full-disclosure - Re: cloning PC / run in VMware

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 25 Jul 2006 13:11:02 +0200
From: Nicolas RUFF <nicolas.ruff@...il.com>
To: endrazine <endrazine@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: cloning PC / run in VMware

>> Don't tell me a simple greyed out checkbox can stop you ...
> ^---> foudstone's showwin.exe usually does the trick

Actually, it's a bit harder.

At export time, the Crypto provider will check the "non exportable"
flag, even if you have "ungreyed" the checkbox.

>>From here you have 2 choices :

- Searching for the private key blob in the process memory.

- Patching the Crypto provider to kill the check (harder, because of WFP
and some internal checksums inside Crypto providers - e.g. RSAENH.DLL).

I have not heard of any readily usable code on the Internet, but looking
at the slides it should not be too hard to reproduce.

Regards,
- Nicolas RUFF

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/