Incident: Windows RT Hack Allows Running Unsigned Desktop Apps

Published Date: 2013-01-08

Postmortem Analysis
Timeline 1. The software failure incident of Windows RT being hacked to run unsigned desktop apps happened in January 2013. [Article 16442]
System 1. Windows RT operating system [16442]
Responsible Organization 1. The software failure incident in this case was caused by an individual hacker known as clrokr who uncovered the hack to run unsigned desktop apps on Windows RT [16442].
Impacted Organization 1. Windows RT users were impacted by the software failure incident as the hack allowed the tablet-based OS to run unsigned desktop apps, potentially compromising the security and stability of the system [16442].
Software Causes 1. The software cause of the failure incident was a hack that allowed someone to change code in the Windows RT kernel to run unsigned desktop apps, which were not officially supported by Microsoft [16442].
Non-software Causes 1. The hack required a certain level of programming expertise and knowledge. 2. Users needed to have local access to the system and local administration rights to implement the hack. 3. The hack involved modifying code in memory each time the device booted up. 4. Desktop applications would need to be recompiled for ARM processors, making it challenging to run existing desktop programs designed for Intel x86 processors. 5. Microsoft hinted at the possibility of eliminating the hack in a future update to Windows RT [16442].
Impacts 1. The software failure incident allowed Windows RT to be hacked to run unsigned desktop apps, which goes against Microsoft's intended design of only supporting Microsoft's own Internet Explorer and Office suite [16442]. 2. The hack required a certain level of programming expertise and had limitations such as needing to modify code in memory each time the device boots up and requiring desktop applications to be recompiled for ARM processors [16442]. 3. Microsoft stated that the hack posed no security threat to Windows RT users but hinted that it may be eliminated in a future update to RT [16442].
Preventions 1. Implementing stricter code signing and verification processes for Windows RT to prevent unauthorized modifications like the one exploited in the hack [16442].
Fixes 1. Microsoft could release a future update to Windows RT that eliminates the hack, as hinted in their statement to CNET [16442].
References 1. Microsoft statement to CNET [16442]

