Gaining System-Level Access To Vista 412
An anonymous reader writes "This video shows a method by which a user can use a Linux distro called BackTrack to gain system access to Windows Vista without logging into Windows or knowing the username or password for any accounts. To accomplish this, the user renames cmd.exe to Utilman.exe — this is the program that brings up the Accessibility options for users without sight or with limited vision. The attack takes advantage of the fact that the Utility Manager can be invoked before the user logs into the system. The user gains System access, which is a level higher than Administrator. The person who discovered this security hole claims that XP, 2000, 2003 and NT are not vulnerable to it; only Windows Vista is."
Cancel.... (Score:5, Funny)
Cancel or Allow...
Nothing new? (Score:5, Interesting)
http://www.avertlabs.com/research/blog/index.php/2007/03/12/windows-vista-vulnerable-to-stickykeys-backdoor/ [avertlabs.com]
Only thing new is using Linux to rename the file.
Re: (Score:3, Funny)
Long weekend... (Score:4, Interesting)
Re:Long weekend... (Score:4, Informative)
Re: (Score:3, Insightful)
Re:Long weekend... (Score:4, Funny)
Unless you were suggesting shopping for Media Access Control, in which case I apologize.
Re: (Score:3, Funny)
Re:Long weekend... (Score:4, Funny)
Re:Long weekend... (Score:5, Funny)
Re:Long weekend... (Score:5, Funny)
Re:Long weekend... (Score:4, Funny)
Re: (Score:3, Informative)
physical access == game over (Score:5, Insightful)
Re:physical access == game over (Score:5, Insightful)
Re:physical access == game over (Score:5, Informative)
Physical access does always mean game over, bruting(most people keep thier FDE passwords around 4 characters) and the possibility of plain text attacks exist on certain blocks.
The interesting thing is that the utility for helping impaired people is run as SYSTEM when it really doesn't have to be. I had wondered this and thought about doing the same hack before ever even seeing this video, however didn't ever bother to do it, the possibility of messing something up and having to revert it after just seemed too annoying to me.
Re:physical access == game over (Score:5, Insightful)
My hunch would be that the utility has to insert some system level hooks into Windows in order to read text from every widget (window, control, or whatever you call them) in the system. This is why it needs elevated privileges.
But the whole article is stupid. I "hacked" into my coworker's Win2000 installation almost decade ago. He was on holiday and we needed something from his PC. I downloaded nice little program from the internet, copied it to disk, booted it and changed admin password. Then we just log on to his system using the new password. Wow! Maybe I should post an article to Slashdot about this!
Re:physical access == game over (Score:5, Funny)
Re:physical access == game over (Score:5, Funny)
Re:physical access == game over (Score:5, Funny)
I disagree (Score:5, Interesting)
Re:physical access == game over (Score:5, Insightful)
Re:physical access == game over (Score:5, Informative)
When vista says "activate now or die" tap shift 5 times, opt to go to accessibility panel, now you have an explorer window running as System, you can jump to control panel, start up all the networking and windows installer services, install those pesky Lan drivers, then exit back and activate windows.
This works so well now because of the heavy integration of explorer/iexplore and the configuration panel scripts.
Re:physical access == game over (Score:5, Informative)
Instead of using the incredibly painful phone activation, you can use this to install said LAN drivers and activate.
If you're using a pirate copy, there's no pesky activation dialog either, and if you're using a crack, you don't really need LAN drivers to use it, do you?
hooks should be in service or drivers (Score:5, Interesting)
That's how all hardware monitoring and similar tools do, to avoid triggering false alarams in UAC.
It's just strange how Windows can't even follow their own recommendations.
All part of the Macintosh heritage (Score:4, Informative)
Thus on system software changes, guess which two manufacturers' software broke the most often.
hawk
Meh, not so impressive (Score:5, Informative)
What you should have done that would have been more impressive would be to boot off a Linux CD and rename the SAM file. Then when the machine was booted again the Administrator password would have been BLANK. You could then have retrieved whatever information you wanted from your "friends" computer, renamed the SAM back to it's correct name, and when he returned his password would have been the same. This would have been much nicer for your "friend" and far more impressive since you would not have had to rely on someone reversing the password storage format of the SAM file - which BTW has changed a few times. Microsoft even started using SALT, the nerve!
