Vista Hacking Challenge Answered...

[imhotep]

"Microsoft's most secure Operating System yet has been compromised at the
Black Hat hacker conference. We all know that Andrew Cushman, Microsoft's
director of security outreach invited the Black Hats over to touch and feel
Vista in order to showcase the superiority of this OS. Joanna Rutkowska,
from Coseinc, a Singapore-based security firm, obliged and showed how it is
possible to bypass security measures in Vista that prevents unsigned code
from running with the help of a little software she calls the 'Blue Pill.'"

http://it.slashdot.org/article.pl?sid=06/08/07/228227&from=rss

-- Imhotep

 

[Roger Abell [MVP]]

(senseless follow-up setting ignored this time)

Man, is that poor reporting. You'd think a "tech" site could do better.

She showed two things, which this quote seems to mix up.

One bypasses the unsigned code prevention in the present incarnation
of Vista if LUA has been shut off.
The other, the "blue pill", is a rootkit technique that leverages the CPU
hardware support for virtualization in the new CPU generation (which
BTW she demonstrated first some weeks ago at conference in Asia)

 

[karl levinson, mvp]

(senseless follow-up setting ignored this time)

Man, is that poor reporting. You'd think a "tech" site could do better.

She showed two things, which this quote seems to mix up.

One bypasses the unsigned code prevention in the present incarnation
of Vista if LUA has been shut off.
The other, the "blue pill", is a rootkit technique that leverages the CPU
hardware support for virtualization in the new CPU generation (which
BTW she demonstrated first some weeks ago at conference in Asia)

And don't forget that "Blue Pill" is not a way to hack Vista. It works
equally well on any operating system, including Linux, OpenBSD, etc.

Also, blue pill is not a way to hack any OS. It's root kit technology, so
it evades detection once an OS is hacked via another means.

During the presentation, Joanna was asked, "How did you bypass LUA?" She
answered, "I clicked on the 'OK' button." And that's a hack?

I thought imhotep was going to stop posting the intentionally inaccurate
posts at slashdot, without also posting a link to the actual article that
was misread and misinterpreted by the slashdotters.

I'm not sure why imhotep claims that we're squelching any real technical
discussion about security and that this newsgroup needs to become more like
slashdot, given that we seem to understand and be better informed about the
technical details about new security advances like blue pill than the
average slashdot thread.

 

[Kerry Brown]

During the presentation, Joanna was asked, "How did you bypass LUA?" She
answered, "I clicked on the 'OK' button." And that's a hack?

And she was running with an administrator account. If she had been using a
standard account she would have had to enter a password as well. I do sort
of see this as a flaw in Vista. The default install should set up a standard
user account and default to using that account.

 

[Roger Abell [MVP]]

And don't forget that "Blue Pill" is not a way to hack Vista. It works
equally well on any operating system, including Linux, OpenBSD, etc.

Also, blue pill is not a way to hack any OS. It's root kit technology, so
it evades detection once an OS is hacked via another means.

During the presentation, Joanna was asked, "How did you bypass LUA?" She
answered, "I clicked on the 'OK' button." And that's a hack?

I thought imhotep was going to stop posting the intentionally inaccurate
posts at slashdot, without also posting a link to the actual article that
was misread and misinterpreted by the slashdotters.

I'm not sure why imhotep claims that we're squelching any real technical
discussion about security and that this newsgroup needs to become more
like slashdot, given that we seem to understand and be better informed
about the technical details about new security advances like blue pill
than the average slashdot thread.

I am in total agreement with you Karl, but perhaps I have one exception
in that. Since, if AMD/Intel do not find the resolution to the "blue pill"
technique before the virtualizing procs are in distribution, then, as I am
presently understanding it, code running in an OS could "hoist" the OS
into being virtualized and cause its own payloads to run "under" the OS.
Yes, as you said, this is a hardware issue that affects any OS, but it
also seems an OS hack in that the OS might be able to cause the first
step to be problematic/impossible (did we fully understand the original
idea of HAL?).

Roger

 

[Gerry Hickman]

I do sort
of see this as a flaw in Vista. The default install should set up a standard
user account and default to using that account.

At last! Someone with a brain posting to Microsoft security newsgroups.

 

[Karl Levinson]

And she was running with an administrator account. If she had been using a
standard account she would have had to enter a password as well. I do sort
of see this as a flaw in Vista. The default install should set up a
standard user account and default to using that account.

Are you sure it doesn't? I thought the plan with the final release of Vista
was to hide the Administrator account to ensure most people are using
non-Admin accounts.

 

[Kerry Brown]

Are you sure it doesn't? I thought the plan with the final release
of Vista was to hide the Administrator account to ensure most people
are using non-Admin accounts.

