Windows 7 WGA hacked

If Microsoft can't even secure the activation system for their supposed-flagship OS, how secure might the OS itself be?

I think people might want to look elsewhere for a free, legal OS that is secure (like maybe...Linux?).

Well the Black Hat conference showed that Windows is more secure than anything Apple is producing. My guess is that it is probably better to stick to Linux

"The hacked key can activate OEM-branded installations from Dell, HP or Lenovo."

That's actually quite an understatement. What it means is that the certs/key/BIOS info can be taken and used for ANY PC to pretend to be an offline activated OEM machine with a valid Windows 7 install. It's already out in the wild, and works because Windows 7 (like Vista before it) can't tell the difference between a real OEM machine, and one that pretends it is an OEM machine with all the correct credentials.

This is the same method used by Vista WGA cracks that are still undefeated by MS. MS can't cancel these installs without also blacklisting all the genuine customers. Even if MS were to do such a thing, the hackers will simply use the updated keys, or versions from other OEM suppliers.

It only took one comment for the Linux fanboys to come out. Surprised there's no Apple comments yet. For the record Linux doesn't need activation because its free, 'tard. As soon as the light gets turned on the niche systems, their security will be tested and cracked like Windows, but that's the point then, niche systems can't do everything Windows can (play any PC game from Best Buy right out of the case??) so they will always be relegated to the dark shadows of market share.

Download hacked windows 7 release

Enjoy your botnet

Those who say their Linux is secure....umm can I have ur IP address plz? ...all i wanna do is leave u a hello message on the desktop...i wont even delete anything. Promise.

my ip: 86.134.48.145 im a little sick of my background, but to lazy to change it.

The key was stolen and distributed from an OEM.

How does that become a hack?

are the WGA developers are Microsoft. Imagine- you spend 6 months trying to develop a scheme to keep people from stealing your software, and in a matter of weeks someone essentially trashes all your work.

I know, print a screen shot of HighHo screen changes please :)

How many applications have you ever used that haven't been cracked?

What DRM have you used that hasn't been cracked?

I'd say it's probably next to impossible to develop a copy protection scheme that can't be cracked by somebody willing to put in enough time and effort.

There is some truth to increased risk of trojans and whatnot from pirated software but it's not always the case.

You SHOULD actually pay for software if you use it. Remember the pc games industry.... the pirates pretty much killed it off, almost all that's left is online rpg's/games that can't be pirated with full functionality. If you are strongly opposed to paying for software then use linux or bsd and free software. Programmers are people too, they need to eat like everybody else.

And by cracking WGA, what does that accomplish? Microsoft will just try harder and make an even more lame, more restrictive, crappier WGA.... just makes it that much more fun for everybody else. Here's a thought, try honesty....

This has been M$ strategy for years, they keep apparent control over licenses, to keep John Doe from using pirated windows, but also leave a door open for the unwilling to pay for it, just to increase it's user base and keep these people from going linux.
It worked pretty well for the last 20 years.
If they really wanted to shut the door to piracy, they would already done it.

Microsoft knows it will be hacked within days, that's not the point of WGA. The point of WGA is to prevent illegal install by people with little computer experience. It's a little technological hurdle that prevents enough piracy to make it profitable for them.

And DRM can't work as long as the content extracting mechanism is located on the user's computer. That's why its use will eventually die out.

This "hack" is really nothing but the action of modifying your BIOS to report that it's from an OEM. When you install windows you use an OEM key. I would hardly call that a hack to WGA. It's a fundamental limitation of WGA, not a hack. You won't find me doing manual edits to my BIOS though.

This is a crack, not a hack. And to answer all Linfants - yes it's been and can be done for Linux progs/OS too. Even the Apple OS has been cracked (to run on PCs for example). So it is neither news, nor any breach in the kernel's security...

There is no known software method to prevent this, it must include hardware blackbox device to be able to prevent such hacking.

http://tinyurl.com/l9q3l5

John, I understand what your saying but you do know that with a few configurations and permission changes I know for a fact that a Linux system can be made so much more secure then windows or Mac OSX. Out-of-the-Box Configs like say Ubuntu are by default way more secure then Windows has and will ever be.

Hack-a-Day competition last year showed that Ubuntu was the only one left standing after the competition was done. It was Vista, Mac OSX and Ubuntu in the competition so dude you do have a point that nothing is unhackable but any person that lives in reality basically thinks that linux is more secure by default.... and they are right it is and always be more secure because the code is visible by all and it is more scrutinized then any other code developed behind closed doors.

It's ironic that most people believe the exact opposite. Security through obscurity is the worst approach since someone may have stumbled upon a undocumented hole and well if they are of a evil inclination then they will keep it to them self and it may be months even years before someone else knows about it during this time this person can hack and not be stopped by anyone.

The most secure environments use linux more often these days to secure their environments. Next time the Canadian public has their mandatory census done by the government I dare you to even get through the first 3 FW's I doubt you will.... they are all hardened linux boxes dude, good luck.

BTW I triple dare you to hack CentOS... and I'll even give you 6 months to prove you did.... good luck.

There's so much FUD going around on this, it's not funny.

