New Windows 7 hack purports to be "unfixable"
By Donald Melanson 
posted Apr 23rd 2009 7:02PM
posted Apr 23rd 2009 7:02PM
A hack that's "unfixable" is a pretty bold claim, but that's just what researchers Vipin Kumar and Nitin Kumar have announced at the now-happening Hack in the Box security conference, and they seem ready to back it up. Apparently, they've devised a means to gain control of a Windows 7 computer during the boot up process though the use of a tiny 3KB program dubbed VBootkit 2.0 (a follow-up to a similar Vista hack), which loads itself into the system memory and bypasses the hard drive altogether, making it extremely difficult to detect. Once loaded, an ill-intentioned individual could potentially change passwords, access protected files, or do just about anything else and then leave without a trace. The one fairly big drawback to the hack, however, and upside for most users, is that it can't be performed remotely, so it'll likely only be a significant concern for businesses or other folks using computers in public places -- unless, of course, Microsoft finds a way to fix the "unfixable."
[Via Electronista]
[Via Electronista]
I don't think I'd download a file any "Kumar" sent me anyways.
Unless of course I won an international lottery worth $1,800,000,000
Or if an aunt I didn't know in Scandinavia died and my notice of inheritance was emailed to me.
Don't forget all the Nigerian princesses that need our support.
Wait.. that bitch asked for your help too?
No matter, I'll keep sending her all my money and banking information. As long as she didn't promise to marry you too.
I mean i sent her my social security but i stopped when she asked me for my bank account number, what kind of a fool did she think I was??
It's generally a good idea to not download files from strangers anyway, is there anything in particular you have against 'Kumar's?
Just wondering, because I'm a Kumar and we're generally quite likeable, and aren't really known for sending out mass scam emails.
I know what you mean, I personally found it a bit strange when I was emailed out of the blue about getting a great mortgage rate but was happy enough to provide a copy of my signature, my name, address, telephone number and social security number.
I found it even stranger when the nigerian man was knocking on my door asking to do a pc inspection which he guaranteed would clear it up of any viruses. I told him, my pc would already off but he said that was great. All I had to do, was stick this thumbstick into the drive and I would get a bonus prize next time it started.
Odd though, I keep being called by Visa telling me my credit card limit is overdrawn. I've never had a credit card with them though. How odd huh?
@Wes
..you took it too far =/
Wes, you ruined my day. Not because of the content of your comment, but the sheer audacity to beat up the dead horse.
Please, give me your e-mail and phone number so we can discuss how to improve your character and personality, and save 30% or more on car insurance.
Wait you mean none of you ever wanted to try viagra?
Those guys left white castle long enough to create a hack.
Dumbest hack ever if it can't be deployed remotely. That's like saying an ERD Commander or PartPE are deadly exploits.
BartPE*
Not to mention that you can use a good BartPE disc to wipe out the bad files on the HDD and then simply reboot, and voila, the "unfixable" hack is now gone.
LAME
it's not on the HDD though.
I find it very scary, and if you would know what you're talking about so would you, unless you use your PCs just to play Doom of course.
Ezio: BartPE and ERD is ran on a CD to change passwords and whatnot, it's not actually on the HDD.
Yeah, because it's not like people want data that's on their computers to stay safe in the event they're stolen. I assume the real point of this hack is that it can be used to circumvent data encryption on the hard drive.
Nothing to see here folks, just a lot of people trying to get all hyped up about nothing.
It isn't fair to call something a "hack" if you need physical access for it to work. Seriously.
> "I find it very scary, and if you would know what you're talking about so would you, unless you use your PCs just to play Doom of course."
I'm fairly certain that you don't actually understand the nature of the attack. It certainly has concerns, but is not outright scary. Assuming a semblance to the vbootkit I can guess at the process this employs. It requires the computer to boot off of removable media (CD-ROM, USB, etc), at which point the program reads the master boot record and begins launching the OS, while it is still running. In many ways it is similar to a hypervisor, executing at a layer below the OS. It then modifies files the OS loads into memory, so that compromised code can be executed within the context of the OS.
