Windows recovery loophole lets hackers in

Who do want to own today?

By John Leyden • Get more from this author

Posted in Enterprise Security, 12th June 2007 17:56 GMT

Free whitepaper – Avoiding 7 common mistakes of IT security compliance

Windows Vista may be Microsoft's most secure operating system to date, but researchers are still finding some glaring loopholes for hackers to exploit. Here is the latest: all you need is a Vista Install DVD to get admin level access to a hard drive.

The loophole arises because the Command Prompt tool in Vista's System Recovery Options fails to request user name or passwords before handing over access to PCs running the operating system. The hack, discovered by security researcher Kimmo Rousku, only works locally. Physical access to a target PC is a must. Even so, the potential for mischief (such as deleting directories or copying files on targeted PCs) is enormous. Hackers don't even necessarily need to run a DVD. "It’s easy to create a bootable USB flash memory that works in a similar way," Rousku notes.

He discovered the problem during a training workshop on Vista back in February and reported it to Microsoft at the time. Since then, Microsofti has sat on the problem, according to Rousku, so he has gone public. The hack also works on machines running other versions of Vista, providing the PCs are not protected by full disc encryption.

A write-up by Rousku explains the issue in detail and suggests workarounds.

Anti-virus firm F-Secure notes that getting into PCs running Windows XP Home is also straightforward, at least in default set-ups, using a different trick. "The Administrator account password for XP Home is blank by default and is hidden in Normal Mode. But if you select F8 during boot for Safe Mode, you can access the Administrator account and have complete access to the computer," F-Secure notes. ®

Free whitepaper – Certify your software integrity with Thawte code signing certificates