Windows Genuine Cracked??

I guess it was only a matter of time.

Quote:

---

From: http://www.theinquirer.net/?article=24134

Microsoft’s anti-piracy program cracked

Indian breaks the unbreakable

By Nick Farrell: Thursday 23 June 2005, 07:16
A BANGALORE programmer has managed to break Microsoft’s anti-counterfeiting system called Windows Genuine Advantage.

Vole has always touted the WGA as unhackable, in the same way that the White Star Line considered its famous tub, the Titanic, to be unsinkable.

According to rediff.com, Debasis Mohanty managed to cracked WGA through an "easy-to-exploit" weakness in the software. So no surprises there then.

Mohanty posted a proof-of-concept programme on Vole's security mailing list.

It shows how the WGA validation check can be tricked to generate key codes on illegal copies of the software. The trick is to use a secondary Microsoft validation tool called 'genuinecheck.Exe'.

Vole has confirmed that Mohanty has managed to crack the WGA, but claimed the hack represented very little threat. So that is all right then.

---

Hi jinxy,

Like you said..." it's just a matter of time "

I once dated this woman who had three locks on her doors...top, middle, and bottom...she thought she was secure until I mentioned that all someone had to do was break a window and climb in... :D

there is no such thing as absolute security...if someone wants in bad enough, they'll find a way.

Eg ;)

Personally I will turn the Titanic into a children's story and focus on the boat being "unsinkable". Throw in a rmonace so it can have a happy ending, and it would be a perfect children's story with a very good moral.

False security is what made them take less lifeboats, since the boat was unsinkable. Had they never believed that, they would have had enough lifeboats for everyone. False security is worse than no security.

Unfortunately, nobody has learned anything from that boat.

Quote:

---

Unfortunately, nobody has learned anything from that boat.

---

I did... I learned never to get on a boat called Titanic on anything bigger than your local pond.... ;)

As above and also, the utter cringe factor of a particular Canadian womans song:)

Quote:

---

Vole has always touted the WGA as unhackable

---

I think I found the vuln :D

Fox:

Yes you did..... :D

Titanic turned away from the iceberg.

Quote:

---

Vole has confirmed that Mohanty has managed to crack the WGA, but claimed the hack represented very little threat. So that is all right then

---

:O OK what else do you want him to do ????

Quote:

---

OK what else do you want him to do ????

---

Nothing. His comment is right in line with any normal business practice. He was well coached by the Public Relations Department on what to say. However...

Quote:

---

Microsoft’s anti-piracy program cracked...but claimed the hack represented very little threat...

---

Quote:

---

...the WGA validation check can be tricked to generate key codes on illegal copies of the software...

---

Seems to me that, that is a pretty significant financial threat! I should call a stock broker and invest in Charmin. There's going to be a real shortage as MS loads their shorts.

cheers

Quote:

---

Titanic turned away from the iceberg.

---

No matter if it streed away from the ice berg or flew away from it
It did sink din't it ??

An update for this was posted on Slashdot. In case the original site gets flooded here's what they say:

Quote:

---

Microsoft "Genuine Advantage" cracked in 24h: window.g_sDisableWGACheck='all'
AV sez, "This week, Microsoft started requiring users to verifiy their serial number before using Windows Update. This effort to force users to either buy XP or tell them where you got the illegal copy is called 'Genuine Advantage.' It was cracked within 24 hours."

Before pressing 'Custom' or 'Express' buttons paste this text to the address bar and press enter:

Code:

---

javascript:void(window.g_sDisableWGACheck='all')

---

It turns off the trigger for the key check.

---

I think MS needs to go back to the drawing board about this. Perhaps, much like patching methodologies, application and OS sales may need to be rethought. Traditional methods may not be sufficient any more.

If they want to be serious, they need to start requiring hardware keys.

Let's revive The Dongle!!!

This reminds me of the fiasco with Sony, magicmarkers, electrical tape, and sh!tty music from Celine Dion.

http://www.theregister.co.uk/2002/05...ky_tape_crack/

Quote:

---

Originally posted here by Striek
Personally I will turn the Titanic into a children's story and focus on the boat being "unsinkable". Throw in a rmonace so it can have a happy ending, and it would be a perfect children's story with a very good moral.

False security is what made them take less lifeboats, since the boat was unsinkable. Had they never believed that, they would have had enough lifeboats for everyone. False security is worse than no security.

Unfortunately, nobody has learned anything from that boat.

---

Not quite true. The cheif builder guy type dude quit in a big huff because they refused to accept the fact they need more boats, because 16 was legaly enough for any ship-- even if it did have over 2500 people on it.

Hello All,

Looking into this Doc (attached) by Debasis Mohanty, it clearly shows that its not a HACK et al.

Quote:

---

From: http://www.theinquirer.net/?article=24134

It shows how the WGA validation check can be tricked to generate key codes on illegal copies of the software. The trick is to use a secondary Microsoft validation tool called 'genuinecheck.Exe'.

---

Quote:

---

From: The Doc

... 6. After downloading “GenuineCheck.exe”, run it on the machine running a genuine copy of Windows XP. It will generate a code which is used for WGA validation. Copy the code and use the same code to validate a pirated copy of Windows XP and bypass the WGA...

---

- :S:

Here's another work round: http://home19.inet.tele.dk/jys05000/

Titanic seemed pretty pathetic to me. Same with Microsoft :)

I'm mostly concerened with a pwned ISP being subject to ARP/DNS/etc. poisoning, and some cracker setting up an MitM or Pharming site, collecting authentic keys.

Quote:

---

Originally posted here by :Singh:
Hello All,

Looking into this Doc (attached) by Debasis Mohanty, it clearly shows that its not a HACK et al.

- :S:

---

I would say yes, it is really a hack. You are hacking their system to coerce it to do something it was not intended to do. You could say it was a crack, in that it is making their system provide a service/data to a node that should not receive it, via false credentials. It's a matter of semantics, but the point is the same. They say it can't be done; enter stage left 6 geeks whoe've done it without breaking a sweat.

In the sense of "I have a screwdriver and some free time, let's see what I can learn about this widget" it is absolutely a hack.

To really make this as secure as possible, each package should locally validate the licensing credentials individually, without reliance on anything external; that would increase the size and function of patches to utter uselessness...much like most of Microsofts bloatware^U software offerings.

All this WGA is news to me...perhaps I just won't update....seems to me from past experience that updating is like patching a boat leaking like a siw by filling it with lead instead...meh...

* Takes of clothes and goes linux! *

BTW: This is not even an hack as far as I am concerned but if you have a "Legit" Windows Install that is giving you problem with the WGA... Open up the Windows Updater
Go to Tools, Manage Add Ons, Disable Windows Genuine Advantage..

BINGO!!!! Your Windows Update will work as before....

I had to do this on several Dells fresh out of the box.
Easier than calling M$ and waiting a hour on hold.

Well that had to happen.

Now as far as I see the response of WGA team towards Vista security, they say that the OEM hack performed on Vista(s) is recognisable by MS. They say that the Hack which is based on the BIOS signatures which the Vista OS would use to see if the installation is on an OEM machine, can be done by changing the code in the BIOS or by changing the software.

Since changing the BIOS is more sophisticated, complex, risky and cannot be deployed on a large scale, the software is changed to achieve the results and it can be very well recognized by MS. Counterfeiters will be charged if and when caught for this.

Hope that this goes towards where they point.