Now this certainly has concerning implications. I suspect it can actually be detected in a similar manner that the Bluepill exploit is detected (look for operations that take too many clock cycles because something else is executing), but the OS is not in a position to do this. If the system is compromised before your own code executes, there is no way to regain integrity at that point. Pre-boot integrity controls are the only feasible countermeasure. Why this is labeled a Windows 7 hack is confusing, since it actually targets the weak integrity checks prior to OS code running (yes, the payload is OS specific, but the attack is not).
Now, why this isn't scary- this attack requires the boot process to be physically compromised. The attack code must execute prior to the bootloader, which means it needs to execute off of removable media and requires physical access. If a person simply maintained their boot order to load from hard disk first, and password protected their BIOS so that the boot order couldn't be changed this isn't going to be even a driveby attack (though overloading the keyboard buffer does work on some machines, to bypass the password most machines are going to require the person to take the case off and reset the cmos via jumper or pulling the battery- neither are going to be quick drive by attacks at a company). Really, it is easy to restrict this to people who have flat out stolen a machine. The open question I have is whether increased boot integrity controls (TPM for example) mitigate this attack.
By the way, the whitepaper for the original v1 attack is here: http://www.nvlabs.in/uploads/projects/vbootkit/vbootkit_nitin_vipin_whitepaper.pdf
informatiowned
I don't know....I don't think it's THAT dumb. There are many, many cybercafes out there. All you really need to do is get lucky on 1 or 2 of them and you'll have a days worth of people's information to play with. Not saying that everyone who uses those machines access more than just email or games on em', but I'm sure some of them do more important things as well.
All a thief would need to do is reboot a machine to get the program into memory, and come back for the 'spoils' before the cafe closes.
Granted, it's hit and miss the entire time (since the machine may have been rebooted before they come back, etc), but it's not super dumb. And if it really can't be detected or is truly 'unfixable' then it could be problematic if it ever got into the wild.
Bitlocker is around to specifically protect against this type of attack, utilize the policy to requre a PIN at boot and unless the decryption key is still warm in the RAM chip you have pretty adaquate defenses against these local only attacks. This is right up there with saying the password recovery on OSX is a vulnerability. Sensationalist journalistic crap!
So what, you don't even need to go to a cyber cafe to get people's personal information. Just get a program that lets you use your cell phone's data connection as a wifi hotspot like WMwifirouter for Windows Mobile and set the SSID as Free Wifi. Go to any high traffic area and you're bound to get at least one person that decides to do their online banking over the new super neato "Free Wifi" they just found.
I went into Starbucks once with WMwifirouter running on my phone, and in the time it took for me to order my coffee and receive it I had two people connect to "Free Wifi". I didn't check to see what websites they went to because I was just wanting to see anyone was stupid enough to connect to 'Free Wifi".
If the virus gets loaded into your RAM, when the power is disconnected (i.e. when you turn it off) the virus should be wiped from the RAM (RAM cannot store data when there is no power). Unless you're silly enough to never shutdown and always put your hardware to sleep.
@insky
I'm not quite sure what the scope of this attack you state would be - so many email services / all banks use SSL, I think you may well have quite a bit more work to do once you've pulled them packets out the sky :D
Can someone hack into my computer and tell me why vista hangs at the "shutting down..." screen, if i shutdown after waking from sleep?
BIOS password/bootorder lock might still be bypassed by posing as some RAID controller and run code that way I imagine, to name a scenario.
As for 'needs to be in RAM', yeah it needs to be the first time, but if it then can access everything with max privilege it can just disable checking (and fake it's not disabled) and insert itself into the OS on the HD I would guess.
What do these people think? Microsoft will look at it and say, "Oh well, we had a good run, guess everyone can start using Ubuntu now. Sorry it didn't work out." Why do these hackers constantly think its so necessary to discover flaws in the Windows OS?
because finding flaws in windows is fun.
I find flaws in Windows everyday of my life and I don't give a FUCK.
