Researchers demonstrate "unfixable" Windows 7 exploit

By on April 24, 2009, 5:59 PM
Researchers at a recent hackers' conference in Dubai have demonstrated what they claim is an unfixable exploit for Microsoft’s upcoming operating system. Apparently, they've found a way to gain control of a Windows 7 machine during the boot up process though the use of a tiny 3KB program dubbed VBootkit 2.0. Since no data is altered on the drive itself, it is hard to detect and of course even harder to remove.

Once loaded, an attacker could potentially change passwords, access protected files, or do just about anything else remotely and then leave without a trace. Unlike most exploits out there, VBootkit 2.0 can't be installed remotely, so an attacker would need physical access to a machine in order to compromise it. Moreover, rebooting the computer gets rid of the security threat, as system memory is cleared during the process.

Its severity is debatable, then, considering it can’t automatically spread through the web. However, it could be a concern for businesses and people using computers in public places. Microsoft hasn't commented on the exploit, but its creators say the problem stems from Windows 7’s assumption that the boot process is immune from attacks. It’s a design problem, they claim, one that cannot ever be fixed.




User Comments: 7

Got something to say? Post a comment
PanicX said:
Requiring physical access to the machine makes this hardly interesting.
windmill007 said:
^^^^ Agree . If you have physical access I'm sure you could install lots of interesting stuff.
ElShotte said:
Yeah, not to mention the fact that you still have to pass a hardware firewall for most cases where it would be actually worth to try and do something like that. It is a very big security problem indeed. Someone that would actually be good enough to hack into one's computer, such as the original creator of the network or a network admin. You have access to the physical address of the computer, heck, you can even leave a backdoor open in the firewall, and be able to use the exploit to get into the client's PC.
JDoors said:
"Since no data is altered on the drive itself, it is hard to detect and of course even harder to remove."So, where does the exploit reside, exactly?Is this a "new" way to exploit a new version of Windows, or have all computers been vulnerable to this, like, forever?Are we running out of REAL exploits? (Wouldn't THAT be grand!)
anguis said:
JDoors, the exploit resides in the system's RAM. That is why on reboot it is essentially fixed, since the memory is dumped.
tengeta said:
This is like that cache exploit for Linux, you have to be there...and at that point you lost anyways.
JDoors said:
anguis, so it HAS to be loaded directly into RAM via an external source such as a thumbdrive? I'm not sure I'm gettin' how, or to be specific, WHEN, it gets into RAM. In the middle of the Windows boot process, Windows looks for external data and will load it into RAM? Now THAT sounds like a flaw to me.And a reboot wouldn't clear the data if the external source was still attached, right?
Load all comments...

Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.