Anyway, the rename method would have worked out of the box without any "boring" reverse work on someone else's part and would take advantage of a stupid oversight on Microsoft's work - just like this hack does. FWIW, I LIKE Vista and know that in general it's more secure than XP. That Microsoft was so STUPID as to allow something like this to work doesn't surprise me but it does dissapoint me. Hopefully they don't fix it before I've had a chance to show a "friend" how it works
Re: (Score:3, Interesting)
Yeah, and there's men that go to work in women's frilly underwear, but most don't brag about it on the internet!
hawk
Re:physical access == game over (Score:5, Funny)
Once you get used to it, it's not too annoying at all.
Re:physical access == game over (Score:4, Funny)
Re:physical access == game over (Score:5, Funny)
qwertyuiopasdfghjklzxcvbnm
but good guess!
Re:physical access == game over (Score:5, Insightful)
Once you get used to it, it's not too annoying at all.
Re: (Score:3, Insightful)
Our final solution ended up being fairly simple (for the users, it was a pain for me to implement) - Smart Cards.
We disallow "stupid" passwords (1234, etc.), and the cards are set to lockout after 3 incorrect tries. When you only get 3 guesses, even a 4 character password is secure.
Re:physical access == game over (Score:4, Funny)
Re: (Score:2)
I dunno --- I'm still waiting for someone who actually watched the video to post in this thread :-)
I guess the question is: can the SYSTEM account access encrypted volumes? In XP, if you encrypted your home directory, the Administrator user could read your files (by default; you could change that).
Re:physical access == game over (Score:5, Insightful)
Physical access is not always game over....
With physical access you can reflash the firmware in either the BIOS or (eg) an ethernet NIC. The modified firmware will have full access to the system RAM, disks, and just about anything else (because it can DMA to/from memory and any device). So the next time the system is booted and the full-disk-encryption password is entered it is indeed game over.
Rich.
Re:physical access == game over (Score:4, Interesting)
Re: (Score:3, Interesting)
Physical access is always the end of the game.
It requires something like 360's hypervisor to prevent this, and then gaining physical access to the actual die, without destroying it, could render this useless.
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
Also interesting to note this hack works only with Vista but not XP or earlier versions of Windows. Why would Microsoft go out of its way to make a system less secure?
Re: (Score:2, Interesting)
Secondly, which moron in Microsoft would allow 'root' level programs to run 'before' the user has logged in as root? Pretty dumb, it seems to me. Maybe they did it on purpose?
Thirdly, why not validate the cmd.exe before actually allowing it to run as root? This appears to have been done in XP /
Re:physical access == game over (Score:5, Informative)
Re:physical access == game over (Score:5, Informative)
The article wouldn't have been newsworthy if it had merely said "Vista just as vulnerable, nothing new." Especially since the old tricks are often the first things tried with the new OS.
Re:physical access == game over (Score:4, Funny)
Your ignorance and intolerance of cripples and mongs astounds me.
Re:physical access == game over (Score:5, Interesting)
And what do you suppose is going to stop the attacker from overwriting whatever program performs this validation, absent full-disk encryption coupled with a hardware security module? (And even then, what if they take a soldering iron to the TPM?)
Face it, if an attacker already has physical access to a system -- to the extent that he can run his own Linux OS on it and mess with the contents of its disks -- then that computer is already, entirely owned. This is true for Linux, it's true for OS X, it's true for BSD, and it's true for Windows. That's just the way computers work.
The only iceberg here is the massive crashing reality that a physically unsecured computer system is, well, insecure. Surprise.
Re:physical access == game over (Score:5, Funny)
It's much much harder with Linux. First of all you have to work out how to lure the user out of their basement and away from their computer.
Re:physical access == game over (Score:5, Insightful)
But you still don't seem to understand. Surely you should see the folly in trying to protect the integrity of the contents of a disk, by performing verification using software stored on the same disk? It is a fool's errand, a fundamentally losing proposition.
