[guru] Boot jelszo kezelesi problemak
DATE: Mon, 15 Sep 2008 18:24:15 +0200
Több boot manager és diszk titkosító program sem figyel arra, hogy a
jelszó bekérése után törölnie kellene a keyboard buffer tartalmát. Így
az elindított operációs rendszer (vagy akár az MBR-be települt vírus)
is meg tudja szerezni a boot jelszót.
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -----------------------------------------------------------------------
[ iViZ Security Advisory 08-002 25/08/2008 ]
- -----------------------------------------------------------------------
iViZ Techno Solutions Pvt. Ltd.
http://www.ivizsecurity.com
- -----------------------------------------------------------------------
* Title: Hewlett-Packard BIOS Plain Text Password Disclosure
* Date: 25/08/2008
* Software: Hewlett-Packard BIOS
* Vendor Bug Tracker : SSRT080104
- --[ Synopsis:
Like most BIOSes, HP 68DTT Ver. F.0D can be used to ask a password
to users at boot time to implement a pre-boot authentication.
The password checking routine of Hewlett-Packard 68DTT Ver. F.0D
(11/22/2005) fails to sanitize the BIOS keyboard buffer after reading
user input, resulting in plain text password leakage to local users.
- --[ Affected Software:
* Hewlett-Packard 68DTT Ver. F.0D BIOS (possibly others too)
- --[ Technical description:
The BIOS's pre-boot authentication routines use the BIOS API to
read user input via the keyboard. The BIOS internally copies the
keystrokes in a RAM structure called the BIOS Keyboard buffer
inside the BIOS Data Area. This buffer is not flushed after use,
resulting in potential plain text password leakage once the OS
is fully booted, assuming the attacker can read the password at
physical memory location 0x40:0x1e.
- --[ Impact:
Plain text password disclosure. Local access is required, but no
physical access to the machine.
The level of privilege required to retrieve the password from memory
is OS dependent and varies from guest user under Microsoft Windows
(any) to root user under most Unix based OSes.
- --[ Full Technical Whitepaper
http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
- --[ Vendor response:
* HP Software Security Response Team has acknowledged the vulnerability and
is pro-actively working on a fix.
- --[ Credits:
This vulnerability was discovered by Security Researcher
Jonathan Brossard from iViZ Techno Solutions Pvt. Ltd.
- --[ Disclosure timeline:
* First private disclosure to vendor on July 15th 2008
* First vendor reply on 1st August 2008, assigned vendor
tracker SSRT080104.
* First Public disclosure at Defcon 16 on August 10th 2008
- --[ Reference:
http://www.ivizsecurity.com/security-advisory.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
iD8DBQFIsnNXkcchhz1mT/IRAgcvAJwImDrY7icCUe3fk1n/EYi7QERIIQCfYPzc
FkyqCFErsbh8UOkgtZqmKKo=
=b5eX
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -----------------------------------------------------------------------
[ iViZ Security Advisory 08-003 25/08/2008 ]
- -----------------------------------------------------------------------
iViZ Techno Solutions Pvt. Ltd.
http://www.ivizsecurity.com
- -----------------------------------------------------------------------
* Title: TrueCrypt Security Model bypass exploiting wrong BIOS API
usage
* Date: 25/08/2008
* Software: TrueCrypt
- --[ Synopsis:
The password checking routine of TrueCrypt fails to sanitize the
BIOS keyboard buffer before AND after reading passwords.
- --[ Affected Software:
* TrueCrypt 5.0 (possibly older versions also)
- --[ Technical description:
Truecrypt's pre-boot authentication routines use the BIOS API to
read user input via the keyboard. The BIOS internally copies the
keystrokes in a RAM structure called the BIOS Keyboard buffer
inside the BIOS Data Area. This buffer is not flushed after use,
resulting in potential plain text password leakage once the OS
is fully booted, assuming the attacker can read the password at
physical memory location 0x40:0x1e. It is also possible for a root
user to reboot the computer by instrumenting the BIOS keyboard
buffer in spite of the full disk encryption.
- --[ Impact:
1) Plain text password disclosure.
Required privileges to perform this operation are OS dependent,
from unprivileged users under Windows (any), to root under most
Unix.
