[Full-disclosure] Hack into a Windows PC - no password needed
eric at rachner.us
Wed Mar 5 02:15:13 GMT 2008
Actually, it's full system compromise -- if the machine is joined to a
domain, then any domain account credentials known to that machine are
compromised as well.
And yes, the same capability exists not only on Macs but on any computer
that implements the Firewire specification. (details at
From: full-disclosure-bounces at lists.grok.org.uk
[mailto:full-disclosure-bounces at lists.grok.org.uk] On Behalf Of Larry
Sent: Tuesday, March 04, 2008 4:01 PM
Subject: Re: [Full-disclosure] Hack into a Windows PC - no password needed
The key to the vulnerability: "To use the tool, hackers must connect a
Linux-based computer to a Firewire port on the target machine. The
machine is then tricked into allowing the attacking computer to have
read and write access to its memory. "
I assume this makes it a local login, not a domain login.
"Paul Ducklin, head of technology for security firm Sophos, said the
security hole found by Boileau was not a vulnerability or bug in the
traditional sense, because the ability to use the Firewire port to
access a computer's memory was actually a feature of Firewire."
So does the same capability exist on Macs?
eWEEK.com Security Center Editor
Contributing Editor, PC Magazine
larry.seltzer at ziffdavisenterprise.com
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 2950 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20080304/4e160f89/attachment.bin
Full-Disclosure is hosted and sponsored by Secunia.