On all the builds I've tested so (limited to MSDN CTP's) there are no
standard user accounts created during the install. If you want a standard
user you have to create one. I sincerely hope you are right about the final
release.

 

[Colin Nash [MVP]]

On all the builds I've tested so (limited to MSDN CTP's) there are no
standard user accounts created during the install. If you want a standard
user you have to create one. I sincerely hope you are right about the
final release.

With UAC enabled (as it is by default in Vista so far) the user would need
to click OK to "approve" a privileged operation even if they are already
using an account that is a member of the Administrators group. If the
account is not a member of Administrators, they will need to type the
name+password of account that is, and then click OK. Either way there is a
prompt to approve the action, it's just a question of how much typing
someone on single-user system will need to do.

For the purposes of this thread, if the demonstrator clicked "OK" at the UAC
screen (also known as LUA...) then they effectively said "I am an
administrator and I want to do this." (Yes, Vista needs to somehow get
better at explaining what exactly is going to happen if you click OK instead
of just giving you gibberish about whatever process name. At least the idea
is there!)

 

[imhotep]

And don't forget that "Blue Pill" is not a way to hack Vista. It works
equally well on any operating system, including Linux, OpenBSD, etc.

Also, blue pill is not a way to hack any OS. It's root kit technology, so
it evades detection once an OS is hacked via another means.

During the presentation, Joanna was asked, "How did you bypass LUA?" She
answered, "I clicked on the 'OK' button." And that's a hack?

I thought imhotep was going to stop posting the intentionally inaccurate
posts at slashdot, without also posting a link to the actual article that
was misread and misinterpreted by the slashdotters.

First:
That post was based on the article "Blue Pill Leaves Vista Vulnerable" by
Techtree news staff. Listen, see how the text "has been compromised" is a
different color: that's a link. How long have you been surf'n the web????

I'm not sure why imhotep claims that we're squelching any real technical
discussion about security and that this newsgroup needs to become more
like slashdot, given that we seem to understand and be better informed
about the technical details about new security advances like blue pill
than the average slashdot thread.

Hahahahaha....you are funny!!!

You would not last 5 minutes with most of the people there. But, hey, if
believing you could allows you to sleep better at night...

--Imhotep

 

[imhotep]

With UAC enabled (as it is by default in Vista so far) the user would need
to click OK to "approve" a privileged operation even if they are already
using an account that is a member of the Administrators group. If the
account is not a member of Administrators, they will need to type the
name+password of account that is, and then click OK. Either way there is
a prompt to approve the action, it's just a question of how much typing
someone on single-user system will need to do.

For the purposes of this thread, if the demonstrator clicked "OK" at the
UAC screen (also known as LUA...) then they effectively said "I am an
administrator and I want to do this." (Yes, Vista needs to somehow get
better at explaining what exactly is going to happen if you click OK
instead
of just giving you gibberish about whatever process name. At least the
idea is there!)

Honestly, this will do nothing for the overall security of the system.
Relying on a non technical user to make technical decisions is a disaster
waiting to happen. Most people will act just like the Blue Pill author and
click "yes" to everything. Also, it seems that, still, out of the box users
will default to being in the admin group. The only real protection from
trojans is a low security level for users: don;t give them the privs to
install it in the first place!

So how has security been enhanced/improved?

Having the idea "there" is meanless...

Imhotep

 

[imhotep]

And don't forget that "Blue Pill" is not a way to hack Vista. It works
equally well on any operating system, including Linux, OpenBSD, etc.

In real life, no. Why? Because all of the operating systems you mentioned DO
NOT run users in elevated security levels. Only Microsoft does this. This
is why this technique will not work on any OS EXCEPT for Microsoft.

Also, blue pill is not a way to hack any OS. It's root kit technology, so
it evades detection once an OS is hacked via another means.

During the presentation, Joanna was asked, "How did you bypass LUA?" She
answered, "I clicked on the 'OK' button." And that's a hack?

Sure it is. 99% of users will do the same damn thing! Let's look at this
honestly and logically. You are saying that prompting non technical people
asking them technical questions will increase security? Most people will
just click "yes". The real fix is to *not* run users with elevated
privileges (which all operating systems do except for Microsoft).

I thought imhotep was going to stop posting the intentionally inaccurate
posts at slashdot, without also posting a link to the actual article that
was misread and misinterpreted by the slashdotters.

Stop your smoke and mirrors! Let's review what this post was about:

1. Microsoft gave a bunch of people at the Black Hat conference Vista and
basically said "Hack away". In a short time someone found one. How long did
it take?

2. Although this technique affects all operating systems, the only operating
system really affected IS MICROSOFT. Why, only Microsoft typically runs
users with elevated privs. ONLY MICROSOFT. You need a user account with
elevated privs to use this technique....

