From: rkingsla at cox.net (Rick Kingslan)
Subject: Product activation is exploitable

A German group broke down and explained the algorithm to a specific level of
detail - leaving out some key elements that would not allow a fully
functional exploit of the algorithm.  This was shortly before or right at
the release of XP.  It would not surprise me to find that many of the keygen
tools are based on this information, with guesses made, but not quite
correct enough to allow total coverage or compromise.

As to MS keeping the whitelist AND a blacklist of keys - yes.  They do
exactly that.

-rtk 

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Kristian
Hermansen
Sent: Sunday, September 07, 2003 12:44 AM
To: Full Disclosure
Subject: Re: [Full-Disclosure] Product activation is exploitable

There is a freely available tool that you can download to see what your
"Product Key" really is.  Most likely this tool reverses the key from the
"Product ID", which is in the registry...but I a not sure (correct me if I
am wrong).  I tried using Regmon to see what registry keys the tool is
querying, but I had no luck.  Anyone know how this tool works?  I'm sure it
is entirely possible to write a nice worm (0-day win sploit + vuln scanner)
that grabs prod ids and uploads them to arbitrary locations for later
retreival and key reversal.  I have no clue as to how windows XP product
activation and such work so these are merely guesses.

The one thing I don't understand about WPA is the fact that no one really
understands the key generation algorithm!!!  For any product that accepts
user input typed keys, there should be an available keygen (assuming the
algorith has been reversed).  So why hasn't anyone written one yet?  No one
reversed it yet?  I did manage to find a nice little prog that guesses and
finds keys by brute force (takes about 1-20 minutes to generate one valid
key), but even this is useless for WPA since activation using these keys
results in an error from MS servers stating "Unauthorized Key" (or something
like that).  WTF???  Does MS really keep track of all the keys they have
issued (aka. "whitelist")???  Someone please explain...

Kris Hermansen


----- Original Message -----
From: "Rick Kingslan" <rkingsla@....net>
To: "'Geoincidents'" <geoincidents@...info.org>;
<full-disclosure@...ts.netsys.com>
Sent: Sunday, September 07, 2003 12:59 AM
Subject: RE: [Full-Disclosure] Product activation is exploitable


> Interesting.  But, I'm not sure how effective this would be, as everything
> that I've looked at (XP, 2003) doesn't have the actual WPA keys in the
> registry - unless I'm looking in the wrong place (possible).  And, unless
> it's WPA, MS is going to have a tough time shutting anyone else off who is
> 'suspected' of using a published key.
>
> However, there's always shutting off the POWER in your city - that's
> effective, too.
>
> -rtk
>
> -----Original Message-----
> From: full-disclosure-admin@...ts.netsys.com
> [mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Geoincidents
> Sent: Saturday, September 06, 2003 6:04 PM
> To: full-disclosure@...ts.netsys.com
> Subject: [Full-Disclosure] Product activation is exploitable
>
> So I'm reading this story http://www.nccomp.com/sysadmin/dell.html about a
> company who laid off their admin and he took all their product keys and
> posted them on the internet. Well to make a long story short, somehow
> applying a hotfix caused the software to deactivate (it has to have a
> deactivation feature or what good is it?) and require activation again
which
> of course was impossible since MS shut those numbers down.
>
> It got to thinking, what if the dcom worm had grabbed the product key from
>
> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion]
> "ProductKey"="XXXXX-XXXXX-XXXXX-XXXXX-XXXXX" or
> ProductID="XXXXX-OEM-XXXXXXX-XXXXX"
>
> and posted it to a dozen random newsgroups? According to the EULA
Microsoft
> has the right to shut down every one who becomes infected and compromised
in
> this manner.
>
> Sure looks like a security issue to me, product activation makes this
> registry entry which allows all users full read access a dangerous thing
to
> have laying around unprotected.
>
> Geo.
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Powered by blists - more mailing lists