The question to ask first is this: can't every piece of software be hacked in some fashion? Quite frankly, yes. However, Microsoft (unfortunately) deals with hackers on a daily basis, patching security holes in the Windows operating system, Internet Explorer, and various programs in the Office suite. In some ways, hackers bring job stability to those who specialize in thwarting security intrusions, those who fill holes where perpetrators like to sneak in. But what if the problem can't be fixed? What if the window is wide open and there's not one thing Microsoft or any other company can do to shut it closed?
Earlier today, researchers Vipin Kumar and Nitin Kumar of NVlabs demonstrated how they could take control of a Windows 7 virtual machine using proof-of-concept code they developed called Vbootkit 2.0. The 3 KB program allows the "attacker" to take control of the computer by making changes to the operating system's files loading into the system memory during the boot process. According to Kumar and Kumar, Windows 7 cannot detect the malicious program because no files are changed on the hard disk.
"Basically, we follow a very simple algorithm for Vbootkit," the team explained during the demonstration, "Hook INT 13 for disk reads, keep patching files as they load, hook onto the next stage, and repeat the above process [until] we reach the kernel, then sit and watch the system carefully."
With that said, there's a positive and negative side to this kind of attack. The good news is that the hacker must by physically present to take control of the PC, making the threat somewhat minimal. Additionally, once the computer reboots, Vbootkit 2.0 will no longer have control since the data stored in memory is no longer available. The negative aspect is that, according to Vipin Kumar, the problem stems from Windows 7's assumption that the boot process is immune from attacks. He said that not only is there no current fix for the problem, but that it cannot ever be fixed.
The security researchers demonstrated the ability to take control of Windows 7 at the Hack in The Box Security Conference held in Dubai. The duo merely wanted to demonstrate how they could get Windows 7 (x64) running normally after implementing changes to the kernel. The demonstration was also meant to show how Vbootkit 2.0 could pass through all of the security features implemented in the kernel without being detected, and without leaving a footprint on the hard drive.
In addition to hacking into the kernel, Vbootkit 2.0 allows the attacker to control the victim's computer by remote after this initial physical invasion. The attacker can then increase the user privileges to the highest level, and remove the current user's password, allowing the attacker to gain access to all files stored on the PC. Once finished, the attacker can use Vbootkit 2.0 to restore the original password, and exit the system undetected.
So what does this mean for Windows 7? Can the problem be fixed? According to Kumar, no. However, perhaps Microsoft will take notice and figure out a workaround before the operating system eventually ships this year.