3. Saying something foolish like, The user is at fault because she
clicked "yes" to the UAC prompt is lame. Most people will do EXACTLY the
same thing.


It is funny that the author of this post that I am replying to, Karl
Levinson, was criticizing the web site slashdot. He obviously knew about
this article but did not post it. Karl, if you do not like slashdot, then
start posting some articles instead of criticizing. Seems to me, that you
care more about hiding the bad press articles then anything else. Now that
is pathetic.

I'm not sure why imhotep claims that we're squelching any real technical
discussion about security and that this newsgroup needs to become more
like slashdot, given that we seem to understand and be better informed
about the technical details about new security advances like blue pill
than the average slashdot thread.

Karl, sorry but, you would be destroyed by most of the people that go to
slashdot so bad that I would actually feel bad for you. At least slashdot
is not afraid of discussing the real articles facing people today.

You simply repeat some facts you have read and try to claim that you are
talented. Can't a trained parrot repeat words too?

-- Imhotep

 

[Roger Abell [MVP]]

Honestly, this will do nothing for the overall security of the system.
Relying on a non technical user to make technical decisions is a disaster
waiting to happen. Most people will act just like the Blue Pill author and
click "yes" to everything. Also, it seems that, still, out of the box
users
will default to being in the admin group. The only real protection from
trojans is a low security level for users: don;t give them the privs to
install it in the first place!

So how has security been enhanced/improved?

Having the idea "there" is meanless...

Imhotep

Surprised as I am to say this, I am pretty much entirely in agreement
with you on this. UAC, which reduces an account at login if it is an
admin is a step toward making sure users run as limited accounts.
However, right now it is all too easy for that user to exert their elevated
privs, and they will.

The solution is as you indicate, in holding tightly any ability to exercise
elevated privileges. I wish OSs had grown up to actually, effectively use
all four rings in the initial Intel concepts, for that matter.

I think where you and I differ however is that you seem to believe that
MS could just make it different. This is just not so from a couple of
directions.

I ask first, if Red Hat had the same mix of "owners", or "users" or
whatever you want to call the large number of casual computer users
that only (I should cap that) users that ONLY want to use the machine
for browsing, media, email, cool stuff and that want to never (actually,
NEVER) have to get "bit dirty" (as in taking responsibility to config,
to patch, etc.) how would things pan out?

The other perspective you seem to lack is that MS (well, one cannot
generalize like that, so to be clear, in this case MS means as significant
faction in the Windows dev group) has long wanted to have a nice,
sane, clear distinction between user and admin. I can recall some
discussions in that direction in NT 4 beta associated with the change
in the Executive/Kernel boundary where we were saying if you can
really pull that off safely then surely restructuring storage so that we
can lock down, at the large grain folder level, the system binaries to
only read/exec for users, etc. etc. We did get a little motion that
direction, but . . . it was not until later, in the NT5 beta (prior to the
July 1999 rename to Windows 2000) where we were again pressing,
"hey, we just want a /usr, a /bin, etc. so we can fully compartmentalize,
etc." (and finding a lot of support/agreement) when it became clear to
me how it was not what they (same MS) wanted but what they could
do given the ecosystem (legacy, dependent third-party software firms,
legalities) that governed how far things could be moved in that direction.
XP moved the bar a little more, nudged the software industry a little
further, and so will Vista. The plain fact is that if MS were to, back
then or even now, enforce changes that many of us would like they
would probably be revisited by DoJ and the Euro commission.
Virtualization of storage and registry is an effort to assist in tightening
things without breaking lame applications or being seen as forcing those
vendors to invest in reversioning their products immediately. One sad
side-effect is that it will probably just lengthen the time before we stop
seeing so much lame software being written/marketed.

OK. Now I am not attempting to "spin". I am attempting to see if you
can appreciate the who behind the MS you often chastize, and that they
(similar comment about generalization) would in fact like to be able to
find a way out from being between the rock and the hard place, so to
speak. They have a legacy rooted in DOS built without any concept of
a network, or later, at least one that went outside of the room. They have
industries that rely on the platform for there very existence, and Windows
design changes can impact the cost of versioning for lots of companies.
Some of those software companies have barely moved in their skillset or
architecture from what they had when their world was DOS and Win 3.1.
They have a huge base of "average Joe/Jane" people, who do not want
to, and should not need to, become IT admins in order to take part in this
information age. They have people like you and I coming at them from
varied angles saying "do the right thing". And then they have a huge wealth
of skill, brain-trust, ideas of what can be done with pervasive
computational
devices pressing for large amounts of rather sophisticated support code in
and/or on the platform

So, I end by just asking you, would you like to be in that decision spot?

--
ra

(PS. May I remind you not to come back at me with diatribe about IE
or other crapware from which the majority of Windows related ills have
their origin. My discussion was about Windows, not Office, not IE, not
OE, etc.)

