Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security Microsoft

Crack Windows XP With... Windows 2000 518

Posted by timothy from the if-you're-sitting-at-the-machine-anyhow dept.
An anonymous reader writes "According to this story seen on Brian's Buzz on Windows, access to a Windows 2000 CD is all that is needed to bypass all (well, most) Windows XP security features. An attacker can boot up XP and start the Windows 2000 Recovery Console which allows them to operate as any user, even Administrator, without requiring them to enter a password. This method even allows someone to copy files to removable media, something which normally the Administrator can't even do in the Recovery Console."
This discussion has been archived. No new comments can be posted.

Crack Windows XP With... Windows 2000 More

Crack Windows XP With... Windows 2000

Comments Filter:

  • So what? (Score:5, Insightful)

    by nweaver ( 113078 ) on Saturday February 15, 2003 @05:28PM (#5310364) Homepage
    It is generally assumed that if you have console access to the machine, you can breach the security and acquire root. Many systems allow you to do this, deliberately.

    You can make a nice Linux boot-floopy or boot-cd to do the same thing.

    • Re:So what? (Score:2, Insightful)

      by Anonymous Coward
      Anyone knows this man, if the enemy touches your computer, it's not your computer anymore.

      I don't want to sound like a flamer, but WTF is this doing on /. timothy?

      This whole article is a flamebait.

      In other news, if you leave your top of the line mercedes with the most sophisticated anti-burglary system in the world, with keys in the ingnition in the middle of the bronx, it WILL get stolen.

    • Re:So what? (Score:4, Interesting)

      by lonoak ( 38287 ) on Saturday February 15, 2003 @06:00PM (#5310558)

      In Linux (also in win) you have many different ways to protect your partitions:

      http://koeln.ccc.de/archiv/drt/crypto/linux-disk.h tml [koeln.ccc.de]

      I think that the difference is important; in Linux everybody know the way to mount partitions and retrieve/change the info inside them. In windows it's suppossed you can't do that.

      • Re:So what? (Score:5, Insightful)

        by afidel ( 530433 ) on Saturday February 15, 2003 @06:52PM (#5310836)
        No it is NOT assumed that partitions can not be mounted, in fact it has been possible to use NTFS for DOS drivers from sysinternals to mount partitions since NT4. That is why if you want security you turn on EFS and encrypt any important directories.
    • News Flash... I just found an incredible security hole in all current versions of OS X; I can basically have root on any OS X machine simply by booting into OS 9! You can go into any folder, change the contents, edit configuration files, and so on. Scandalous!!

      Seriously I don't see how this is any different.
    • Go here [eunet.no]:

      1. Put a diskette in your floppy a:
      2. Open up rawrite.exe in the command prompt
      3. Use the attached .bin file to make a boot disk (much the same way you'd make any sort of Linux boot disk). Something like rawrite2 -f bd011022.bin -d A: (from UNIX dd if=bd011022.bin of=/dev/fd0 bs=1024 )
      4. Take out boot disk and put it in the computer that you would like to hack.
      5. Boot to the disk and follow the instructions. This disk directly edits the registry (which, of course, have the SAM (Security Account Manager)...which handles handles user and group accounts, and provides user authentication for LSA [techtarget.com].).

  • And as usual... (Score:3, Insightful)

    by vslashg ( 209560 ) on Saturday February 15, 2003 @05:28PM (#5310369)
    ...if someone has physical access to your machine, all other security is off.

  • so what (Score:5, Insightful)

    by ZeekWatson ( 188017 ) on Saturday February 15, 2003 @05:29PM (#5310370)
    I can reboot linux into single user mode without a password also.

    The first rule of security is removing console access.
    • You can have encrypted boot for lilo/grub, or have encrypted partitions. Of course, I suppose that exist encrypted filesystems also for XP.

  • Security? (Score:2, Funny)

    by Anonymous Coward
    Windows? Security? I thought we allready decided that thoes two dont mix.

    --SupraX

  • How does this have anything to do with Security? (Score:5, Insightful)

    by tsmit ( 222375 ) <tsmit50.yahoo@com> on Saturday February 15, 2003 @05:30PM (#5310383) Homepage
    Anyone in the security industry worth their salt knows that physical security is the FIRST step to securing a box. If someone (hacker) can walk up to a machine a press the power button to force a reboot, you've already got a denial of service (if the machine is processing something important, that is). Anything beyond is just icing on the cake.

  • Non story (Score:2, Insightful)

    by Pharmboy ( 216950 )
    This is a non story. If you can sit in front of a linux box you can do the same thing. Just boot into maintenance/init 1 and go crazy.

    • Not that easy. With Debian, at least, you will be asked for the root password. If the machine is set to boot from HD and a BIOS password is set you will have to open the case.

