Vista Hacking Challenge Answered 388
debiansid writes "Microsoft's most secure Operating System yet
has been compromised at the Black Hat hacker conference. We all know that Andrew Cushman, Microsoft's director of security outreach invited the Black Hats over to touch and feel Vista in order to showcase the superiority of this OS. Joanna Rutkowska, from Coseinc, a Singapore-based security firm, obliged and showed how it is possible to bypass security measures in Vista that prevents unsigned code from running with the help of a little software she calls the 'Blue Pill.'" To be fair, the hack was possible only when the target is in administrator mode rather than a limited user account.
Only works as an administrator but... (Score:5, Insightful)
Ok, so the machine was in Admin mode... (Score:4, Insightful)
Hypocrites (Score:3, Insightful)
And no, before you ask, I am not a windows user, I am on a Mac PowerBook G4. I prefer the mac because it is easier to use and I am not a gamer, not because of some imagined speed or innate security edge over every possible windows product.
Re:Would they tell anyway? (Score:3, Insightful)
Most of these people at the blackhat con aren't of ill intent, though. They're just hackers who won't let microsofts convenience get in the way of their fun.
Besides, with Microsofts history, I'd say it's pretty unlikely this hole will be patched if vista comes out before 2008. They certainly didn't patch any other verison of windows with that kind of speed.
Re:Only works as an administrator but... (Score:3, Insightful)
To be fair to MS (Score:5, Insightful)
Microsoft doesn't care about impressing Linux users, they care about releasing something that A LOT of normal users can install and forget about. Every iteration they get more stuff right, and their operating system becomes better (except ME, that sucked dick).
Re:Hypocrites (Score:4, Insightful)
Now if that's a security issue, then I guess rm -rf / is an enormous security hole on Unix systems
Blue Pill seems insincere (Score:4, Insightful)
Seems to me this 'hack' gets the cart before the horse. If you are able to run malicious software in administrator mode, you can do anything at all, not just compromise signed code authorization. Heck you could replace the whole OS. The point of security is to prevent unknown persons from being able to run malicious software in the first place.
Re:Ok, so the machine was in Admin mode... (Score:4, Insightful)
I've had accounts on POSIX-compliant systems for years. I've found that with only user-level access I'm quite able to compile or install applications for my own user account in my own home directory without much difficulty, and still maintain the system integrity. As long as Microsoft holds on to the registry they'll never achieve such.
Re:Only works as an administrator but... (Score:5, Insightful)
Short term administrator usage to install a driver isn't that big of a threat. The real problem will be legacy applications that won't run without administrator priviledges. That's what keeps most people from running everything as a user.
Re:Hypocrites (Score:2, Insightful)
These kinds of contests don't work. (Score:3, Insightful)
The only case where they DO work is when you're asking people to crack encryption, and then it's only CRACKING it that proves something, saying that noone could crack it doesn't mean it's uncrackable.
Re:question (Score:5, Insightful)
That depends on how many legacy programs require Administrator priveleges to even run. (Hint: a lot)
Re:Only works as an administrator but... (Score:5, Insightful)
You shouldnt be allowed to say "NT/2k/Xp compatible" if your software cant correctly handle user permissions.
Re:Only works as an administrator but... (Score:3, Insightful)
Yes it's a great way to alert a knowledgable user that some background process may be playing where it doesn't belong but I still see thousands of end users blindly clicking "Continue" as with the old Active X warnings.
I think MS has made some great strides in this area. But they're going to have to "innovate" a lot more then this to solve the clueless user problem.
Re:Would they tell anyway? (Score:5, Insightful)
This is not just a matter of losing face. If the Windows team blows the revised date by several months (say April or later) AND it ships what is considered to be a lackluster product, many people will start considering the Windows codebase as a sustaining mode project. They will assume that Microsoft is busy preparing a brand new code base (based on FreeBSD plus
Re:Only works as an administrator but... (Score:3, Insightful)
There's a point where you have to blame people for their own actions. That's roughly at the point where they start making explicit choices based on available information. Anything more, and the OS (or any other program) just starts becoming useless under the weight of handholding and artificial restrictions.