You're right. Who wants a constantly improved product line. Why should companies to perform any kind of maintenance or upgrades on what products they sell. I mean, who cares if some co-worker's 15 year old who sits down at your computer while you are on lunch can wipe out your entire system and get you fired. Not that that will ever happen. Nah. Lets all got back to NT 4 cause that was... well, 'just good enough'.
I found a flaw in Windows at my last job that pertained to Terminal Server and how a certain part of the registry gets parsed.
I reported it to MS Tech support and they said "Wow, that does seem to be a problem"
Then my Technical Account Manager (TAM in MS Speak) stepped in and said it was a "feature" and not a bug and if I wanted it changed, we would have to provide TONS of information on how this problem was monetarily affecting our company, including financial records and all kinds of other stuff.
And thus, to this day, the problem still exists.
beacuse it helps in making a better, reliable, safer product. At least these hackers inform manufacturers about these flaws, some hackers intend to find and exploit hacks like these with possibly your bank accounts on the receiving end of the exploit. Won't it be better that hackers like the ones in the article found it and letting it being known than those who want to use it for criminal activities.
Yesterday I found a flaw in Windows of a friend. They would make a squeaking noise when opened slowly.
@tinu - lol!
If you can't login to and tamper with Ubuntu or most Linux builds without login credentials, you aren't doing it right. This is possible on most OS.
@Tinu you can fix the Windows flaw with WD40!
The pity argument is a strong one. Take pity on us, leave us alone.
@Casper42: The reason why they need a business impact statement is they need to determine if it's worth the time/money to fix it. It's a business decision. The last figured I heard tossed around was in the quarter mil range to generate a hotfix due to the very extensive testing involved for a piece of software that will distributed globally. If that hotfix actually makes things worse for those people...well...let's just say that's the reason for the very extensive testing. If it's a serious problem costing businesses millions of dollars, things will either 1) get a workaround and/or 2) get fixed rather quickly. On the other hand, if it's something that's just not working right but doesn't cause any harm or monetary loss, it's unlikely to get fixed immediately. It's not that they're trying to push you off (unless you just got a lazy TAM/engineer), they just need to determine if it's worth sinking all that time/money into.
Also, if it's a legacy OS (like 2k3) they're less likely to want to fix it since that's multiple OS generations behind and that sucks up finite time and resources from supporting current OSes and developing new ones (i.e. Win7/2k8 R2).
This isn't a flaw in windows. It executes before OS code even loads. If an OS loads on a compromised system it is impossible to ensure integrity- that is one of the basic tenants of computer security. The payload is for Windows 7, but the hack involves booting prior to Windows and then launching the OS. The same premise would work for any x86 system though the payload would need to be tailored to the OS. It is literally impossible for an OS to protect against an attack that transpires prior to it executing- the only countermeasure would be for greater integrity controls via firmware on the part of the hardware vendor.
@Tinu:
That's a feature, not a flaw.
Simple. Microsoft pays them to do it. Last I heard any good hacks you find they will pay you outright for the blow-by-blow of how you did it.
Uh-Oh
Don't fret my friend, there is a fix for this hack.
See someone using your computer you kick his arse.
If this could be deployed remotely....that'd be bad xD
Actually, it's possible. All you need is every Apple product ever made in your house at one time. Your head will grow so large, you will develop psychic powers, and can then take over someone else who IS by the computer you want to hack, and have them do it. I'm getting there man, I'm getting there.
You might think
// Begin C Code
int main () {}
// End C Code
is perfect but your function just run off the end without returning a value :).
Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.
Exactly, to call this a hack and boast about it?
Normally I'd agree. But in this case it mentions that "protected" files can become accessible. If they mean encrypted files this is a big flaw in Windows security. If I'm not mistaken encryption should use the user's MD5 or likewise password as the key to unlock the files. If just changing the password file gives you access to encrypted documents on Windows 7 that's a big flaw.
Also I'd like to question these security experts... How do they know it's unfixable?
