Secret Sector Backdoor / Security Breach

Secret Sector Backdoor / Security Breach
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Secret Sector Backdoor / Security Breach Security.Concerned.User 10-22-2007
Posted by on October 22, 2007, 1:02 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Hello everyone,

Recently I've realized that Windows XP Pro (SP1) secretly writes data
to hard-disk sector(s) that were beyond its
installation-partition boundaries; at that time I used a
basic Windows XP installation on a 3-GB partition,
and the rest of the harddisk was unformatted, for all Windows cared.

I should also mention that my WinXP partition is formatted on FAT32,
but I am capable of accessing NTFS partitions, if need be, using
NTFS4DOS, (which I didn't).

Obviously I was only able to have discovered that with
an MSDOS-run Disk Editor capable of accessing all 160 million
sectors of my 80GB hard disk, and making a text-based datafile
containing sector numbers (Cyl., Head, Sector + Index),
that was runnable under pure MSDOS mode avaiable by booting
from a BootCD / BootDVD.

I wasn't quite sure what the nature of that data was,
and whether or not it was a copy of the swapfile
(e.g., PageFile.SYS), or some other data off RAM,
or maybe password(s) or other sensitive data
that I may have been working on prior to re-booting
from my BootDVD.

So my questions are:

1. Would anybody be familiar with that sector-writing stuff?
2. If so, what is the nature of the data written?
3. Would password(s) typed at MSDOS-based program(s), run within
Dos-Box windows, be secretly saved there too?
4. How Am I do prevent that from happening?
5. How Am I to erase such data?

Thanks much,
SCU


Posted by Mark Trimble on October 22, 2007, 6:30 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Quoting Security.Concerned.User on Mon, 22 Oct 2007 17:02:09 +0000:

> Hello everyone,
>
> Recently I've realized that Windows XP Pro (SP1) secretly writes data to
> hard-disk sector(s) that were beyond its installation-partition
> boundaries; at that time I used a basic Windows XP installation on a
> 3-GB partition, and the rest of the harddisk was unformatted, for all
> Windows cared.
>
> I should also mention that my WinXP partition is formatted on FAT32, but
> I am capable of accessing NTFS partitions, if need be, using NTFS4DOS,
> (which I didn't).
>
> Obviously I was only able to have discovered that with an MSDOS-run Disk
> Editor capable of accessing all 160 million sectors of my 80GB hard
> disk, and making a text-based datafile containing sector numbers (Cyl.,
> Head, Sector + Index), that was runnable under pure MSDOS mode avaiable
> by booting from a BootCD / BootDVD.
>
> I wasn't quite sure what the nature of that data was, and whether or not
> it was a copy of the swapfile (e.g., PageFile.SYS), or some other data
> off RAM, or maybe password(s) or other sensitive data that I may have
> been working on prior to re-booting from my BootDVD.
>
> So my questions are:
>
> 1. Would anybody be familiar with that sector-writing stuff? 2. If so,
> what is the nature of the data written? 3. Would password(s) typed at
> MSDOS-based program(s), run within
> Dos-Box windows, be secretly saved there too?
> 4. How Am I do prevent that from happening? 5. How Am I to erase such
> data?
>
> Thanks much,
> SCU

Problem exists between keyboard and chair.

There is NO way the OS can write beyond the partition; for the OS, the
rest of the drive does not exist.

Posted by Sebastian G. on October 22, 2007, 7:00 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Mark Trimble wrote:


> Problem exists between keyboard and chair.


Likely, but not clear from the mentioned stuff.

> There is NO way the OS can write beyond the partition;


It can. Trivially. It has RAW access to the drive, and not touching various
partition is a self-respecting limitation of the volume manager.

> for the OS, the rest of the drive does not exist.


Of course it does. It just typically doesn't care unless you instruct it to
do so.

As for what I think it could be: Windows read the partition table and found
it to be incorrect/inconsistent/imprecise, and therefore corrected it. Maybe
it was an x64 version and added an additional GUID-based partition table.
Maybe it considered the other partition as a dynamic volume and wrote a
specific signature into it.

Or, most likely, it's just the user seeing things that aren't there.

Posted by xpyttl on October 23, 2007, 10:51 am
If you were  Registered and logged in, you could reply and use other advanced thread options


> Or, most likely, it's just the user seeing things that aren't there.

A number of manufacturers include a small, non-Windows partition to store
BIOS configuration information and some limited set of Windows configuration
files. In principle, they can then restore a completely dead system to at
least working in a relatively automated fashion. I've also seen laptop
manufacturers keep their hibernate image on a "hidden" partition, although I
haven't seen that in a while.

..



Posted by Frank Slootweg on October 23, 2007, 3:30 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Security.Concerned.User@gmail.com wrote:
> Hello everyone,
>
> Recently I've realized that Windows XP Pro (SP1) secretly writes data
> to hard-disk sector(s) that were beyond its
> installation-partition boundaries; at that time I used a
> basic Windows XP installation on a 3-GB partition,
> and the rest of the harddisk was unformatted, for all Windows cared.

Was the XP partition the *first* partition (C:)? If not, then there's
your answer, because XP needs stuff on C: to boot.

Is your XP software a *retail* version (i.e. a box which you bought in
a store), or an 'OEM' version which came with your/a computer? If the
latter, than it may contain extra software which is stored in a hidden
partition. For example my HP OmniBook vt6200 has a hidden partition with
diagnostic programs.

As xpyttl mentioned, it may well be a hibernate partition. XP normally
uses a hibernate file, but IIRC it can still use a hibernate partition
(like Windows 2000).

BTW. *how* did you determine that XP/something writes beyond the
partition? You mentioned the *tool* you used ("an MSDOS-run Disk
Editor"), but not what the tool *showed*, let alone what made you look
in the first place.

[...]

Similar ThreadsPosted
XP SP2 Firewall security breach November 11, 2004, 7:50 pm
Can you keep a secret? This encrypted drive can... October 30, 2006, 11:25 pm
my linux box is bogged down, could it be a breach? August 5, 2006, 1:38 am
Is Office Max the Point of Compromise in the Debit Card Breach? February 12, 2006, 2:57 am
Does Windows still have NSA backdoor? January 14, 2007, 8:50 am
Does kernel 2.6 include an NSA backdoor? March 4, 2008, 7:19 pm
Security Breaches Pandemic - Deloitte Touche 2006 Global Security Survey June 29, 2006, 12:42 am
New site dedicated to security conferences : www.security-briefings.com May 6, 2006, 11:16 am
New It Security News and Information site for security professionals August 6, 2008, 2:46 am
Excellent website for IT Security (Security+) February 8, 2008, 12:32 am

The site map in XML format XML site map

Contact Us | Privacy Policy