 

[Roger Abell [MVP]]

First:
That post was based on the article "Blue Pill Leaves Vista Vulnerable" by
Techtree news staff. Listen, see how the text "has been compromised" is a
different color: that's a link. How long have you been surf'n the web????

Hey Im, if you want to claim it was munged text then next time how
about not using the "" quotes.
I did not bother to follow the link as I had already seen pdf of the last
talk at BH, I had seen a couple 3rd-hand digestions already, and I did
give you credit that the "" quotes intended to be just that.

Roger

 

[Gerry Hickman]

Hi Colin,

With UAC enabled (as it is by default in Vista so far) the user would need
to click OK to "approve" a privileged operation

!?!

Get a grip; does anyone remember those pop-ups saying "some files can
harm your computer"? Does anyone remember what the user clicked next??

If this is what Microsoft calls "taking security seriously", I can only
hope everyone out there has got a alternative security plan (like I do).

It's absurd to say Vista is the most secure o/s from Microsoft. At this
point in time, it's no different to all the rest. Everything that makes
Windows poor in terms of security is still right there in Vista; take a
look at how IE interacts with system DLLs if you don't believe me.
Mozilla/Firefox is way ahead of the game here and don't be misled by
counting how many patches are released for each, instead concentrate on
user mode vs kernel mode.

Will we suddenly see it change before release date? Good question!

 

[Gerry Hickman]

In real life, no. Why? Because all of the operating systems you mentioned DO
NOT run users in elevated security levels. Only Microsoft does this. This
is why this technique will not work on any OS EXCEPT for Microsoft.

At last! Another man with a brain posting to the security groups.

This is the second sensible post this week. First Kerry and now imhotep

 

[Guest]

At last! Another man with a brain posting to the security groups.

This is the second sensible post this week. First Kerry and now imhotep

Sorry, you're totally wrong. Email Joanna herself. She'll tell you that
Blue Pill works against any OS. Or read her words:

http://theinvisiblethings.blogspot.com/2006/06/introducing-blue-pill.html

"I would like to make it clear, that the Blue Pill technology does not rely
on any bug of the underlying operating system. I have implemented a working
prototype for Vista x64, but I see no reasons why it should not be possible
to port it to other operating systems, like Linux or BSD which can be run on
x64 platform."

Good luck trying to argue with Joanna about her own root kit.

What was that you were saying about this being a sensible post?

 

[Guest]

take a
look at how IE interacts with system DLLs if you don't believe me.
Mozilla/Firefox is way ahead of the game here and don't be misled by
counting how many patches are released for each, instead concentrate on
user mode vs kernel mode.

Then why do IE remote code execution vulnerabilities almost always grant the
attacker the permissions of the currently logged in user, rather than full
System privileges? Just the same as Mozilla remote code execution vulns?

Why is it just as easy, if not easier, to find format vulnerabilities in the
latest Mozilla / Firefox as it is in IE 6 code written in 1999?

 

[Dan]

Then why do IE remote code execution vulnerabilities almost always grant the
attacker the permissions of the currently logged in user, rather than full
System privileges? Just the same as Mozilla remote code execution vulns?

Why is it just as easy, if not easier, to find format vulnerabilities in the
latest Mozilla / Firefox as it is in IE 6 code written in 1999?

According to the Secunia website you have 18 advisories for Internet
Explorer with the highest rated moderately critical.
http://secunia.com/product/11/

Mozilla Firefox has 3 less critical vulnerabilities remaining.
http://secunia.com/product/4227/

Opera 9 has no current vulnerabilities.
http://secunia.com/product/10615/

 

[karl levinson, mvp]

According to the Secunia website you have 18 advisories for Internet
Explorer with the highest rated moderately critical.
http://secunia.com/product/11/

Mozilla Firefox has 3 less critical vulnerabilities remaining.
http://secunia.com/product/4227/

Opera 9 has no current vulnerabilities.
http://secunia.com/product/10615/

.... because IE vulns get you more fame, so people spend more time looking
for them.

http://www.securityfocus.com/archive/1/378632

"All browsers but Microsoft Internet Explorer kept crashing on a regular
basis due to NULL pointer references, memory corruption, buffer overflows,
sometimes memory exhaustion... It appears that the overall quality of code,
and more importantly, the amount of QA, on various browsers touted as
"secure", is not up to par with MSIE; the type of a test I performed
requires no human interaction and involves nearly no effort. Only MSIE
appears to be able to consistently handle [*] malformed input well,
suggesting this is the only program that underwent rudimentary security QA
testing with a similar fuzz utility.

"This is of course not to say MSIE is more secure; it does have a number of
problems, mostly related to its security architecture and various features
absent in other browsers. But the quality of core code appears to be far
better than of its "secure" competitors."