The attacker simply puts the Windows 2000 CD into the drive and boots up the target system with it. When prompted, they select the recovery console option and immediately gain access to a command prompt without being queried for a password.
The attacker can then read and write data to and from the hard disk, including administrator data.
Although the flaw relies on physical access to be exploited, it is sure to cause headaches with network administrators enforcing a "user accounts only" policy in a corporate environment.
It has always been possible for attackers with physical access to a system, especially one with a bootable CD-ROM, to compromise it with relative ease by using other bootable CD's such as BiatchUX, the popular Linux based forensic recovery tool. However the ease of exploitation of this glitch is sure to cause concern among system administrators.
Security consultant Daniel Lewkovitz says administrators can minimize their exposure to these types of "physical access" vulnerabilities by taking a few simple measures.
"Any physical access to a machine gives a would-be attacker access to data such as passwords, and allows them to use bootable floppies or CDs," he said.
"All of these vulnerabilities can be reduced by strongly controlling physical access to the machine. Floppy drive locks and locking rack cabinets are a good start," he said.
He says that disabling the boot function on CD-ROMs and setting a BIOS password makes it much more difficult for attackers to exploit this vulnerability, but does stress that an attacker with physical access to a machine has many methods of attack available to them.
Windows 2000 is not affected by this issue.
Talk about overkill by the media. So what if a "hacker" can boot up a WinXP box with a Win2k recovery console. Isn't that the "hacker" got physical access to the machine in the first place FAR more important?