Software Taxonomy of Faults

Category Option Rationale
Recurring unknown <Article 16442> does not provide information about the software failure incident happening again at either the same organization or multiple organizations. Therefore, the information for both options is 'unknown'.
Phase (Design/Operation) design (a) The software failure incident described in the article is related to the design phase. The incident involved a hack that allowed Windows RT to run unsigned desktop apps by changing code in the Windows RT kernel. This hack was not intended for the average user and required specific programming skills. Microsoft acknowledged the hack but mentioned that it does not pose a security threat and hinted that it may be eliminated in a future update to RT. The incident highlights a loophole in the design of Windows RT that allowed for this unauthorized functionality to be exploited [16442]. (b) The software failure incident is not related to the operation phase or misuse of the system. The hack described in the article was a deliberate attempt to modify the system's behavior by changing code in memory, which required technical expertise and local access to the system. It was not a case of misuse but rather a demonstration of the system's vulnerability to unauthorized modifications [16442].
Boundary (Internal/External) within_system (a) within_system: The software failure incident described in the article is related to a hack that allows Windows RT to run unsigned desktop apps by changing code in the Windows RT kernel. This hack requires local access to a system, local administration rights, and a debugger to work. It involves modifying code in memory and does not pose a security threat according to Microsoft. The failure originates from within the system as it involves manipulating the system's code and functionality [16442]. (b) outside_system: There is no specific mention in the article of contributing factors originating from outside the system that led to the software failure incident.
Nature (Human/Non-human) non-human_actions (a) The software failure incident in the article is related to non-human actions. The hack described in the article allowed for the modification of code in the Windows RT kernel to enable the running of desktop apps on the tablet-based OS. This was achieved through changing a certain value in the RT kernel, indicating a failure due to contributing factors introduced without human participation [16442].
Dimension (Hardware/Software) software (a) The software failure incident related to hardware: The incident described in the article [16442] does not involve a software failure related to hardware. Instead, it discusses a hack that allows Windows RT to run unsigned desktop apps, which is more about a software exploit rather than a hardware-related failure. (b) The software failure incident related to software: The software failure incident described in article [16442] is related to software. It involves a hack that allows Windows RT to run unsigned desktop apps by changing code in the Windows RT kernel. This exploit is a software-related issue rather than a hardware failure.
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident described in the article is non-malicious. The hack to run unsigned desktop apps on Windows RT was not considered a security threat by Microsoft. The company actually applauded the individuals who discovered the hack and mentioned that it required a certain level of programming expertise and local access to the system. Microsoft also hinted that the hack may be eliminated in a future update to Windows RT, indicating a non-malicious intent behind the incident [16442].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident related to poor_decisions: - The incident of Windows RT being hacked to run unsigned desktop apps was not considered a security vulnerability by Microsoft. - Microsoft applauded the individuals who discovered the hack but hinted that it may be eliminated in a future update to Windows RT. - The hack required a certain level of programming expertise and could only change code in memory, needing modification each time the device boots up. - Microsoft emphasized that the Windows Store is the only supported method for customers to install applications for Windows RT, indicating that running unsigned desktop apps was not in line with their intended design and security measures [16442]. (b) The intent of the software failure incident related to accidental_decisions: - The incident of Windows RT being hacked to run unsigned desktop apps was not described as an accidental decision but rather as a deliberate hack by an individual named clrokr. - The hacker discovered a way to change a certain value in the RT kernel to expand the types of apps RT can run, indicating a deliberate effort to bypass the restrictions set by Microsoft. - The hacker's actions were intentional and required specific technical knowledge and skills, rather than being accidental or unintended decisions [16442].
Capability (Incompetence/Accidental) unknown (a) The software failure incident related to development incompetence is not applicable in this case as the incident described in the article is not attributed to a lack of professional competence by humans or the development organization. The hack to run unsigned desktop apps on Windows RT was a result of skilled individuals finding a way to modify the code in the Windows RT kernel, requiring programming knowledge and access to the system [16442]. (b) The software failure incident related to accidental factors is also not applicable in this case. The hack to run unsigned desktop apps on Windows RT was a deliberate action by a skilled individual named clrokr who intentionally modified the code in the RT kernel to expand the types of apps RT can run. It was not accidental but a purposeful discovery [16442].
Duration temporary The software failure incident described in the article is more of a temporary nature. The hack that allowed Windows RT to run unsigned desktop apps was a result of specific circumstances introduced by the actions of the hacker, clrokr, who was able to change a certain value in the RT kernel to expand the types of apps RT can run. Microsoft, in response to the incident, mentioned that the hack does not pose a security threat and actually applauded the individuals who discovered it. They also hinted that the hack may be eliminated in a future update to RT, indicating that it is a temporary issue that can be addressed ([16442]).
Behaviour other (a) crash: The software failure incident described in the article does not involve a crash where the system loses state and does not perform any of its intended functions. Instead, it discusses a hack that allows Windows RT to run unsigned desktop apps, indicating a manipulation of the system's intended functionality rather than a complete failure to function [16442]. (b) omission: The incident does not involve the system omitting to perform its intended functions at an instance(s). Instead, it focuses on a hack that enables the system to run desktop apps not officially supported by Windows RT, indicating a deliberate alteration of the system's behavior rather than an omission of functions [16442]. (c) timing: The failure incident is not related to the system performing its intended functions correctly but too late or too early. It revolves around a hack that modifies the system's behavior to allow the running of desktop apps on Windows RT, indicating a deviation from the intended functionality rather than a timing issue [16442]. (d) value: The software failure incident is not characterized by the system performing its intended functions incorrectly. Instead, it involves a hack that alters the system's behavior to enable the execution of desktop apps on Windows RT, suggesting a manipulation of the system's capabilities rather than incorrect performance [16442]. (e) byzantine: The incident does not exhibit the system behaving erroneously with inconsistent responses and interactions, which would align with a byzantine failure. Instead, it focuses on a hack that changes the system's behavior to allow the running of desktop apps on Windows RT, indicating a deliberate modification rather than erratic behavior [16442]. (f) other: The behavior of the software failure incident can be categorized as an intentional manipulation of the system's functionality through a hack rather than a traditional software failure such as a crash, omission, timing issue, value error, or byzantine behavior [16442].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence no_consequence The software failure incident described in the article did not result in any real observed consequences. Microsoft stated that the hack posed no security threat and did not impact Windows RT users. The company even applauded the individuals who discovered the hack. Additionally, the hack was described as not something the average user could leverage easily, as it required specific technical skills and did not pose a threat to users [16442]. Therefore, the consequence of the software failure incident was categorized as 'no_consequence.'
Domain information (a) The failed system in the article was related to the information industry. The software failure incident involved a hack that allowed Windows RT to run unsigned desktop apps, expanding the types of applications the system could support [Article 16442].

Sources

Back to List