Windows 7 bootkit released
INSECURITY RESEARCHERS in India have released a proof-of-concept bootkit that can be used by an attacker to gain stealthy control of Windows 7 systems.
The software, called Vbootkit 2.0, was revealed last month at the Hack In The Box computer insecurity conference in Dubai. At the time, developers Vipin Kumar and Nitin Kumar had said they wouldn't publicly release the code lest it be misused.
They've since changed their minds and have released Vbootkit 2.0 under an open sauce licence, according to PC World. They said their reason for releasing the proof-of-concept attack was to encourage security researchers to develop defences against the technique used.
"All we are trying to do is help more people understand the real enemy, malware, so new innovations can occur," Vipin Kumar wrote in an email.
Vbootkit 2.0 can be foiled by using Bitlocker hard drive encryption and a Trusted Platform module, but many Windows 7 capable PCs don't have those features.
Microsoft doesn't consider it a serious threat to Windows 7 because it doesn't enable a remote attack.
However, a malware writer might modify the Vbootkit 2.0 code to turn it into a remote attack tool as has been done with other bootkit software in the past.
Since it might be months before Windows 7 is released by Microsoft, it sounds possible that the Vole's next big thing might hit the streets with malware ready and waiting to greet it. µ
Share this:
ShareBusiness Intelligence Software
Customer Relationship Management (CRM)
Enterprise Accounting Software
Enterprise Resource Planning (ERP)
Enterprise Systems Management
ZOMG!!!! It's amaaaaazing how vulnerable a personal computer becomes granted *physical* access. BTW, April the 23rd rang asking for it's "news" back.
Nothing new here, physical access is always insecure. That's why buildings have security guards and doors have locks.
It's not just Windows 7, it's about every system ever released. Check "Kon-boot", which is already available and can be used on most of the Windows releases and on some Linux distros as well.
Not only this is not "new" (it's been around for a while), but also: if someone gains phisical access to a computer, there are other, much serious dangers such as... a) the attacker may open the safe and steal the family jewels ... or b) ties your hands and feet, wraps your mouth with duck tape and abuses you.... or c) since the bottom line is getting control of your computer, he puts it in the backpack and takes it away....
Not to mention what the attacker may do to your fridge....
...people still send their bank account numbers to Nigeria. It has been years since we have crossed the point where stupidity now overrules security, and yet it still makes headlines. Banks and governments get hacked due to nitwits and novices setting the password to "pa$$w0rd" or leaving the server room door unlocked when they go to lunch. People's credit card numbers get stolen by replying to fake websites or someone reading their unshredded mail they put in the trash. Computers get turned into 'zombies' from downloading that video/song from who-knows-where and 'installing' it instead of playing it. You'd like to think people aren't that stupid, but they are. PEBDAK will trump Symantec any day.
Hey software vendor, we're a 'security company' and we found a vulnerability in your software. But we won't pass it around...for now.
What, you didn't decide to 'invest' in our company or fund our 'research'? Well, since we can't make money from you on the flaw we found, we'll give it away to the world and make you spend shedloads of money to fix the problem. Next time, you'll pay up, chump!
Is it ok as long as they are doing it to M$?
This is not a "Windows" or "Microsoft" specific thing.
ANY system is vulnerable to a cold-boot attack if you have physical access.
DUCT tape - as in sealing joins on air-conditioning ducting.
DUCK tape - I'm yet to see a practical use for applying tape to a duck.
Use full disc encryption
DUCK tape is actually a brand of DUCT tape.
I think if they've got physical access to the equipment, the following applies:
http://xkcd.com/538/
Sorry Jim, Wrong Answer.
Disk Encryption is a doddle to break, and all of them have been broken.
The Black Hat people made a big song & dance about being able to break MS Bitlocker with little difficulty, and then pointed out they could do the same for any encryption system.
Facts are, that with physical access, you cannot stop someone taking the data... best you can hope to do is deter the script-kiddies and slow down the serious hackers... but if someone really wants to, and knows how to, they will get it.
It doesn't matter if it's Windows, Linux, OS/X, whatever.
open sauce licence lol
You cannot break Full Disc Encryption if the key is never in the RAM...
So use hardware Full Disc Encryption
That doesn't protect you against thugs with drugs and wrenches.
Scenario:
-Boot Your machine only in secure enviroment. (Key card is need for boot only).
-Store Your Key card only in secure enviroment.
-When thugs with drugs and wrenches arrives, they cannot extract nothing from You or from Machine.
On Windows 7 it is possible to replace any file with malware if the attacker has administrator access.
I would consider that an even great security issue than vBoot.
Be careful!
:-)