I totally agree with krikit... Just because you are self-proclaimed "security experts", what makes your code absolutely perfect, or the manner in which it operates?
As a former "security expert", one of the few rules of the game is "no code, especially not code written by a human, will ever be perfect".
Where's the other laws of which I assume this one is a member?
http://technet.microsoft.com/en-us/library/cc722487.aspx
From the big M themselves.
I think, looking at it a second time, law 2 is even more apt.
@Obvious: I think this code, written by a human, is perfect:
// Begin C Code
int main () {}
// End C Code
Windows 7 looks very KDEish
It's just the thicker taskbar. The similarities stop there. For better and for worse.
Yeah, because both have windows, icons and have a blue shade......
KDE was originally designed to mimic the look of Windows to make it less scary for converts.
Naah you're getting it wrong : KDE looks alot Windows 7-ish ..
Oh wait is KDE4 like 2 years older ?
SNAP !
So younger then XP or Vista then?
Cock.
seems pretty cool thought not too practical. if you need to do this all while booting the computer locally, why bother even remotely controlling it? i suppose you can spy on anyone who leaves their computers on 24/7 and would be oblivious to someone restarting it, though to me if you do that, you deserve to get hacked.
Sounds to me like the perfect tool for a girlfriend or wife who has tried your trust to much and won't come clean.
Most computers can be taken over with physical access. This is more of a tinker, than a hack. I always have a Helix or a Backtrack3 CD with me or a hacksaw usb thumb drive just in case I stumble on a computer that needs tinkering.
As if every OS on the planet isn't subject to physical access attacks where you can insert code into the boot process.
Here fishy, fishy...
Thank god Engadget didn't use that stupid unicorn watermark crap.
So... you like fish sticks??
Yes...
then your a gay fish
Screw you guys, I don't get the joke although I'm the voice of the future.
i love putting fish sticks in my mouth..
This is stupid this has been possible since before XP, and is even possible on a Mac. All it is doing is fooling the system. Back in XP you could do this using the bios to trick xp into letting you in a back door. On OS X, not sure if you still can, but you could command line the system to thinking it was a new install. Then simply fill out the form and boom your an Admin. There's always a way but as long as it's not remote I don't care.
If you have to use the Terminal then you have to be on the/an account.
What is up with these Indian (or its neighbors) IT people? they think they are the cleverest of the lot? Wake up! People have been at this game for decades, well before the 2 nitwits were born!
Unfixable, my foot! So many people have claim to such, but no one has yet succeed.
The two I-have-no-sex-life hackers really need to be humbled.
Finally, a programmer that knows assembler.. I remember DOS viruses - smallest was 451b (bytes) as in twice as less characters than this entire article contains.
This is getting really boring. Finding bugs that will never do anything except steal some crap passwords. Add to it the fact that it is virtually useless remotely means 7 is gonna be good enough for me. I'm getting it and I don't care who finds what anyways.
kthx.
"Dude, your computer's booting up."
"yeah, so what ?"
"Insert this thumb drive now."
"Why?"
"Just do it man."
"I don't get it, why ?"
"Dang, never mind it booted up already. See ya later."
they are telling the guys that MADE the OS that they cant fix it? how incredibly stupid of them.
It's not a vulnerability of the operating system.
Every operating system, OSX, Linux, BSD, etc. is vulnerable to this style of attack. Not this particular implementation of it, but the same general idea.
Oh I'm worried!
I mean once they break the encryption on my corporate laptop they'll be able to load the program on!
More FUD. What a fucking waste of an article.
FUD againts MS on engadget? You sure? Noooo I can't believe this!
There are a few problems I can see with this:
1. If it can't be performed remotely, just don't be dumb. Whether you have a Mac, Linux or Windows, If I can get to where I sit on your keyboard, I will find a way to screw it up.
2. If it bypasses the hard drive, and loads straight into memory, that doesn't really sound like a Microsoft screw up. If you BYPASS the hard drive can't you use the same method to crack Linux, OSX or anything else? Wouldn't it just have different variations on the same code? Especially considering that most PC's run VERY similar hardware at this point (Intel processors etc.) I could see this being something that would affect everyone - they are simply pinpointing Windows 7 because it is the "latest and greatest" (they did the same when Vista came out.)