It is a great security feature for keeping your data from being read by others if your laptop is confiscated or stolen. It is not a great security feature for keeping someone else from manipulating disk contents without special hardware support -- because in order for the computer to even boot there must be some amount of unencrypted code in the boot sector, and if you can modify that then there always exists a vector for attack.
These are two different types of security you're talking about; you can't just lump it all together.
TPM sets the bar damned high (Score:3, Interesting)
Re: (Score:3, Insightful)
Re:physical access == game over (Score:5, Insightful)
A bit of a chicken-and-an-egg problem here: How do you propose you authenticate users without a) running the authenticating program as root, having privileges to say "okay, you're user X, let me shift the control over to you", or b) being just as exploitable by giving limited user Y the privilege of saying "okay, you're user X, let me shift the control over to you"?
Linux isn't any better, you know...
# ps axu | grep getty /sbin/getty 38400 tty3 /sbin/getty 38400 tty4 /usr/sbin/gdm /usr/sbin/gdm
root 4825 [...]
root 4826 [...]
[...]
# ps axu | grep gdm
root 10691 [...]
root 23736 [...]
A better question would be to ask, "why is the login application executing random programs anyway?" or, like you said, "why isn't the login application making sure that, when it executes a random program, it actually executes the program it was supposed to execute?" but I suppose the answer to these questions is simple: "sometimes the flexibility is warranted" and "this is getting way too elaborate, giving minimal gains in actual real security" - in short, if you want to make sure utilman.exe isn't messed around with before the boot, the more feasible and elegant solution is to use full-drive encryption (which solves far more problems at one single swat), not mess around with micro-granular annoyances.
Re:physical access == game over (Score:5, Insightful)
ts7000:~$ ps aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 1.7 1368 508 ? S May25 0:05 init [2]
Re: (Score:3)
If you have LANMAN hashes on the local network, you can usually (well over 99.9% IIRC) get the password very quickly using the "alpha-numeric-symbol32-space" lanman rainbow tables available here [shmoo.com].
Re: (Score:3, Insightful)
If the "interesting" files on a FS are cryptographically signed with a signature that also covers at least some of their FS info (name, fs, allocation, etc) you can happily read them, but you cannot modify them and move them around.
The funniest bit here is that Vista has the relevant crypto framework in place and has everything it needs to do this. Windows has been cryptographically verifying stuff for ages. As the video shows, it ho
Re: (Score:3, Funny)
Re:physical access == game over (Score:5, Interesting)
No kidding. I once "hacked" into a Linux machine that had an unknown root password by booting off a live CD, sudo bashing to become root, and then it's just mount, chroot and passwd to reset the root password. (I could have also manually edited /etc/shadow but this was easier.)
Linux is horribly insecure! I was able to reset the root password with just a live CD and complete access to the machine!
Now of course if the hard drive had been encrypted, this "attack" wouldn't have worked. (Although in this case at least, a different attack would have worked: reinstalling the OS. Resetting the root password was faster. The data on the machine wasn't important. We just needed a working Linux installation with a known root password.)
You don't even need a bootCD/disk (Score:3, Informative)
init=/bin/bash
It bypasses the init process (and all of the login requirements therein) to dump you straight to the *bash shell.
*Assumes bash is in the path
Re:What idiots modded this up? (Score:5, Informative)
Re: (Score:3, Interesting)
Unless you deleted the partition containing the data...but wouldn't that defeat the purpose of breaking into the system?
Nope. Know how most worms don't actually care about the data on the machine? They just want enough control to make the machine join a bot-net and start spamming.
In this scenario I don't care about the data on the machine. All I want to do is run programs on the machine. Sadly, the OS is password protected and I don't know the password. So I can't run programs. But if I were to replace the existing OS with a new one that I do have access to, I've done a successful attack: I now have the access I desired.
Re: (Score:3, Insightful)
Multi-step process (Score:4, Interesting)
Your questioning follows the "who cares if water expands when it freezes?" line of thinking. You're missing the second part, the idea that you have to pour it into something before it freezes in order to break that something without effort.
