Windows 7’s flaw without a fix.

Researchers have uncovered what they seem to think is a flaw in Windows 7 that has no fix.  At the Hack in the Box Security Conference in Dubai, Vipin Kumar and Nitin Kumar demonstrated their Vbootkit 2.0 software, and used it to take control of a computer running Windows 7 at boot time.

The hack bypasses the security in Windows 7 by altering the files that get loaded into RAM at boot. The code is only 3KB in size and can allow an attacker to elevate their privileges to the system level, it can also change the administrator password, and allow access to files and folders. Once the hack has been completed the software can reset the password. As the hack only lives in RAM, a reboot will flush the malicious code, and the hack undetectable.

Currently, the code is invisible to any AV vendors software. Although the good news is that the attacker must be present at boot to administer the code. Vbootkit, or Vista bootkit was originally developed for Microsofts current OS, but 2.0 has been developed for Windows 7.

This is not the first time Windows 7 has been the focus of security concerns, the User Account Control (UAC) feature that annoyed so many in Vista was tweaked in W7 to allow it to be disabled without prompting. This cut down the annoyance factor, but allowed a malicious script to emulate keystrokes, disable UAC and force a reboot, thus leaving the operating system open to whatever payload the attacker would have you suffer.

Windows 7 will not be shipping until the end of next year or beginning of the next, so Microsoft have a bit of time to come up with a solution or workaround. However the version of Vbootkit for Vista is able to take control of a computer remotely.