2) A privileged attacker able to write to the MBR and knowing the
password (for instance thanks to 1), is able to reboot the computer
in spite of the password prompted at boot time (and in spite of
disk encryption) by initializing the BIOS keyboard buffer with the
correct password (using an intermediary bootloader that will in turn
run TrueCrypt).
- --[ Full Technical Whitepaper
http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
- --[ Vendor response:
* Vendor denies the vulnerability
* Fixed in updated versions
- --[ Credits:
This vulnerability was discovered by Security Researcher
Jonathan Brossard from iViZ Techno Solutions Pvt. Ltd.
- --[ Disclosure timeline:
* First private disclosure to vendor on July 29th 2008
* First vendor reply on July 29th 2008, denying the
vulnerability.
* First Public disclosure at Defcon 16 on August 10th 2008
- --[ Reference:
http://www.ivizsecurity.com/security-advisory.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
iD8DBQFIsnPvkcchhz1mT/IRAvK9AJ9NB+/8OwAm+/pHA0ZaKLjgqu/umwCgtfoJ
QTYYHLIVb80eudsZrlSBx04=
=mttT
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -----------------------------------------------------------------------
[ iViZ Security Advisory 08-004 25/08/2008 ]
- -----------------------------------------------------------------------
iViZ Techno Solutions Pvt. Ltd.
http://www.ivizsecurity.com
- -----------------------------------------------------------------------
* Title: Intel BIOS Plain Text Password Disclosure
* Date: 25/08/2008
* Software: Intel BIOS
* CERT temporary tracker : VU#604539
- --[ Synopsis:
Like most BIOSes, Intel's firmware PE94510M.86A.0050.2007.0710.1559
(07/10/2007) can be used to ask a password to users at boot time to
implement a pre-boot authentication.
The password checking routine of this firmware fails to sanitize the
BIOS keyboard buffer after reading user input, resulting in plain
text password leakage to local users.
- --[ Affected Software:
* Intel Corp PE94510M.86A.0050.2007.0710.1559 (07/10/2007) BIOS
(possibly others too)
- --[ Technical description:
The BIOS's pre-boot authentication routines use the BIOS API to
read user input via the keyboard. The BIOS internally copies the
keystrokes in a RAM structure called the BIOS Keyboard buffer
inside the BIOS Data Area. This buffer is not flushed after use,
resulting in potential plain text password leakage once the OS
is fully booted, assuming the attacker can read the password at
physical memory location 0x40:0x1e.
- --[ Impact:
Plain text password disclosure. Local access is required, but no
physical access to the machine.
The level of privilege required to retrieve the password from memory
is OS dependant and varies from guest user under Microsoft Windows
(any) to root user under most Unix based OSes.
- --[ Full Technical Whitepaper
http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
- --[ Vendor response:
* Intel Product Security Incident Response Team (iPSIRT) has
aknowledged the vulnerability and is proactively working on a fix.
- --[ Credits:
This vulnerability was discovered by Security Researcher
Jonathan Brossard from iViZ Techno Solutions Pvt. Ltd.
- --[ Disclosure timeline:
* First private disclosure to vendor on July 15th 2008
* First vendor reply on July 15th 2008
* CERT assigns tracker VU#604539 to the bug.
* First Public disclosure at Defcon 16 on August 10th 2008
- --[ Reference:
http://www.ivizsecurity.com/security-advisory.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
iD8DBQFIsnYakcchhz1mT/IRAofuAJ9+OeAETRi5pqFLhMhE9XDGIRwn7wCgjt65
tj++4trQVUCF/MWK1NWwwUY=
=MBpr
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -----------------------------------------------------------------------
[ iViZ Security Advisory 08-005 25/08/2008 ]
- -----------------------------------------------------------------------
iViZ Techno Solutions Pvt. Ltd.
http://www.ivizsecurity.com
- -----------------------------------------------------------------------
* Title: IBM Lenovo BIOS Plain Text Password Disclosure
* Date: 25/08/2008
* Software: IBM Lenovo BIOS
- --[ Synopsis:
Like most BIOSes, IBM Lenovo's firmware 7CETB5WW v2.05 (10/13/2006)
can be used to ask a password to users at boot time to implement a
pre-boot authentication.
The password checking routine of this firmware fails to sanitize the
BIOS keyboard buffer after reading user input, resulting in plain
text password leakage to local users.
- --[ Affected Software:
* IBM Lenovo 7CETB5WW v2.05 (10/13/2006) BIOS
(possibly others too)
- --[ Technical description:
The BIOS's pre-boot authentication routines use the BIOS API to
read user input via the keyboard. The BIOS internally copies the
keystrokes in a RAM structure called the BIOS Keyboard buffer
inside the BIOS Data Area. This buffer is not flushed after use,
resulting in potential plain text password leakage once the OS
is fully booted, assuming the attacker can read the password at
physical memory location 0x40:0x1e.
- --[ Impact:
Plain text password disclosure. Local access is required, but no
physical access to the machine.
The level of privilege required to retrieve the password from memory
is OS dependent and varies from guest user under Microsoft Windows
(any) to root user under most Unix based OSes.
- --[ Full Technical Whitepaper
http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
- --[ Vendor response:
* No Response from vendor in spite of multiple solicitations.
- --[ Credits:
This vulnerability was discovered by Security Researcher
Jonathan Brossard from iViZ Techno Solutions Pvt. Ltd.
- --[ Disclosure timeline:
* First private disclosure to vendor on July 15th 2008
* First Public disclosure at Defcon 16 on August 10th 2008
- --[ Reference:
http://www.ivizsecurity.com/security-advisory.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
iD8DBQFIsnavkcchhz1mT/IRAtvNAJ4v6ipZ4LAdgKIiiyETxcLdSlktYACgkZTr
7vtu8xQMJ7TZgftfYt/WMoM=
=/O0V
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -----------------------------------------------------------------------
[ iViZ Security Advisory 08-007 25/08/2008 ]
- -----------------------------------------------------------------------
iViZ Techno Solutions Pvt. Ltd.
http://www.ivizsecurity.com
- -----------------------------------------------------------------------
* Title: DriveCrypt Security Model bypass exploiting wrong BIOS API
usage
* Date: 25/08/2008
* Software: DriveCrypt
- --[ Synopsis:
The password checking routine of DriveCrypt fails to sanitize the
BIOS keyboard buffer before AND after reading passwords.
- --[ Affected Software:
* Secu Star's DriveCrypt Plus Pack v3.9 (possibly other versions also)
- --[ Technical description:
DriveCrypt's pre-boot authentication routines use the BIOS API to
read user input via the keyboard. The BIOS internally copies the
keystrokes in a RAM structure called the BIOS Keyboard buffer
inside the BIOS Data Area. This buffer is not flushed after use,
resulting in potential plain text password leakage once the OS
is fully booted, assuming the attacker can read the password at
physical memory location 0x40:0x1e. It is also possible for a root
user to reboot the computer by instrumenting the BIOS keyboard
buffer in spite of the full disk encryption.
- --[ Impact:
1) Plain text password disclosure.
Required privileges to perform this operation are OS dependant,
from unprivileged users under Windows (any), to root under most
Unix.
2) A privileged attacker able to write to the MBR and knowing the
password (for instance thanks to 1), is able to reboot the computer
in spite of the password prompted at boot time (and in spite of
disk encryption) by initializing the BIOS keybaord buffer with the
correct password (using an intermediary bootloader that will in turn
run DriveCrypt).
- --[ Full Technical Whitepaper
http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
- --[ Vendor response:
* No Response from vendor in spite of multiple solicitations.
- --[ Credits:
This vulnerability was discovered by Security Researcher
Jonathan Brossard from iViZ Techno Solutions Pvt. Ltd.
- --[ Disclosure timeline:
* First private disclosure to vendor on July 15th 2008
* First Public disclosure at Defcon 16 on August 10th 2008
- --[ Reference:
http://www.ivizsecurity.com/security-advisory.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
iD8DBQFIsnewkcchhz1mT/IRAt67AJ9HICVN+7/BmxWyZaFcrvFlXCHMeQCg1GGU
ydFJNRdj6sRvqJbZmzT5r7Y=
=iZpc
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -----------------------------------------------------------------------
[ iViZ Security Advisory 08-008 25/08/2008 ]
- -----------------------------------------------------------------------
iViZ Techno Solutions Pvt. Ltd.
http://www.ivizsecurity.com
- -----------------------------------------------------------------------
* Title: LILO Security Model bypass exploiting wrong BIOS API
usage
* Date: 25/08/2008
* Software: LILO
- --[ Synopsis:
The password checking routine of LILO fails to sanitize the
BIOS keyboard buffer before AND after reading passwords.
