iViZ Discovers Pre-Boot Authentication Vulnerability

iViZ, an Indian information security start-up offering on-demand Penetration Testing, has announced its discovery of a new class of vulnerability at the recently held Defcon 16, a global security conference. This vulnerability allows attackers to steal computer boot passwords and bypass the security of pre-boot authentication software like hard disk encryption tools. It affects general computer users, enterprises, governments and can result in unauthorised access or theft of confidential data. Incidentally, in 2007, the global loss due to data theft is estimated to be $40 billion.

“Surprisingly, this vulnerability has been existing for 25 years,” says Jonathan Brossard, iViZ lead security researcher and discoverer of this vulnerability. “Programmers unaware of this have coded boot password feature such that user password is not flushed properly leading to inadvertent text leakage and theft from memory. Even hard-drive encryption does not help here.” This vulnerability affects Microsoft Bitlocker on the latest TPM (but not Vista SP1), Truecrypt, Intel/HP BIOS and several others.

More from Biztech

Future Group - Reliance Retail Deal approved by CCI RBI ban on cryptocurrencies takes effect; prohibition could force investors to tap the black market

As a part of responsible disclosure practice, iViZ has already briefed all the affected vendors. “We appreciate vendors like Microsoft, Intel, HP proactively providing fixes to users. iViZ is committed to initiatives making the Web safe and conducts research that helps secure organisations worldwide,” said Bikash Barai, CEO of iViZ.

Bill Sisk, security response communication manager at Microsoft, via his e-mail to RedmondMag, encouraged “customers to update their systems accordingly”.