Security loophole found in Windows operating system

Nov 12, 2007

A group of researchers headed by Dr. Benny Pinkas from the Department of Computer Science at the University of Haifa succeeded in finding a security vulnerability in Microsoft's "Windows 2000" operating system.

The significance of the loophole: emails, passwords, credit card numbers, if they were typed into the computer, and actually all correspondence that emanated from a computer using "Windows 2000" is susceptible to tracking.

"This is not a theoretical discovery. Anyone who exploits this security loophole can definitely access this information on other computers," remarked Dr. Pinkas.

Various security vulnerabilities in different computer operating systems have been discovered over the years. Previous security breaches have enabled hackers to follow correspondence from a computer from the time of the breach onwards. This newly discovered loophole, exposed by a team of researchers which included, along with Dr. Pinkas, Hebrew University graduate students Zvi Gutterman and Leo Dorrendorf, enables hackers to access information that was sent from the computer prior to the security breach and even information that is no longer stored on the computer.

The researchers found the security loophole in the random number generator of Windows. This is a program which is, among other things, a critical building block for file and email encryption, and for the SSL encryption protocol which is used by all Internet browsers. For example: in correspondence with a bank or any other website that requires typing in a password, or a credit card number, the random number generator creates a random encryption key, which is used to encrypt the communication so that only the relevant website can read the correspondence. The research team found a way to decipher how the random number generator works and thereby compute previous and future encryption keys used by the computer, and eavesdrop on private communication.

"There is no doubt that hacking into a computer using our method requires advanced planning. On the other hand, simpler security breaches also require planning, and I believe that there is room for concern at large companies, or for people who manage sensitive information using their computers, who should understand that the privacy of their data is at risk," explained Dr. Pinkas.

According to the researchers, who have already notified the Microsoft security response team about their discovery, although they only checked "Windows 2000" (which is currently the third most popular operating system in use) they assume that newer versions of "Windows", XP and Vista, use similar random number generators and may also be vulnerable.

Their conclusion is that Microsoft needs to improve the way it encodes information. They recommend that Microsoft publish the code of their random number generators as well as of other elements of the "Windows" security system to enable computer security experts outside Microsoft to evaluate their effectiveness.

Source: University of Haifa

Explore further: Mobile app could speed O'Hare passport lines

Related Stories

Redirect to SMB vulnerability in Windows discovered

Apr 14, 2015

News stories on tech spots on Monday reported that the Irvine, California, security company Cylance's SPEAR research team discovered a vulnerability relating to all versions of Windows including the Windows ...

Fighting the next generation of cyberattacks

Apr 16, 2015

The next generation of cyberattacks will be more sophisticated, more difficult to detect and more capable of wreaking untold damage on the nation's computer systems.

Paperspace computer aims to resolve hardware distractions

Mar 05, 2015

A promotional video for Paperspace made its point quickly. A woman sitting at a computer sighed as she pressed down on the keys impatiently, as the straight-faced announcer noted computers can be such a pain. ...

Recommended for you

Google's Waze app to alert kidnappings in LA

Apr 22, 2015

Alerts about hit-and-runs and kidnappings in Los Angeles will soon pop up on traffic app Waze, along with road closure information, the West Coast city's mayor said.

How the first smart shopping mall in Europe works

Apr 21, 2015

Researchers from Zendos Tecnología and the IMDEA Networks Institute have developed an innovative tool to analyze the behavior of customers and visitors to shopping malls. The result is a technological platform called Ubicua ...

Energy-tracking app encourages sustainable behaviors

Apr 21, 2015

For a generation motivated by technology and fast-moving information, a professor at the University of Wisconsin-Madison has created an energy-tracking app to make reducing day-to-day energy usage more accessible.

User comments : 2

Adjust slider to filter visible comments by rank

Display comments: newest first

Argiod
1 / 5 (2) Nov 13, 2007
"Security loophole found in Windows operating system..."

So, I thought this was a forum for news. There's nothing new about Windows security loopholes. Anyone who uses Windows has to download security updates at least once a week. The simple cure is to switch to Ubuntu Linux. I have, and no longer have to worry about security problems. And my system runs about two to four times faster now.
superhuman
not rated yet Mar 18, 2008
This one is HUGE though, being able to predict random numbers and security keys is a dream come true for hackers. Seriously microshit needs to hire some professionals.

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.