3. EVERY piece of software has the potential to have bugs and hacks. Even if Windows 7 alone couldn't POSSIBLY be hacked...any company that wrote software to connect to the internet would be potentially dangerous. Online gaming, chatting, pictures....all that stuff is potential danger.
There were computer viruses before the internet even existed. Security is going to be an on going issue for ALL software all the time. It is just such a tedious process to code, I wouldn't DREAM of asking Microsoft to release an OS with no flaws. It simply isn't possible or realistic. If Linux became the dominant OS people would learn to hack it too...its just the way things work. Windows 7 is fabulous so far (typing from build 7000 right now). It far exceeds Vista both in ease of use, performance, and just overall "snazziness" so don't take this as a setback by any means
True true but this nicely prevent the obligatory balmer announcement that goes: 'this is the most secure windows ever'.
Followed by apple fanbois comments and the 'discovery' that it can still be hacked.
This is dumb, as a few posters have alluded to, if someone is sitting at your computer who wants to get into it, the odds are they can find a way to do it.
And speaking of the command line trick for the Mac, I tried to do that to my roommate once, and it didn't work. (I did something wrong). So I restarted his computer and was going to let it hang at the sign in screen so that he didn't know I was on it, and it just bypassed the screen and signed in, even though if I logged out I'd need a pass to get back in. I think that's a flaw lmao.
Auto-login is turned off by default, so that particular "vulnerability" is more or less your friend's fault because he consciously decided he wanted it to skip asking for a password. TweakUI gives you the same option in Windows, IIRC. If I had my druthers, System Preferences would idiot-proof that option a little by at least presenting a warning; not everyone will realize the glaringly obvious, as 20+ years' worth of computer history will attest to.
Microsoft needs to find a way to fix the fixable first.
oh no a person sitting at my computer is going to control my computer help me microsoft!!!
Oh my god with physical access and the ability to insert code into the boot chain I can compromise Windows 7!111 - You can compromise any current OS on the planet this way - this isn't at all special.
The only way a boot exploit of this sort could be special is if it compromises "Secure Boot" (which putzes around with hypervisors and TPM) enough to recover encrypted BitLocker files without any passwords. Now that might be some kind of vulnerability. But this doesn't do that.
I'm unclear on why this is just a Windows 7 problem... if the HDD is bypassed entirely, doesn't the problem impact just about ANY operating system?
This is dumb if you had physical access to the pc youy can just take the hdd and walk away with it.
This seems like a non-story to me. Anyone could easily hack the pentagon, the white house or the CIA's computers if you had direct access to one of their computers, even if it wasn't running Windows 7...
I don't get why this couldn't be done remotely? Seems simple enough. How do RAM drives work when rebooted? Cached, but once it it up and running, then it goes back to the RAM. Further the item could just be "patched" into the system.
based on the picture i thought the hack was that you could move the widgets around the desktop and microsoft could do nothing about it.
Sheesh, talk about your amateur reporting. Physical access required? Way to spread the FUD engadget. Any OS would be susceptible to this sort of attack.
This is nothing more than a rootkit that has to be installed with the box in front of you. In other words, no big deal. You guys should be ashamed for giving it any level of press.
UPDATE: The site this news came from: an Apple fansite. No shit. Please stop spreading FUD engadget. All OSes are vulnerable to this type of attack. Prevention is easy: don't give people physical access to your computer.
A more honorable way to get someone's passwords would be to give them some scopolomine. :)
http://www.youtube.com/watch?v=Id_kGL3M5Cg
Nuff said
I think when they rename this operating system, there is only one name to use:
Windows God_Dammit! v 1.0.
Then start naming versions from there.
My eyes fell out from the lameness
i smell BS...unfixable my arse!
they said macs couldnt be haxed to run on pc..now look where we are at