🚀 go-pugleaf

S_TITZ@iravcl.ira.uka.de (Olaf Titz) writes:

> Just ANY sort of password protection scheme can be bypassed if you are
> able to boot the machine from a diskette. No matter if you use UNIX
> SVR4 or CP/M with a login add-on :-)

I don't see the need for the smiley; what you said is completely
true.

> If you want to make your machine secure against boot disks, you have
> to lock it up. Give a cracker physical access to the hardware and he
> can do anything he wants.

Ah, I almost had a solution to this, before DOS 5.0 came out. It is
true that if you can boot from a diskette, the protection is void
(unless it uses encryption, but even then you cannot prevent the
attacker to destroy the information). So, what the solution should
look like? Right, do not allow the user to boot from a diskette.

As I already said, before DOS 5.0 came out, I had an entirely software
solution to this. A program that scrambled the MBR and the DBR of the
hard disk in such a way, that when the user tried to boot from a
diskette, DOS just hung up. That's right, the DOS that was about to be
loaded from the diskette. The trick used an obscure bug in the earlier
DOS versions (present in all PC- and MS-DOS versions before 5.0, and
even in DR-DOS 5.0). When DOS is loaded from a diskette, it accesses
all hard disks, reads their MBRs, checks them for the presence of
valid partition tables, computes the size of the DOS partitions, if
any are found, and so on. Due to the bug mentioned above, some
particular values of the partition table could result in divide by
zero, so the computer just hung during the bootstrap process...

You couldn't solve the problem by attaching the hard disk to a
different computer, even not as a second hard disk, since this would
make this computer non-bootable too... And, if you tried to boot from
the hard disk, instead of from a floppy, the special program in the
MBR asked you about the password, and if it was correct, fixed the
partition tables and the boot sectors.

Of course, there was a way around this - you could create a special
diskette, with a custom boot sector, that does not try to load DOS,
but instead "repairs" the boot sectors of the protected hard disk...
However, you had to know how to repair them and so one. Possible to
circumvent, but definitively not easy. I have seen system hackers to
get frustrated when they were not able to boot from a floppy... :-)
And all this - achieved only by software.

Unfortunately, they have fixed the bug in DOS 5.0, so you can boot
from such a system diskette, even on a computer with a protected hard
disk... Of course, the hard disk is not accessible to DOS (you get
"Invalid drive C:"), but once you have booted DOS, the rest is easy -
you fire up your favorite disk sector editing utility and fix the
problem.

However, nowadays I don't think any more that this kind of protection
is a good idea... It has been invented before the computer viruses
became widespread. And, if you suspect that your computer is infected,
the first thing you have to do is to boot from an uninfected
write-protected system diskette... And on computers with the hard disk
protected with the kind of protection described above, you just
couldn't boot from a floppy... Not good at all...

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany