secure -- at least you can restart with the same snapshot, eliminating any attempts to embed a rootkit or snooping ware.
But really, with Lin
Scary - and unbelievable (Score:2)
This sounds too scary to be true - and if true, it won't be long for this to be reverse-engineered.
Bypassing passwords/security: that sounds like a built-in back door. Not a security flaw: "this bug is a feature". And those back doors if confirmed to exist will be found soon.
The most unbelievable part is "decrypting passwords". Since when is the actual password stored, instead of a cryptographic hash of it? If decryption were possible, they are using a two-way encryption and a secret key is somewhere hidd
Re: (Score:2)
It really wouldn't be hard to cook up a Linux-based thumbdrive which automatically mounts more or less any filesystem in common use today, runs a combination of find and grep to weed out potentially interesting files, copy them onto an area of the thumbdrive and shut the system down when done.
It probably wouldn't generate anything which would stand up to forensic questions in court, but it would give you a pretty good idea as to whether or not it's w
TrueCrypt ! (Score:2, Informative)
Maybe this "security device" is simply... (Score:2)
People have been using that to recover data from broken and otherwise defective Microsoft Windows boxes for a long time now...
MS is giving out for free (Score:2)
FUD (Score:2, Insightful)
Viruses? (Score:2)
Great Idea(tm) (:-)
Imagine the TSA was using these. Every businessman's computer would be owned. If the virus also disabled the detection systems, our Bad Guy could also attack other bad guy's systems. He'd rule the world... Bwa Ha Ha Ha....
There is no security without physical security (Score:2)
With the right tools you can read files regardless of permissions, change passwords, add users, etc, almost anything. Building a linux live c
It's OK, theyre doing it to keep the internet safe (Score:2)
Seriously though, I'm curious to know more about what exactly this does. At first I assumed this was typical
Just one question... (Score:2)
Re: (Score:2)
interesting. (Score:2)
I have a compact distro on a thumb drive that I can boot on, mount ntfs vfat and rifle through a computer should I wish - but this sounds like its more comprehensive then that. And if it is designed for widespread cop usage then it must be extremely user friendly as well. And TFA implies you do not even need to power down the PC.
So.. I would a guess an auto run application that is designed from the bottom up the bypass security, promote to admin rights, scan for files matching keywords, copy log f
It basically bypasses all of the Windows security (Score:3, Funny)
So who needs Microsoft's device? (Score:3, Informative)
Nothing to Hide... (Score:5, Funny)
Could set crooks free easier too (Score:3, Insightful)
You'd always have to shut it down, image the drive, and then run your test against the image. If you ever so much as boot the image and use the device at that point, you've still just changed a shit load of files during the boot up process and a lawyer may still be able to get you off.
This device is only helpful if it contains a standalone script that can be pointed to a set of files on a write-blocked drive. Blindly letting it have full read/write access to any drive would be instant not-guilty result.
Unless this device gets some hefty certs, I'd be surprised if any law enforcement agency that reports to the public courts would ever use this device as reported.
Am I trolling again? (Score:2)
Now the summary says "Just one more reason not to run Windows on your computer."
I guess the submitter was trolling? But at any rate, it seems to me that since Windows can't read hda, as long as you keep your terrorism plans, drug dealers' phone book
This has already been done (Score:3, Informative)
http://tourian.jchost.net/shadow/liveusb/boot.png [jchost.net]
http://tourian.jchost.net/shadow/liveusb/memoryremenance.png [jchost.net]
http://tourian.jchost.net/shadow/liveusb/memoryremenance-filecarving.png [jchost.net]
http://citp.princeton.edu/memory/ [princeton.edu]
http://mcgrewsecurity.com/projects/msramdmp/ [mcgrewsecurity.com] (The MS isn't for microsoft)
Re: (Score:3, Informative)
Nothing really new.. (Score:3, Informative)
If you are a computer forensic investigator you already have many available tools (EnCase, etc) to do the same thing, not to mention the obvious linux based free tools (Helix, etc) that let you pound away on a computer (or captured image) and get whatever you want off it.
Keeping your computer completely secure is about as practical as copyright owners keeping their data totally protected. Its always an escalating two way battle and the winner is just the one who's willing to go the farthest with it, but nothing is 100% safe.
Privacy and DRM are both doomed for the same reasons.
Get over it.
Re:If It's Possible... (Score:5, Insightful)
No. The ONLY question that is of any interest is whether or not this device actually has a back door to Windows encryption. Somehow I seriously doubt that it does. Its probably little more than a bootable drive with NTFS support, and some tools. If you've got a password on your login, it doesn't mean you are using encryption. And this tool probably just lets you get straight to searching the -unencrypted- disk without cracking the login, or without pulling the drive and installing it somewhere else to scan through.
The implications of a device like this are scary to say the least. Although I'm not a Microsoft hater, this alone is more than enough to make me take a second look at options other than Microsoft Windows.
I suspect your average Linux LiveCD Recovery Disk has all the same tools on it. MS is just getting on board with their own version, to remove another area, where, right now, you have to use Linux. If that's the case the implications aren't scary at all.
And this whole are article is pure FUD.
Unless they've provided a back door to the encryption. That is the -only- question. But I really doubt they have.
Re: (Score:2)
Re:If It's Possible... (Score:4, Insightful)
I can't believe all the people who are freaking out about this. This isn't a remote exploit. This isn't a massive security hole. This is trivial stuff that anyone who is reasonably computer savvy should be able to do.
Re: (Score:2)
Re: (Score:2)
This is interesting. An FBI guy told me they shipped all the Macs they seized to the RCMP, who had staff experienced in analyzing them, whereas the FBI did not.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Some COFEE info from an Australian L.E. Conference (Score:4, Informative)
Here is the original link if anyone wants it: http://scissec.scis.ecu.edu.au/wordpress/conference_proceedings/2006/forensics/Proceedings_Forensics2006.doc [ecu.edu.au]
If you scan down about 15% of the way down, there is a blurb about COFEE mixed in with the rest:
Interestingly, this article if from 2006. So COFEE has been around for 2 years already. Fascinating that we are just hearing about it now.