[Security] VBootkit 2.0 claims to exploit “unfixable” hack in Windows 7
Latest hack for Windows 7 is run by a small software called VBootkit 2.0 which is just 3Kb in size and researchers Vipin Kumar and Nitin Kumar claim this hack to be “unfixable”.
“There’s no fix for this. It cannot be fixed. It’s a design problem,” Vipin Kumar said, explaining the software exploits the Windows 7 assumption that the boot process is safe from attack.
This is how the hack works, the program VBootKit 2.0 during the boot time, loads itself into the system memory and bypasses the hard drive altogether, making it extremely difficult to detect. Because nothing is changed on the hard disk itself, VBootkit 2.0 is hard to detect.

Image: Windows 7 Logo
Once the software is loaded onto the memory, any ill-intentioned attacker can access all data, change passwords, install softwares to remotely control the PC. However, when the victim’s computer is rebooted, VBootkit 2.0 will lose its hold over the computer as data contained in system memory will be lost.
While, Microsoft works on to fix the “unfixable”, one thing which can certainly give you some piece of mind, is the fact that in order to initiate such an attack, the attacker needs to have physical access to your PC. Though, once the attack is performed, he can certainly control your PC remotely.
You can follow me on Twitter at http://twitter.com/vaibhav1981
Do stay tuned to Technofriends for more, one of the best ways of doing so is by subscribing to our feeds. You can subscribe to Technofriends feed by clicking here.
Related posts:
- George Hotz releases Sony PlayStation 3 Exploit Hack
- Zero day exploit for Firefox 3.6 Discovered by Russian Security Firm
- [Yahoo Hack Day] Open Hack 2009 on 14th and 15th Feb 09
- [Freeware] Check Your Windows Boot Speed With BOOTRACER
- Microsoft Releases Patch for IE vulnerability which caused Google Hack
Probably doesnt work when a TPM chipset is used on the motherboard, the Vista VBootKit also did seem to work when the TPM was active.
http://blogs.technet.com/robert_hensing/archive/2007/04/05/vbootkit-vs-bitlocker-in-tpm-mode.aspx