About the only thing I could see worth adding (if it isn't already... I haven't kept up on the Vista betas) is some sort of good central logging function, so when people like you 'n' I get called in to decraptivate the machine, there's a way we can look and go "Here. This is the point at which you were an idiot. Don't do this again."
Re:freeware? (Score:3, Insightful)
Re:Only works as an administrator but... (Score:2, Insightful)
Re:That is not Microsoft's fault (well, not really (Score:2, Insightful)
Re:Hypocrites (Score:2, Insightful)
Wow! That's so insightful! With that conditional, you could replace "Microsoft" with any OS and still be correct! ;)
I think I'll stick with what gives me the most flexibility, easiest installation of the tools I want, guaranteed free updates, access to the source code, has been relatively easily secured more or less since inception, and all at the lowest initial cost. That's what works best for me and that's what I support for family and friends (a group that keeps growing as people become more and more frustrated with MS Windows). You may not agree with these points *from your perspective* but that's my experience and thus my opinion.
But I fully support your right to choose the system you want.
Re:Ok, so the machine was in Admin mode... (Score:5, Insightful)
Bingo.
I've tried, I've tried so hard to get my family to run using user-level accounts. It doesn't work. I don't live with them, so at least one needs an account with Admin rights. The others get the password (usually by asking), and then reelevate themselves. They aren't doing it to spite me. When some games won't run without admin, they can't burn CDs, so forth, they will find a way to make it work. Security? What's that? They don't care. If they can't play games, or burn CDs, they don't care about security.
I know it is nice and easy to blame developers. True, they should do better. Heck, the first two release versions of my software didn't run properly as a user under Windows either (be gentle, I didn't have XP then). But if you want developers to behave, it has to cost them if they don't. The admin-by-default situation in Windows is ludicrous. They took a step in the right direction with user accounts in XP, but with the default installation forcing the first user account to be admin, and then not letting you de-admin the account, makes the step almost pointless.
When default users run as an ordinary user with a pretty graphical sudo, and the OS blocks running apps as administrator without some sort of painful confirmation process (eg. whitelist), and developers have access to decent commandline or API sudo and security equivalents, then developers will behave and make damn sure their app runs as an ordinary user.
Legacy apps will break unless some sort of layer is put in to make it look like the app does have arbitrary permissions to do fun stuff like write into its installation directory or the top level of a drive. I've heard Vista does some of this funky stuff (I'd check if the a__holes at Microsoft actually let me get their beta version of Vista- another story), which I hope is true.
Microsoft got themselves into this mess and they have nobody to blame but themselves (despite the way they love to blame third parties for their sloppy OS). They can dig their way out if they choose. It won't be easy, but give them a decade and they'll be where Unix was a decade ago.
Personally I'm not too stressed one way or the other. I don't use Windows unless I absolutely must, and whilst it is a worm-ridden crash-prone security nightmare it does mean there will be work available to clean up the mess. The target market of my software mostly runs on Windows though, so I do have to keep aware of what is going on. It would be nice if they cleaned up their act, as it makes my work easier.
Re:Would they tell anyway? (Score:4, Insightful)
Re:Not only does it have to be in admin mode... (Score:2, Insightful)
Aren't windows users trained to click yes? If you try to do anything, you are often slammed with warning boxes, confirm boxes, software license agreement boxes, reboot request boxes, etc. And I hear that vista is even worse in this regards. You get trained to click through them as fast as possible if you actually want to get anything done. The fact you click on that one out of a thousand that actually is malicious shouldn't be a surprise.
Re:Would they tell anyway? (Score:3, Insightful)
There's also the description on her blog [blogspot.com], which states, "I would like to make it clear, that the Blue Pill technology does not rely on any bug of the underlying operating system. I have implemented a working prototype for Vista x64, but I see no reasons why it should not be possible to port it to other operating systems, like Linux or BSD which can be run on x64 platform."
If you paid attention, you'd realize the real issue is that this enables malware that cannot be detected, even when the algorithm it uses is known.