Windows Vista’s Security Privileges Bypassed by Blue Pill
No, it’s not a joke. It’s a real fact that happened at the Black Hat conference. And, as always, a woman is involved.
Security in Windows OS has always been a painful thorn for the Redmond giant, so they have been striving to improve in their next-generation OS Vista the overall safety, by applying multiple stages in security privileges.
But a Polish expert working for a Singapore security company demonstrated at the Balck Hat conference last week that it is possible to bypass these privileges using…the famous Blue Pill! Well, this is how she called her rootkit-like malicious software…
The Redmond giant thought it’s best to go directly into the beast’s lair, instead of waiting for the beast to attack. So they released a limited and exclusive version of their up-coming OS to 3,000 security professionals at the Black Hat conference this week.
They have also indicated to the security gurus gathered there the steps made by the Redmond-based company in improving the overall security levels in Vista. The multi-leveled security architecture of Windows Vista should reduce to minimum the impact of malicious software code, making sensitive data like social numbers, bank accounts or passwords more secure.
Joanna Rutkowska showed to the attendees at Black Hat how it is possible to avoid the security measures adopted in Windows Vista which are meant at preventing or limiting malware’s access to a computer.
Not only has the Polish security expert showed how to bypass security measures, she also showed how to use virtualization technology in order to transform a malicious code to make it “invisible” or undetectable.
“Microsoft is investigating solutions for the final release of Windows Vista to help protect against the attacks demonstrated,” a representative for the Redmond giant said. “In addition, we are working with our hardware partners to investigate ways to help prevent the virtualization attack used by the Blue Pill.”
The demonstration of how to trick Windows Vista’s “locks” gathered a lot of people in Caesar’s Palace in Las Vegas, despite of the fact that it was the last day of Black Hat conference and it was one of the last events there. According to her declaration, Rutkowska used an early version of Vista to achieve this “performance”.
Since Vista is mainly destined for 64-bit systems, Microsoft added a mechanism of protection against unsigned drivers, which should hinder them to run on the 64-bit version of Vista.
But the Polish technician also managed to make an unsigned driver to work on beta versions of 64-bit Vista, which could pose serious threats to infected machines. Security experts have warned about the fact that running at low levels in the operating system, unsigned drivers could eventually remain undetected.
“The fact that this mechanism was bypassed does not mean that Vista is completely insecure. It’s just not as secure as advertised,” Rutkowska said. “It’s very difficult to implement a 100 percent-efficient kernel protection.”
The good news for Microsoft is that in order to perform an attack Vista has to run in administrator mode. That means her attack would be foiled by Microsoft’s User Account Control, a Vista feature that runs a PC with fewer user privileges. UAC is a key Microsoft effort to prevent malicious code from being able to do as much damage as on a PC running in administrator mode, a typical setting on Windows XP.
When she was asked from the audience how did she bypassed the security levels implemented in Vista, Rutkowska replied: “I just hit accept.” That was a reference at what most users will probably do at seeing the multitude of security windows which pop-up in Vista, a reaction that might expose their PCs to infection.
Throughout the company development of Vista, Microsoft has applied a new process known as SDL (Security Development Lifecycle), which requires that all of the operating system’s code is scoured for potential problems before being added into the product.
Through SDL and “fundamental architectural changes” that will help make customers more secure from evolving threats, including worms, viruses and malware, Microsoft says that it has effectively minimized Vista’s “attack surface area.”
“Windows Vista has many layers of defense, including the firewall, running as a standard user, Internet Explorer Protected Mode, /NX support, and ASLR, which help prevent arbitrary code from running with administrative privileges,” the Microsoft representative noted.
Blue Pill, the malicious software code that bears the nick-name of the famous Pfizer product, is a “silent” software, created using the Pacifica Virtualization technology from AMD. This is why some voices speculated that Rutkowska’s work was secretly funded by AMD’s rival, Intel. Rutkowska denied these allegations.
“Some people suggested that my work is sponsored by Intel, as I focused on AMD virtualization technology only; that is untrue.”
If Vista does not meet the security standards imposed by the inside SDL commission, it will be postponed again…This is what Bill Gates himself said to a group of partners of Microsoft in Cape Town, South Africa.
“We got to get this absolutely right,” Bill Gates said at the conference. “If the feedback from the beta tests shows it is not ready for prime time, I’d be glad to delay it.” Jucaushii Entertainment S.R.L.