If you are a windows user than I’m sure you are familiar with blue screen of death. A Romanian hardware expert has published a proof-of-concept code that crashes most of the Windows computer within seconds. , even if the computer is in a lock state.
This interesting code exploits a vulnerability in Microsoft’s handling of NTFS filesystem images and was discovered by Marius Tivadar, a security researcher with Bitdefender.
Affected Systems
1. Windows 7 Enterprise
2. Windows 10 Pro
3. Windows 10 Enterprise
The researcher only tested on the above mentioned system so there is a high chance that other systems too are affected by it.
What exactly is the flaw ?
The PoC contains a malformed NTFS image that users can take and place it on a USB thumb drive. Inserting this USB thumb drive in a Windows computer crashes the system within seconds, resulting in a Blue Screen of Death (BSOD).
“Auto-play is activated by default,” Tivadar wrote in a PDF document detailing the bug and its impact.
“Even with auto-play [is] disabled, [the] system will crash when the file is accessed. This can be done for [example,] when Windows Defender scans the USB stick, or any other tool opening it.”
Microsoft declined to fix !
Yes you read it right, Microsoft declined to fix the flaw stating that it requires physical access / social engineering. Tivadar contacted Microsoft about the issue in July 2017, but published the PoC code today after the OS maker declined to classify the issue as a security bug. What makes it more dangerous is that it works even when the PC is locked. So imagine the situation when you lock your system and so somewhere hoping no one can access or cause any damage to your PC, someone can come and plug their pendrive and crash your system completely.
“I strongly believe that this behavior should be changed, [and] no USB stick/volume should be mounted when the system is locked,” the researcher said. “Generally speaking, no driver should be loaded, no code should get executed when the system is locked and external peripherals are inserted into the machine.”
