New Windows XP & Vista Full Take-over Hack with Firewire

Use Netsparker


This Firewire hack seems to be creating a big buzz, from what I’ve read it also works on Vista as for some odd reason the Firewire port gets access to the whole memory space in DMA mode – not just what it needs to function – so you can read from anything stored in memory with the right tools.

Pretty worrying eh? There is a few ways to secure yourself if you feel this is a threat (Disable the 1394 bus or disable DMA).

A security consultant based in New Zealand has released a tool that can unlock Windows computers in seconds without the need for a password.

Adam Boileau first demonstrated the hack, which affects Windows XP computers but has not yet been tested with Windows Vista, at a security conference in Sydney in 2006, but Microsoft has yet to develop a fix.

Interviewed in ITRadio’s Risky Business podcast, Boileau said the tool, released to the public today, could “unlock locked Windows machines or login without a password … merely by plugging in your Firewire cable and running a command”.

If you are interested in the details and want to read about the Windows Vista Firewire hack you can do so here [PDF].

As I’ve always said though, if you have physical access you basically own the machine. Physical security of servers is a lot more important than many people think.

To use the tool, hackers must connect a Linux-based computer to a Firewire port on the target machine. The machine is then tricked into allowing the attacking computer to have read and write access to its memory.

With full access to the memory, the tool can then modify Windows’ password protection code, which is stored there, and render it ineffective.

Older desktop computers do not come equipped with Firewire ports, which are needed for the hack to work, but many recent models do. Most laptops made in the last few years include Firewire ports.

Microsoft has been unavailable for comment about this issue of course. The FD thread is extremely long, if you are interested in reading it you can do so here.

Source: Sydney Morning Herald

Posted in: Exploits/Vulnerabilities, Windows Hacking

, , ,


Latest Posts:


Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.
Four Year Old libSSH Bug Leaves Servers Wide Open Four Year Old libssh Bug Leaves Servers Wide Open
A fairly serious 4-year old libssh bug has left servers vulnerable to remote compromise, fortunately, the attack surface isn't that big as neither OpenSSH or the GitHub implementation are affected.
CHIPSEC - Platform Security Assessment Framework CHIPSEC – Platform Security Assessment Framework For Firmware Hacking
CHIPSEC is a platform security assessment framework for PCs including hardware, system firmware (BIOS/UEFI), and platform components for firmware hacking.


7 Responses to New Windows XP & Vista Full Take-over Hack with Firewire

  1. Bogwitch March 21, 2008 at 11:05 am #

    It’s not just MS OSes that are vulnerable to this – anything with an active firewire.
    The reason it can access the memory direclty is that Firewire is a BUS whereas USB etc. is a PORT.

  2. Pantagruel March 21, 2008 at 1:24 pm #

    A fun thing to read.

    Like Bogwitch says, it’s a bus and has direct DMA access, basically needed since most of the firewire attached stuf is a HDD or other drive which want/need DMA access. Did a trial with disabled DMA but trying to capture video from the firewire attached hi-8 cam results in significant more frame loss compared to having DMA turned on. The direct DMA access appears to be needed to ensure a proper dump of the data coming in at the firewire onto the hdd (both p-ATA and s-ATA are fast enough to capture the 4 Mb datastream).

    @Darknet, indeed a makeshift secured broom cupboard (padlock/etc and steel plate reinforced door) is enough to keep out the average purp.

  3. James C March 21, 2008 at 2:40 pm #

    @Darknet
    “As I

  4. zupakomputer March 21, 2008 at 3:30 pm #

    Have to agree too – the ways of taking over a machine are plentiful if you have physical access to it.

  5. fever April 10, 2008 at 4:43 pm #

    another example of disable that which you do not use. Or it will come to bite you in the end.

  6. Clarkson January 5, 2009 at 8:32 pm #

    Just pick up the machine and walk out with it, if you have physical access to the box.

  7. Bogwitch January 5, 2009 at 10:52 pm #

    Clarkson,

    The attack mentioned does have some practical application.
    Imagine a workstation with full disk encryption. Having physical access to the workstation is not much use. Now, if the workstation is powered, but locked, the attacker can gain access to the OS using this method.