Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

3/5/2008
06:45 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Tool Physically Hacks Windows

Lets an attacker use Firewire to take over a 'locked' Windows machine

No screwdriver required: A researcher has released a plug-and-go physical hacking tool that uses a Firewire cable to “own” a Windows machine within seconds.

Winlockpwn, originally built two years ago, bypasses Windows’s authentication system and lets an attacker take over a “locked” Windows machine without even stealing its password. Adam Boileau, a researcher with Immunity Inc., says he decided it was finally time to make his tool publicly available. (See 'Cold Boot' Attack Tool Surfaces.)

Similar Firewire hacks have been demonstrated on Linux and OS X as well.

With Winlockpwn, the attacker connects a Linux machine to the Firewire port on the victim’s machine. The attacker then gets full read-and-write memory access and the tool deactivates Windows’s password protection that resides in local memory. Then he or she has carte blanche to steal passwords or drop rootkits and keyloggers onto the machine.

“This is just a party-trick demo script thats been lying around my homedir for two years gathering dust,” Boileau blogged this week. “I'm not releasing this because Microsoft didn't respond (they did; it’s not a bug, it's a feature, we all know this). It just seemed topical, with the RAM-freezing thing, and it's a pity to write code and have no one use it.”

Firewire’s abuse should come as no surprise, security experts say. The peripheral bus connection technology lets you read and write to memory, so the weakness is not a true vulnerability, but a feature of the technology.

“That Firewire port is, as designed, literally there to let you plug things into your laptop memory banks,” says Thomas Ptacek, principal with Matasano Security. “When you think of Firewire, you really should just think of a cable coming directly out of your system's DRAM banks. That's basically all Firewire is.”

Ptacek says this tool raises the bar in physical hacking. “People think about physical hacking as something you have to do with a screwdriver and 20 minutes, under cover of darkness. Attacks like Adam's can be done in the time it takes you to pick up a sheet of paper off the office printer,” he says.

Not all machines have Firewire ports, of course, but other researchers have already found ways to get around that, using a PCMCIA Firewire card. (See No Firewire for Hack? No Problem.) And Vista is not immune to such an attack, either: Austrian research firm SEC Consult had previously written a proof of concept for Windows Vista that disables password authentication in the default login routine, so the attacker can log in with an arbitrary password, according to the researchers.

Ptacek says the best defense is to disable Firewire. “I think that enterprises who care about security should make sure they don't issue laptops with enabled Firewire ports,” he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • Immunity Inc.
  • Matasano Security LLC

    Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    US Turning Up the Heat on North Korea's Cyber Threat Operations
    Jai Vijayan, Contributing Writer,  9/16/2019
    MITRE Releases 2019 List of Top 25 Software Weaknesses
    Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
    Preventing PTSD and Burnout for Cybersecurity Professionals
    Craig Hinkley, CEO, WhiteHat Security,  9/16/2019
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Current Issue
    7 Threats & Disruptive Forces Changing the Face of Cybersecurity
    This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
    Flash Poll
    The State of IT Operations and Cybersecurity Operations
    The State of IT Operations and Cybersecurity Operations
    Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2019-14821
    PUBLISHED: 2019-09-19
    An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->l...
    CVE-2019-15032
    PUBLISHED: 2019-09-19
    Pydio 6.0.8 mishandles error reporting when a directory allows unauthenticated uploads, and the remote-upload option is used with the http://localhost:22 URL. The attacker can obtain sensitive information such as the name of the user who created that directory and other internal server information.
    CVE-2019-15033
    PUBLISHED: 2019-09-19
    Pydio 6.0.8 allows Authenticated SSRF during a Remote Link Feature download. An attacker can specify an intranet address in the file parameter to index.php, when sending a file to a remote server, as demonstrated by the file=http%3A%2F%2F192.168.1.2 substring.
    CVE-2019-16412
    PUBLISHED: 2019-09-19
    In goform/setSysTools on Tenda N301 wireless routers, attackers can trigger a device crash via a zero wanMTU value. (Prohibition of this zero value is only enforced within the GUI.)
    CVE-2019-16510
    PUBLISHED: 2019-09-19
    libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server/mms_server.c, as demonstrated by server_example_goose.