Print 53 comment(s) - last by lexluthermiest.. on Mar 14 at 3:11 PM

New Zealand hacker releases source code to utility that reads password directly from memory

Exploiting a little known feature built into Firewire port specifications, Adam Boileau released the source code to a utility authored in 2006 that allows anyone to bypass the Windows Authentication dialog box on any PC with a Firewire port.

The tool is a simple, 200-line script written in the Python programming language exploits features built into Firewire that allow direct access to a computer’s memory.  By targeting specific places that Windows consistently stores its vital authentication functions, Boileau’s tool is able to overwrite Windows’ secured code with patches that skip Windows’ password check entirely.

Boileau says he decided to release the script now, two years after it was initially unveiled, because Microsoft had not acted to patch the vulnerability. Boileau considers his tool a “party-trick demo script thats been lying around my [home folder] for two years gathering dust,” and considers it “a pity to write code and have no one use it.”

“Besides,” says Boileau, “according to Microsoft's definition, it never was a Security Vulnerability anyway – screensavers and login prompts are … about the Feeling of Security.”

Boileau also notes that he’s seen others successfully modify the script to hack Windows Vista’s password-check code, as well as use a laptop’s PCMCIA port to plug in a Firewire card and attack the laptop after Windows auto-installed the card’s drivers.

It’s important to note that Firewire’s provisions for direct memory access, called DMA, are useful in other contexts, like in the use of software debuggers. Nowadays, a sizable percentage of the world’s software checks for the presence of programs monitoring memory directly – which is what a debugger does – and will frequently act differently or refuse to start up if it detects their presence.

Firewire ports are therefore usable as high-speed debugging devices, allowing developers and hackers alike to passively monitor anywhere in a computer’s memory and make changes where needed, whether its reprogramming a password check or seeding buggy software with correct data. It might also allow forensic investigators to grab an encrypted hard drive’s decryption key directly from memory, while the computer is running.

Also important is that the same technique has been known to work on other operating systems, including Mac OS X and Linux – and in fact some people have used modified iPods to run Firewire DMA attacks on the fly.

Common security thought dictates that a computer is essentially lost if it is in your opponent’s possession, and that security on a physical machine will be subverted with time: for computers equipped with Firewire, the thought couldn’t be more true.

Comments     Threshold

This article is over a month old, voting and posting comments is disabled

RE: sigh
By eman7613 on 3/8/2008 12:16:11 AM , Rating: 2
actualy, if its a laptop reseting the cmos wont do anything, although bying a new bios chip and switching them out will.

RE: sigh
By zshift on 3/8/2008 10:30:08 AM , Rating: 2
actually, thats not completely true. I work at best buy and we had a customer that returned a laptop because it "didn't work." turns out they apparently forgot their bios password, so i opened the laptop and reset the cmos and low and behold: the boot password was gone.

RE: sigh
By falacy on 3/8/2008 10:35:50 AM , Rating: 2
Then it wasn't a Toshiba.

Stinking Toshiba had to be tough on that sort of thing by installing a secondary IC that store the password, but doesn't come with a reset feature. Replacing the IC fixes the issue, but it's a surface mount IC and it's teeny tiny!

RE: sigh
By mindless1 on 3/8/2008 9:50:28 PM , Rating: 2
There's bound to be a way it can be done, they'd leave a backdoor long before having to desolder surface mounted PROMs just to wipe a password (for their own benefit even if they don't care about the owner).

RE: sigh
By Korvon on 3/9/2008 2:08:03 PM , Rating: 2
There are back doors to most every laptop. Older toshibas BIOS password can be bypassed by making a loopback on the parallel port. Several manufacturers have passwords that will bypass whatever you put in just in case you forget yours and call support. :P

RE: sigh
By kextyn on 3/8/2008 8:11:48 PM , Rating: 2
It depends on the laptop. But many of them store the passwords in a seperate chip now that would require some physical hacking to read the chip or replacement of the motherboard. Try getting into a Thinkpad that has all of the IBM/Windows standard passwords set (power on, bios supervisor, hard drive, etc.)

RE: sigh
By Samus on 3/9/2008 2:18:07 PM , Rating: 3
IBM Security Chips fix this. Among many other things, they monitor the memory space windows stores passwords in for phishing utilities like this script.

"A politician stumbles over himself... Then they pick it out. They edit it. He runs the clip, and then he makes a funny face, and the whole audience has a Pavlovian response." -- Joe Scarborough on John Stewart over Jim Cramer

Copyright 2016 DailyTech LLC. - RSS Feed | Advertise | About Us | Ethics | FAQ | Terms, Conditions & Privacy Information | Kristopher Kubicki