How come I'm allowed to reboot a computer that I don't own, put in a USB, boot ubuntu from it and then access all files stored on the drives available (even critical files such as system files on C drive in Windows)?
Isn't there a way to prevent people from doing this, without putting up a password on the BIOS?
The file and folder/directory permissions on an operating system are managed and enforced by... you guessed it right, that operating system (OS). When the operating system is taken out of the picture (booting a different operating system), then those permissions become meaningless.
One way to think of it: You hire a big bodyguard (OS) to protect your house. You give him a list (permissions) of the allowed guests (users) and which areas (files and folders) they're allowed to visit. How useful are those lists when the bodyguard is asleep (not booting from that OS)?
Generally, it is assumed that once an attacker has physical access to your system, they own your system. Even a BIOS password won't help you in this case. One way to solve this problem is using full-disk encryption using software such as TrueCrypt, Bitlocker, and others.
The problem, in your case, is that you'll have to setup a password (or key) to be inputted whenever you reboot the system. Weigh in your options and decide.
Because Windows only shows you what they think you should see, and other operating systems don't necessarily care and just show you what's on the disk. That is the gist of it.
It's not a Microsoft conspiracy; Microsoft protects Windows' system files from being damaged this way. You can access it if you know some fairly sophisticated tricks and manage to run explorer with "SYSTEM" permissions (these go above Administrator), or simply boot another operating system that does not implement these restrictions.
Sidenote: Viruses love these places. Almost every virus I've seen nested itself in System Volume Information, a folder in the root of each Windows drive where you cannot normally go without system permissions. Even the Administrator, who can usually get access to every file even if he denies himself all possible permissions on it, cannot go into that folder. Luckily anti-virus products also go there and they detect anything that shouldn't be there, but it's a caveat to keep in mind. For example I used to scan my computer from a remote machine with read-only permissions, but that is not enough because remotely (using SMB) you usually can't access these system protected folders.
If you want to protect people from simply reading what's on your harddrive, you need disk encryption (which will ask you for a password upon booting, just like a BIOS password would). Otherwise it will always be trivial to boot another OS and read the harddrive's contents. Even if you have a BIOS password, it's still fairly trivial to take the harddrive out. With most laptops and desktops, provided that noone is around, you can get a harddrive out, copy a few gigabytes, and put it all back within 5 minutes.
Isn't there a way to prevent people from doing this, without putting up a password on the BIOS?
There is a way to prevent people from doing this and it is called Full Disk Encryption
Here is the Mac attack vector: http://patrickmosca.com/root-a-mac-in-10-seconds-or-less/
The only sure way to prevent unwanted root access to your system is by simply enabling File Vault’s full disk encryption (not home folder encryption!).
TrueCrypt - recently there was a fundraising campaign - http://www.indiegogo.com/projects/the-truecrypt-audit - to audit the source code - http://istruecryptauditedyet.com/
Operating Systems Supported for System Encryption - http://www.truecrypt.org/docs/sys-encryption-supported-os - only Windows
Regarding BitLocker:
Why am I allowed to access protected Windows files when I boot Ubuntu from USB?
There is a car (hardware). But you happen to swap all the electronics (operating system). Now you have access to engine, steering wheel, indicators, lights and electronics itself, allowing you to wipe out other, already existing, operating systems.
This only works, if you have not enabled Full Drive encryption. This can be achieved using various methods or softwares like TrueCrypt or the Windows Bitlocker as well.
If you drive is say, encrypted using the Windows Bitlocker protection then the user who is trying to access the file system of the hard disk using the live cd won't be able to even browse the hard disk.
You can read more about the Windows Bitlocker Protection here - http://www.technibble.com/bitlocker-101-easy-free-full-drive-encryption-for-windows/
Also, what more you can do is put a hard disk password. There are many softwares available over the Internet and I guess Seagate also provides such tools for Drive encryption and protection.
If you can boot an arbitrary operating system on a machine, you have root access. This is the essence of the evil maid attack.
AFAIK nothing can prevent that, maybe only Secure Boot can, but anyway its specification requires that the user must be able to disable it on non-ARM machines.
The BIOS password can be reset by removing the battery in the motherboard, or with easy-to-use freeware programs found on the Internet.
Disk encryption does not protect attackers from replacing the very first thing that is booted, be it the Master Boot Record, the kernel/initrd, or whatever, with one that stores the password somewhere for the attacker to read it later. While it does protect your data from thieves (provided you do not insert the password after the thief compromised the system). This is because something in the boot process must necessarily be unencrypted for it to be able to ask you a password (unless the encryption key is in the hardware, as per Secure Boot).
Information security depends on plain old physical security. If you don't want folks to tamper with your computer, then do not let them put their hands on it.
The easiest way of preventing this without significantly impairing your computer's performance (Bitlocker or TrueCrypt are not free performance-wise) is buying a modern SSD and enabling the BIOS password.
All modern SSDs encrypt all data all the time (usually using AES-256 since that is a good marketing buzzword). The reason is, however, not security, but randomizing data in order to better balance the memory cells against wear.
This has two practical advantages which come for free:
Modern drives usually have a recovery key which an attacker can use to remove the existing key. Unluckily this means that although a thief can't read the data on your disk, the drive as such is still valuable, since it can be used for storage (I'd wish a stolen drive was completely worthless).
Insofar, if your password cannot be guessed (or captured by a hardware keylogger plugged between your keyboard and the USB port), the best an attacker can do is destroy all data, akin to smashing the computer with a heavy hammer.
This really comes down to use case.
If you have military hardware/OS then you can lock everything down but it comes at a cost. Maintenance of FDE, disabling ports(or removing), making them tamper proof is pretty onerous from a management and usability point of view. The OS the military use is severely locked down and hardened but they would still consider a box to be owned if it was stolen.
If you are talking about corporate and even personal then If you are concerned about data then data security should always be done at the data level and not at infrastructure/OS. Encrypt your data above FDE as well if you are that concerned about it. It probably won't stop the NSA but it might give you a few days to breath while they are hacking away.
If you are concerned about your device being altered so that you don't know about it then FDE and AV ++, IPS/IDS is what you nee