Re:Multi-step process (Score:5, Insightful)
Your comment is akin to saying "Ah, but what if someone finds a way to remotely append init=/bin/bash to Grub?" There's no weakness in Linux there, as you'd need to have root on the box in order to do such a thing, and then after the shutdown -r you'd be fucked anyway as it sat at a shell 1000 miles away waiting for someone to type into the console.
Is this how it was planned? (Score:5, Funny)
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
That's not the point
Linux doesn't try to be secure against physical access, just add init=/bin/sh to the kernel command line.
OTOH: Windows has always had this weird naivety that passwords will protect the OS from the guy sitting infront of the PC.
Re:Is this how it was planned? (Score:4, Informative)
On your second point, encrypted filesystems. If the filesystem is encrypted but the user knows the password they can:
Encryption is designed to protect against people who don't know the password to the disk. The only way you can arrange this for people who logon to the machine is if physical to the machine doesn't mean physical access to the keys .. ie TPM. Even then it's uncertain as when you're logged into the machine the plaintext disk key must be available to the OS.
Likewise, if the password the user enters is poor and the 256bit key is available on the hard disk (no "keyfob") you can probably get over 100bits of plaintext for a dictionary search from just the boot sector of the harddisk.
So to avoid the attack in the FA from a third party you either need a good FDE password, so the on-disk key is used only for password changing or a keyfob that cannot be left in the machine.
Against the user of the machine it's TPM and prayer.
Re:Is this how it was planned? (Score:5, Insightful)
Not really, the kernel is just a file or two. If you insist, then rename init to something else (e.g. a shell) and you'll get a similar effect on Linux. Or modify the inittab to run a logged-in root shell on one of the vty's. If you really think this is some special OMG VISTA IS SO INSECURE COMPARED TO EVERYTHING ELSE flaw, then you don't understand the "problem" at all.
However I have to wonder: once you have access to the filesystem, why exactly would you bother booting into Vista and getting yourself a privileged cmd.exe? Why not just access whatever data you want from the other OS? Or does "unencrypted hard drives can be read and modified using other computers" not make a good enough headline?
This whole thing is so completely and utterly pointless it's probably created a black hole.
Physical Security (Score:5, Insightful)
This demonstrates that it's almost impossible to secure a machine when an attacker has unrestricted physical access. Any OS is vulnerable somehow. There are a few things that can be done (like encrypting the entire system partition), but mostly solutions are limited to restricting who has physical access.
Re: (Score:2)
Re:Physical Security (Score:4, Informative)
Re: (Score:3, Insightful)
You ALREADY have unrestricted access to the drive by booting into an alternative OS with R/W access to the unencrypted HD. You want to install a rootkit or keylogger, just do it. You don't need to boot windows at all.
This is possible in any OS. Windows, OSX, Linux.... hell even OS9.
Re: (Score:3, Insightful)
You have unrestricted access at that point of time.
You may want unrestricted access forever.
Re: (Score:2)
But they too are vulnerable to other kinds of attack by someone that has physical access to the machine. While the attack would be different for non-Vista Windows machines, I think those are about as easy.
Re: (Score:3, Interesting)
The best way to block this attack, on ANY OS, is a cage with a padlock. Linux, OS X, and Windows all have single-user diagnostic modes that can easily be used with a boot disk.
PANIC (Score:5, Insightful)
Re:PANIC (Score:5, Funny)
If you can write the raw disk... (Score:5, Insightful)
Really. If you have enough access to the machine to boot your own OS and rewrite the disk, of course you can take over the machine.
Now if someone manages to do this from the outside, that's news.
Oh... (Score:5, Informative)
Re:Oh... (Score:4, Informative)
There isn't anything magical or hidden about a laptop hard drive.