- --[ Affected Software:
* LILO 22.6.1 (current) and all previous versions
- --[ Technical description:
LILO's pre-boot authentication routines use the BIOS API to
read user input via the keyboard. The BIOS internally copies the
keystrokes in a RAM structure called the BIOS Keyboard buffer
inside the BIOS Data Area. This buffer is not flushed after use,
resulting in potential plain text password leakage once the OS
is fully booted, assuming the attacker can read the password at
physical memory location 0x40:0x1e. It is also possible for a root
user to reboot the computer by instrumenting the BIOS keyboard
buffer in spite of the full disk encryption.
- --[ Impact:
1) Plain text password disclosure.
Required privileges to perform this operation are OS dependent,
from unprivileged users under Windows (any), to root under most
Unix.
2) A privileged attacker able to write to the MBR and knowing the
password (for instance thanks to 1), is able to reboot the computer
in spite of the password prompted at boot time (and in spite of
disk encryption) by initializing the BIOS keyboard buffer with the
correct password (using an intermediary bootloader that will in turn
run LILO).
- --[ Full Technical Whitepaper
http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
- --[ Vendor response:
* No Response from author in spite of multiple solicitations.
* vendor-sec@lst.de has been intimated and distribution makers are
working on separate fixes.
- --[ Credits:
This vulnerability was discovered by Security Researcher
Jonathan Brossard from iViZ Techno Solutions Pvt. Ltd.
- --[ Disclosure timeline:
* First private disclosure to vendor on July 15th 2008
* Contacted vendor-sec@lst.de on July 29th 2008
* First Public disclosure at Defcon 16 on August 10th 2008
- --[ Reference:
http://www.ivizsecurity.com/security-advisory.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
iD8DBQFIsngtkcchhz1mT/IRAgcBAKDDFnYFqZz7Oo8LKnbxjI48vLbyuQCeLFkv
ilcv/NIQZpoBZlr66Gu62GI=
=tSJc
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
-----------------------------------------------------------------------
[ iViZ Security Advisory 08-009 25/08/2008 ]
-----------------------------------------------------------------------
iViZ Techno Solutions Pvt. Ltd.
http://www.ivizsecurity.com
-----------------------------------------------------------------------
* Title: Grub Legacy Security Model bypass exploiting wrong BIOS API
usage
* Date: 25/08/2008
* Software: Grub Legacy
--[ Synopsis:
The password checking routine of Grub fails to sanitize the
BIOS keyboard buffer before AND after reading passwords.
--[ Affected Software:
* Grub Legacy 0.97 (current) and all previous versions
--[ Technical description:
Grub's pre-boot authentication routines use the BIOS API to
read user input via the keyboard. The BIOS internally copies the
keystrokes in a RAM structure called the BIOS Keyboard buffer
inside the BIOS Data Area. This buffer is not flushed after use,
resulting in potential plain text password leakage once the OS
is fully booted, assuming the attacker can read the password at
physical memory location 0x40:0x1e. It is also possible for a root
user to reboot the computer by instrumenting the BIOS keyboard
buffer in spite of the full disk encryption.
--[ Impact:
1) Plain text password disclosure.
Required privileges to perform this operation are OS dependent,
from unprivileged users under Windows (any), to root under most
Unix.
2) A privileged attacker able to write to the MBR and knowing the
password (for instance thanks to 1), is able to reboot the computer
in spite of the password prompted at boot time (and in spite of
disk encryption) by initializing the BIOS keyboard buffer with the
correct password (using an intermediary bootloader that will in turn
run Grub).
--[ Full Technical Whitepaper
http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
--[ Vendor response:
* No Response from author in spite of multiple solicitations.
* vendor-sec@lst.de has been intimated and distribution makers are
working on separate fixes.
--[ Credits:
This vulnerability was discovered by Security Researcher
Jonathan Brossard from iViZ Techno Solutions Pvt. Ltd.
--[ Disclosure timeline:
* First private disclosure to vendor on July 15th 2008
* Contacted vendor-sec@lst.de and bug-grub@gnu.org on July 29th 2008
* First Public disclosure at Defcon 16 on August 10th 2008
--[ Reference:
http://www.ivizsecurity.com/security-advisory.html
--- End Message ---