Hacker News Reader

Comment by runeks | Hacker News Reader

If you have physical access to the PC, why not just boot up Ubuntu, and replace the files that need replacing? No need to rely on a feature in Windows that can be disabled.

If full-disk encryption isn't used, there's really not much the underlying OS can do to prevent this.

View on HN

Lots of work/school computer has a password locked BIOS which prevents you from booting from anything else. If they also have a physical lock on the computer, or if it's a laptop that you can't open or doesn't have a bios reset functionality, or you're worried about getting caught opening the computer, you're effectively locked out.

This exploit does actually open possibilities where there were few/none before. Also I imagine it's easier for some people to execute.

This password locking is worthless - most (if not all) BIOSes have backdoor password that allows anyone to bypass password lock.

Here's one of the pages that lists some of them: http://www.uktsupport.co.uk/reference/biosp.htm

Also you could probably reset the bios in a couple minutes.

Don't even get me started on the passwords to unlock HDD's, the ones you set on the BIOS... One day I will write how I unlocked the Toshiba(TSSTCorp) HDD I had forgotten the password for on my laptop. I had to buy a new HDD, because I didn't have a spare one at the time, but I did it in less than 5 minutes, unscrewing and screwing the laptop covers and HDD's included. They weren't even the same brand. I bought a Samsung to unlock the Hitachi.

Some devices make this very difficult. Well, not very difficult - just more time consuming. I was trying to unlock a BIOS password on a Toshiba Satellite maybe 3 years ago, none of the default or "backdoor" passwords would work. However, you were able to reset it by using a jumper to complete a specific part of the circuit.. Not for the faint hearted, however if a thief steals the laptop, they'll have no problem opening it up in their own time.

I'm glad they've made this harder, as most thieves are deterred by the technical aspects of breaking in to wipe a computer.

I refuse to use lab computers on this basis. I assume they're owned and have keyloggers. I'd sooner use someone else's toothbrush.

I don't understand why more labs don't use dumb terminals to hook back into a VM that gets blown out the airlock after each and every use.

Cost and complexity of administration most likely.

Also time, our university did something like this on their library computers. It meant waiting 5min after someone logged out for it to do a system restore before the next person could log in. Which seemed like forever when you're rushing to print a paper.

It's not very hard to build a keylogger using basic pic chips and install them into a keyboard. The same could be done against a dumb terminal. For bonus points, put a bluetooth module / picoduino inside so that you can read out people's keystrokes without touching it again.

Physical-access always means "game over" unless full-disk encryption is used.

In this case FDE won't help, right? As the OS already can read the hard drive during the repair phase (or otherwise can't get that far).

It looks like you can only launch the repair once you have decrypted the hard drive [1].

[1] http://answers.microsoft.com/en-us/windows/forum/windows_7-s...

You can do a entire dump of the HD while its turned on and save it to a backup. Then you can restore the backup back to the initial HD

Could you link some kind of a guide about what should be changed from a Live CD/USB?

According to step 7 and 8, you only need to create a copy of the cmd binary and name it sethc.

Here's a 'guide' from 2012 http://carnal0wnage.attackresearch.com/2012/04/privilege-esc...

And here's a 'fix' from microsoft: https://social.technet.microsoft.com/Forums/windows/en-US/a3...

It doesn't need fixing, it is working as intended.

If you can alter one system file then you can alter all system files. So even if this got "fixed," then another program would be replaced, a service, or the login screen itself.

The only actual fix is to protect the Windows installation itself, this can be accomplished through full disk encryption (e.g. Bitlocker) in combination with uEFI secure boot.

To be honest I roll my eyes when people post "exploits" like this. It just shows that people have no core understanding of computer security from the ground on up.

As an aside this exact exploit would work perfectly on a Linux (e.g. Ubunutu) system that didn't implement full disk encryption.

The clever part is getting the startup repair command prompt with no additional tools. Its similar to the old windows login bypasses (https://i.imgur.com/fqjnKh.jpg) in that it gives on more tool to use for pentesting.

http://pogostick.net/~pnh/ntpasswd/

Reply on news.ycombinator.com