Re: [Full-disclosure] Hack into a Windows PC - no password needed
On Tue, 04 Mar 2008 19:00:33 EST, Larry Seltzer said: > So does the same capability exist on Macs? What, don't you remember? :) Google for the phrase "Owned by an iPod"... pgppkWLA8zBDg.pgp Description: PGP signature ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Hack into a Windows PC - no password needed
Actually, it's full system compromise -- if the machine is joined to a domain, then any domain account credentials known to that machine are compromised as well. And yes, the same capability exists not only on Macs but on any computer that implements the Firewire specification. (details at http://storm.net.nz/projects/16) - Eric -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Larry Seltzer Sent: Tuesday, March 04, 2008 4:01 PM To: Untitled Subject: Re: [Full-disclosure] Hack into a Windows PC - no password needed The key to the vulnerability: "To use the tool, hackers must connect a Linux-based computer to a Firewire port on the target machine. The machine is then tricked into allowing the attacking computer to have read and write access to its memory. " I assume this makes it a local login, not a domain login. "Paul Ducklin, head of technology for security firm Sophos, said the security hole found by Boileau was not a vulnerability or bug in the traditional sense, because the ability to use the Firewire port to access a computer's memory was actually a feature of Firewire." So does the same capability exist on Macs? Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blogs.pcmag.com/securitywatch/ Contributing Editor, PC Magazine [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ <>___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Hack into a Windows PC - no password needed
Actually, it's full system compromise -- if the machine is joined to a domain, then any domain account credentials known to that machine are compromised as well. And yes, the same capability exists not only on Macs but on any computer that implements the Firewire specification. (details at http://storm.net.nz/projects/16) - Eric -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Larry Seltzer Sent: Tuesday, March 04, 2008 4:01 PM To: Untitled Subject: Re: [Full-disclosure] Hack into a Windows PC - no password needed The key to the vulnerability: "To use the tool, hackers must connect a Linux-based computer to a Firewire port on the target machine. The machine is then tricked into allowing the attacking computer to have read and write access to its memory. " I assume this makes it a local login, not a domain login. "Paul Ducklin, head of technology for security firm Sophos, said the security hole found by Boileau was not a vulnerability or bug in the traditional sense, because the ability to use the Firewire port to access a computer's memory was actually a feature of Firewire." So does the same capability exist on Macs? Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blogs.pcmag.com/securitywatch/ Contributing Editor, PC Magazine [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ <>___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Hack into a Windows PC - no password needed
The key to the vulnerability: "To use the tool, hackers must connect a Linux-based computer to a Firewire port on the target machine. The machine is then tricked into allowing the attacking computer to have read and write access to its memory. " I assume this makes it a local login, not a domain login. "Paul Ducklin, head of technology for security firm Sophos, said the security hole found by Boileau was not a vulnerability or bug in the traditional sense, because the ability to use the Firewire port to access a computer's memory was actually a feature of Firewire." So does the same capability exist on Macs? Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blogs.pcmag.com/securitywatch/ Contributing Editor, PC Magazine [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Hack into a Windows PC - no password needed
I guess the release of this tool makes physical access pen-tests a little bit easier huh? Will have to try this out some time. Steven > http://www.smh.com.au/news/security/hack-into-a-windows-pc--no-password-needed/2008/03/04/1204402423638.html > > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Hack into a Windows PC - no password needed
2008/3/4, Ivan . <[EMAIL PROTECTED]>: > http://www.smh.com.au/news/security/hack-into-a-windows-pc--no-password-needed/2008/03/04/1204402423638.html > Here is a (totally unofficial) mirror of Metlstorm's files in case you can't reach his overloaded website :-\ http://www.hotsecuritynews.com/fearwire/ Again, very nice work Metlstorm ! ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] Hack into a Windows PC - no password needed
http://www.smh.com.au/news/security/hack-into-a-windows-pc--no-password-needed/2008/03/04/1204402423638.html ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
