Security team shows unfixable Windows 7 hack

April 23, 2009 – 4:19 PM

At the Hack In The Box (HITB) Security Conference in Dubai on Thursday, security researchers demonstrated how software they developed can already take advantage of a design problem with the upcoming Windows 7 operating system, allowing them to hack into the system. VBootkit 2.0, created by researchers Vipin Kumar and Nitin Kumar, was used to demonstrate how hackers can take control of a Windows 7 computer while it’s booting up. Unlike most exploits, though, the attack is said inherent to Windows 7 and may likely remain with the OS until it’s replaced.

“There’s no fix for this. It cannot be fixed. It’s a design problem,” Vipin said, though the attack cannot be done remotely and requires that hackers have physical access to a PC.

The program is just 3KB big and lets attackers change files that are loaded into system memory during the boot process. Because nothing is changed on the hard disk itself, VBootkit 2.0 is hard to detect, Vipin says. Also, rebooting the computer gets rid of the security issue, as system memory is cleared during the process.

Via the software, hackers can remotely control the targeted computer and change their access level to the highest possible. Passwords can also be removed, letting hackers access a victim’s files. What’s more, the password is restored, so victims are unaware their security was breached.

Source:
http://www.electronista.com/articles/09/04/23/windows.7.hack.program/