5

I just learned about Kon Boot (from this YouTube video) and am wondering, how is such a hack tool guarded against? In the video the presenter claimed he had full disk encryption but was still able to by pass the password from booting to the USB stick and then had access to the files.

Would such a tool be able to hack a virtual machine?

OscarAkaElvis
  • 5,185
  • 3
  • 17
  • 48
Celeritas
  • 10,039
  • 22
  • 77
  • 144
  • I'm quite doubtful regarding this video made by someone trying to sell his own security product (see the comment associated to the video). According [here](http://www.piotrbania.com/all/kon-boot/) and [there](http://www.kryptoslogic.com/download/KonBootHelp.pdf) Kon Boot is not magical and do **not** support disk encryption. – WhiteWinterWolf May 16 '15 at 11:20

2 Answers2

4

how is such a hack tool guarded against?

  • Prevent your computer to boot from an external media by setting appropriate options at the BIOS level and protecting this configuration using a BIOS password,
  • Use Trusted Boot where TPM chip is available (most professional laptops have one, this Dell Latitude has one),
  • Use full disk encryption, this recommendation being the most important one.

As a side note, Kon Boot documentation states that it does not work on system where the BIOS available memory is too small. Whether this limitation can help to guard against this attack, I'm not sure...

Regarding the video the author claims to have already enabled the two latter recommendations using Dell's Control Point Security Manager, but it seems obviously untrue (encrypted disks are officially unsupported by Kon Boot, see here, here and there), either because the video author mistakenly did not setup these features correctly, or for other reasons. As a side note, he promotes a commercial encryption product in his video description, so...

Would such a tool be able to hack a virtual machine?

Yes, if someone get administrative access to the virtual machine is able to boot it from an external media it will work the same as way with a physical PC (I have not tested it myself, but encountered blog posts where people actually used VM to safely test this tool and bypassed their password successfully).

WhiteWinterWolf
  • 19,082
  • 4
  • 58
  • 104
0

This question is now answered in their FAQ:

How can I protect against Kon-Boot?

You can use hard disk encryption software like FileVault (Apple) / Bitlocker (Microsoft) / TrueCrypt or set BIOS/UEFI password in order to stop other people from using Kon-Boot on your computer.

Whatever you do remember old, basic security law: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore..

HackSlash
  • 268
  • 1
  • 10