Oddly enough... (Score:3, Interesting)
DUH..... this works in 2000 and xp as well (Score:5, Informative)
Umm (Score:3, Informative)
This is news? (Score:5, Informative)
Linux distro named BackTrack? Who is this kdawson and how is he such a fucking idiot? All the "elite haxors" in the video are doing are mounting the Windows filesystem in offline mode and doing two simple file operations. Again, how is this news and why is slashdot consistently posting more crap these days? Slashdot: morons for editors, shit that doesn't matter (anymore).
Re: (Score:2, Informative)
Re: (Score:2)
Two reasons (Score:4, Interesting)
However the other is that it seems that many geeks misunderstand security. They think that perfect security is something you can actually have, that a system can actually be invulnerable from attack. So any attack is news in their minds since they've never thought it through. This is quite evident from the comments any time a site gets hacked and there is the attitude of "It is your fault if you are stupid enough to get hacked." I always like to ask if they'd take the same view if I broke in to their house, which would be extremely easy (almost nobody has good home security).
As you noted: When there's physical access to the system, all bets are off. Any OS level security isn't any good since the drive can just be removed and accessed directly. Heck, that's how we do data recovery at work. We don't even try to figure out if the problem is OS configuration or an actual disk error. The disk comes out, goes in to our recover system, and we get the necessary data off. Data first, diagnosis later. Once the data is safely off, then I worry about what actually went wrong.
All security is just a matter of trying to be secure enough that anyone who wants at what you are securing can't or won't spend the effort to defeat it. There's no perfection. Even something like full disk encryption. Yes, this will defeat something like this, and also defeat someone grabbing the drive and reading it. However if they really want it, they just grab you too and force you to hand over your password. If the data was important enough that you had to plan for that contingency, you get some body guards to keep you safe. However then they simply kill your guards and get you... etc.
Basically there isn't a be-all, end-all of security, where you are safe against everything. There is only being secure to the point that anyone who wants what you have, doesn't have the ability to get it.
Limited Usefulness (Score:2)
Even in a networked environment, this access gets you very little, as a local machine admin still has no privileges on the network. So the best you can hope for here, is that the
Mastercard Ad (Score:5, Funny)
Disk access? (Score:5, Insightful)
This isn't a real security hole. (Score:5, Insightful)
Definition of a security hole : A security hole allows you to gain system access when you don't have system access in the first place.
This could be useful (Score:5, Insightful)
Re: (Score:3, Informative)
You silly people (Score:4, Funny)
this is a feature
which helps you recover data after you forgot your password.
Fake or real? Camtasia? (Score:3, Interesting)
But that product is only available for Windows, so how was it used to capture a screen video of a Linux computer? And how was it used to show a Vista computer booting (since presumably the Camtasia ScreenCam software cannot be loadet at that time)?
No flaming intended - this is an honest question.
- Jesper
Re: (Score:2)
Re:WTF? (Score:5, Insightful)
Wow, if I boot a *nix machine with a rescue disk (assuming /sbin isn't encrypted) I can replace all sorts of apps that run as root with my own!
danger will robinson.
Seriously, as many problems as I have with Microsoft's past security practices, this does not look like anything.
Re:WTF? (Score:5, Insightful)
> something as root before login is still incredibly
> stupid.
Every Unix/Linux system runs "something as root" before login. You should look at "top" some time and see what pid number 1 is and who ran it.
Re:WTF? (Score:4, Funny)
My porn! My precious porn!!
Re: (Score:3, Interesting)
On PowerPC it's possible to set a CD boot password in Open Firmware. (use command-option-O-F at startup to get the Open Firmware command prompt) However, Open Firmware's settings can be reset by changing the amount of RAM in the system (adding/removing a DIMM), so physical access is a problem even there.
I don't even know if there's an equivalent to the Open Firmware command prompt in EFI.
Why bother? (Score:3, Informative)
I've used the same technique before to restore an XP system that no one knew the admin password to. Changed the default screensaver .scr to cmd.exe. Just booted to login, made a coffee, when I got back, cmd was open in System user. Funnily, I think the user rights for System in XP were limited below Administrator
Why bother? If you can reboot the computer, you can just boot into single user mode and change the password directly, on any operating system I've ever used (Windows: press F8 on bootup; Linux: append S to the GRUB kernel line, etc.).