No one cracked Microsoft's protection system. Microsoft SLP system relies on a encrypted certificate on the disc that matches an encrypted string in the BIOS. However, if you are able to discern that string, you can write it on any BIOS you wish, and that disc will work and activate on that system. Keeps people from needing to type in a key for their OEM system.

What happened was that the string that Lenovo was given was leaked. So now you can flash your BIOS with the string, install from a Lenovo disc, and it will work, Genuine Advantage or not.

Most likely what will happen is that Lenovo's key will be revoked at some point, and these systems will no longer work.

@John's comment, I'm still trying to figure out:

A) Who said anything about Linux needing activation so far in these comments, and thus:

B) Who the 'tard is in this equation.

(Also, there was an Apple reference in the second post. I'll have what you're drinking, John...)

You people talking about modifying your BIOS don't have the full story. This method works on both modified and unmodified BIOSes - you don't have to mess with your BIOS. It just uses a bootloader to load a BIOS emulator that tells Windows 7 that it is talking to an authentic OEM machine.

MS can't revoke these keys without also killing all the genuine Lenovo customer installations, and then the crackers will simply use the new keys, or the keys from any other OEM install.

That would be a big inconvenience for Lenovo and it's many customers, and the MS support lines, but would be a slight and temporary inconvenience for the hackers.

You may argue that these guys haven't broken the Win 7 protection, but they've certainly managed to effectively fake the OEM path (they are not supposed to have access to) in order to produce fully activated Win 7 installations.

Instead of breaking through the heavy front door, the hackers have lifted the OEM flowerpot and used the OEM spare key to waltz straight through the front door.

User Jaz said it perfectly.

You do NOT have to own a lenovo laptop or a PC with a modified BIOS to apply the crack. In plain words, you do NOT need to modify any part of your hardware or BIOS to do the trick.

You can always emulate the lenovo BIOS and trick Windows Seven into thinking it's running in a lenovo machine, while it doesn't. Then Windows will authenticate itself offline, or in other words, cracked. For now.

- We all known how it goes: Pirates will receive their short thrill, then microsoft is going to revoke those lenovo keys and have the legal owners authenticate once again, "for their convinience". Hence, the crack will be useless after a couple of months.

Microsoft has a long, long history of distributing newer and improved versions of their WGA software as "critical updates" through Windows Update, so I do not see why this case will be any different. It won't.

THE ONLY WAY to get free windows is through an MSDN license. MDSN licences are given away like discount vounchers in computer science universities, so if you are a student of those enstablishments (like I am) or know someone who is, you can get a LEGAL Windows key for free. Generally, try to find a leaked legal key. It's the best way.
All the other illegal methods will bust sooner or later if you want to keep your Windows updated. And with all those security holes, you 'll want to, it's almost as they were put there on purpose. Almost.

..Microsoft have never revoked a leaked OEM key, not for XP, and not for Vista. I don't think they will do it for Win 7. even though the exact same crack is in use for Vista. In fact, this crack is just an updated Vista crack with the newer certs/keys. MS couldn't stop it on Vista, and they can't stop it on Win 7.

Revoking keys would cause massive problems for the OEM's customers (of whom there could be millions of), whilst having very little impact on the crackers.Hackers would simply slot in the new keys or use keys from a different OEM.

While the OEM path is part of the WGA system, it can always be accessed. There's no choice but to have the OEM path because no company can install and authorize individual keys thousands of times a day.

It's the design and requirements of the WGA system that leaves a weakness that is the problem.

I don't understand why big companies even try to implement measures against piracy as everyone of them gets broken.

I would invest more money in making an attractive service that people would want to use and buy.

Why the f**k have this news been blatantly ignored??:

http://arstechnica.com/microsoft/news/2009/07/eu-vista-xp-users-will-also-get-to-vote-ie-off-the-island.ars

I can't believe it, this site is totally pro-microsoft after all!!
Feh..!!

Totally agree with db - security through obscurity is a horrible concept. Not only do people discover the security flaws and keep them to themselves, they also can sell them to the highest bidder - be they hackers, anti-virus makers, or both.

If you think it doesn't happen, get real. That is the true reason Linux will always be more secure than Mac and MS OS's - Linux is constantly scrutinized, where as Mac and MS do it behind closed doors, and backroom deals.

I don't care if they hack Linux, I didn't pay for it...

And I have my own means to secure my data anyway. What else do I have to worry about? Anything else is as bad as another reformat and reinstall. And I won't even have to be bothered with another activation. That's Linux!

But if you leave your sensitive files in your HD like your grandma also does, they you should buy a very expensive OS.

Then at least you can pretend to be safe.

The ONLY program that I ever actually paid for was somewhere back in 1985. It was called COPYII-PC. It gave you the ability to make 'backups' of your 'copy protected' LOTUS123 disks. I believe in the Grateful Dead model of distribution.
Once it's out there . . it belongs to everyone. As far as Windows 7 goes - It's just Vista for Dummies. Nice try MS.

Hello, an update about windows 7, there's a new hack going-on. Now, hackers found a way to bypass the product key activation. Microsoft has been notified but no actions were seen from the tech company.
a href="http://bit.ly/windows7-hacked" / http://bit.ly/windows7-hacked /a