Hack into a Windows PC - no password needed

Mangelwurzel said:
Yep that's right, just as booting with a live linux CD bypasses windows user account passwords, giving instant access to all windows drives/partitions. Which also works on vista as well. I've tried it!
Click to expand...

You said that.

But this exploit is nothing like booting up a linux boot cd and bypassing local passwords.

This exploit lets you unlock a windows PC. We're talking computers on domains etc. Something that prior to this was (to the best of my knowledge) not possible!

=/ Absolutely ridiculous exploit and I still can't believe it hasn't been sorted already.





anyway on topic..

Seen around a few "certain" forums that vista pc's just BSOD if you try this? Suppose thats an improvement if its true!
 
allllec said:
You said that.

But this exploit is nothing like booting up a linux boot cd and bypassing local passwords.
Click to expand...

I was merely pointing out that it bypasses the password, as a live cd does, not that the methods were the same. If his method couldn't bypass the password, it wouldn't get in. Maybe you missed the title on that page? it was: "Hack into a Windows PC - no password needed" So I wasn't as you put it 'missing the point', just making a different one.

I'm still at a loss as to where your comment came from, maybe you just like stirring people up? Or maybe you think no one else knows the difference between a firewire cable and a live linux cd?
 
All I was doing was pointing out the fact this exploit is nothing like using a live cd. Don't worry about it - Was more tounge in cheek than serious. :cool:

ta

alec
 
allllec said:
You said that.

But this exploit is nothing like booting up a linux boot cd and bypassing local passwords.

This exploit lets you unlock a windows PC. We're talking computers on domains etc. Something that prior to this was (to the best of my knowledge) not possible!

=/ Absolutely ridiculous exploit and I still can't believe it hasn't been sorted already.
Click to expand...

The problem is that memory access is part of the firewire specs, so you can't just shut that side off.

It's also worth noting that this exploit can't elevate privileges which is going to limit it's usefulness, and requires direct, unsupervised access to the PC...

anyway on topic..

Seen around a few "certain" forums that vista pc's just BSOD if you try this? Suppose thats an improvement if its true!
Click to expand...

Wouldn't surprise me, Vista is a lot more secure than XP, and allows a lot less user stupidity to affect that security.
 
Dolph said:
The problem is that memory access is part of the firewire specs, so you can't just shut that side off.

It's also worth noting that this exploit can't elevate privileges which is going to limit it's usefulness, and requires direct, unsupervised access to the PC...



Wouldn't surprise me, Vista is a lot more secure than XP, and allows a lot less user stupidity to affect that security.
Click to expand...

Yeah read that in the link - Memory access okay whatever but being allowed to modify parts of the memory as crucial as this? Still baffles me why anything other than the kernel and CERTAIN drivers has permission to do that when the systems in a "locked" state.



Yeah, I would expect and hope vista to not be as vulnerable.

Still not sure if the BSOD is from the fact that the exploit is slightly difference in Vista and its just rewriting some memory that's causing a BSOD or if the Kernel is detecting its being modified and BSODing itself, hopefully the latter.

Either way I'm still amazed that something relatively simple like this works.
 
hopefully clear it up a bit..

Firewire and USB may seem similar (both data buses for connecting peripherals), but firewire is based on an expansion bus model, similar to PCI etc, this means it has DMA access. So.. All you need do, as this exploit shows, is trick the OS into thinking you're a device which requires DMA access and you can read/write to RAM at your will. This example shows unlocking a desktop or dumping the SAM but many other things are possible. This is (apparently) the 1st demo on Windows, but its been a tested exploit on OS X/Linux for a while now. Also, it has been tested on Vista with some tweaking. You can't just fix it as its a core feature of firewire
 
allllec said:
Yeah read that in the link - Memory access okay whatever but being allowed to modify parts of the memory as crucial as this? Still baffles me why anything other than the kernel and CERTAIN drivers has permission to do that when the systems in a "locked" state.
Click to expand...

The point with firewire was that the appliance can access the memory on a read-write basis without involving the OS, that's the way it was designed (and not by MS). What was missing was some sort of OS detection to realise this had occured, or that part of the windows code had been modified.

Yeah, I would expect and hope vista to not be as vulnerable.

Still not sure if the BSOD is from the fact that the exploit is slightly difference in Vista and its just rewriting some memory that's causing a BSOD or if the Kernel is detecting its being modified and BSODing itself, hopefully the latter.

Either way I'm still amazed that something relatively simple like this works.
Click to expand...

It's the problem with creating standards that allow people to do things that seem like a good idea, but essentially rely on goodwill not to exploit.
 
Also interesting, he mentions at the end of his paper that there's a Wireless Firewire standard in the pipeline, so then you wont even need the firewire cable ;)
 
Where is the documentation of this "vista" BSOD? No-ones posted anything to do with this, only that its not been properly tested. It wouldn't surprise me if this still worked with vista too...
 
LeperousDust said:
Where is the documentation of this "vista" BSOD? No-ones posted anything to do with this, only that its not been properly tested. It wouldn't surprise me if this still worked with vista too...
Click to expand...

It would surprise me, because vista is a lot more aware of itself than XP ever was in security terms. Just because it looks the same, it doesn't follow that it works the same.
 
allllec said:
And why exactly does windows still let a firewire driver read/write to the memory, specificially parts of the operating system like this? =/

He demonstrated it in 2006! common Microsoft!
Click to expand...

its to do with the firewire connection apparently

the same exploit allows full read/write access to RAM in OSX too aparently.
 
LeperousDust said:
But as mentioned its a problem with the specification, rather than the OS itself?
Click to expand...

It's a combination of the two. The specification allows the firewire device direct memory access which is what allows it to rewrite the memory location. However, it can be addressed by making the OS aware of this possibility, not so much in terms of looking for this specific exploit, but in monitoring the general integrity of the memory contents, or by making the location of the code to be overwritten random. (Vista does this anyway source

As has already been said, the same exploit works on MacOS and Linux machines, so if Vista has managed to stop it (even if just by BSOD'ing) then it's definite progress.
 
You must log in or register to reply here.
Back
Top Bottom