  • Silly Microsoft (Score:5, Interesting)

    by goldid ( 310307 ) <matthew@@@goldmaninternet...com> on Saturday February 15, 2003 @05:30PM (#5310385) Homepage
    I have to agree with Microsoft that if the bad guys have physical access to your computer you have some serious problems. however, let's note this scenario.

    1. Important computer. Locked down
    2. Bad employee, always has to computer for job.
    3. Employee "works late" one night
    4. Employee brings in Win2K CD
    5. Employee hickjacks data to floppy unlogged
    6. Employee blackmails company or other bad thigns

    I am just amazed that what was secure in 2000 is less secure in XP.

    Good ol', silly Microsoft.
    • Why wasn't this important system in a locked room?

      You can do this with any system... Even Slashdot's precious Linux.
      • And indeed you can do it to a linux system with a DOS bootdisk with Fdisk one.

        You won't get any files that way admittedly.

        Or if you have time, a DOS boot disk with drive image on and a spare HD.

    • Re:Silly Microsoft (Score:2, Interesting)

      by Anonymous Coward

      One of the first steps to securing a PC is to change the configuration to only boot only to harddisk, thus eliminate this risk.

    • Re:Silly Microsoft (Score:3, Insightful)

      by tshak ( 173364 )
      5. Employee hickjacks data to floppy unlogged
      6. Employee finds out that data is all encrypted and is unable to use the data to his/her advantage.

      NTFS encryption is available, and much safer means of encrypting your files are also available. Encryption is your only defense against someone who has physical access to your machine.

  • Windows has numerous security flaws but... (Score:5, Interesting)

    by GreyWolf3000 ( 468618 ) on Saturday February 15, 2003 @05:31PM (#5310387) Journal
    This isn't one of them. If I have access to a box physically, I can destroy all of the content with a sledgehammer. I can also mount any partition for any operating system and start messing around. Ever tried booting into rescue mode in Windows? That works too. Use digital security means for digital access, physical means for physical access. That means a security guard and at the very least lock and key.

  • Always remember ... (Score:2, Interesting)

    by GreatOgre ( 75402 )
    that physical access is the best, and sometime the easiest, way to gain control of a computer.

    For the most part, I think this may have been more of an oversight on the software engineering team not to come up with all of the possibilities that one could try to gain access to the computer. Still, this should not even remotely be a possibility!!
  • An attacker can boot up XP and start the Windows 2000 Recovery Console which allows them to operate as any user, even Administrator, without requiring them to enter a password.

    Is this something you can't do to a Linux box with boot & root disks? Just mount / and you can do anything you want.

    The bottom line is, if you have physical access to the hardware, most OS-level security can be defeated. The only way to secure a machine that isn't under your physical control is by using always-encrypted filesystems. Anyone who writes software that deals with cash or sensitive information has known for decades that you never trust the client device, and you keep the servers in a secure facility, with armed guards if necessary.
    • (At least with LILO) a boot disk is usually not required; just hold shift, press tab, choose image, enter image-name, append init=/bin/bash. Done. And nothing gets logged so when you're done just shut off the machine and nobody will even know you were there (unless they check when patyitions were last mounted).

  • And... ? (Score:2, Informative)

    by powerlinekid ( 442532 )
    If you have physical access to a machine you can crack it. This has been demonstrated before. I mean you could pop Knoppix in, mount the windows partition and copy files that way. If you don't want anyone accessing your files make sure you lock the damn machine down (physically and network wise).

  • Not a big deal! (Score:5, Informative)

    by Longinus ( 601448 ) on Saturday February 15, 2003 @05:33PM (#5310405) Homepage
    You can do the same thing to Linux with a boot floppy. Also, Ars [arstechnica.com] is carrying this story, but with the follow observations from readers:

    "Update: Some posters in the discussion thread point out this report may not be valid. One said that booting from a 2K CD did ask them for an administrator password and didnt let them in without it. Unfortunately, I dont have XP installed here to test it out before I posted."

    Either way I don't find this to be terribly upsetting because a) root access can be gained in a similar manner with Linux and b) if one is worried about security, they shouldn't being using Windows to begin with.

    • Re:Not a big deal! (Score:5, Funny)

      by tmark ( 230091 ) on Saturday February 15, 2003 @06:12PM (#5310628)
      You can do the same thing to Linux with a boot floppy.

      You do realize, I hope, that the fact that Linux is, and has always been, vulnerable to a boot disk "attack" (just like /.'s other beloved OS, OS X) is irrelevant here, as neither vulnerability outlines the crappiness of Windows.

  • Goodbye NTFS encryption? (Score:3, Informative)

    by GraZZ ( 9716 ) <jack@@@jackmaninov...ca> on Saturday February 15, 2003 @05:35PM (#5310416) Homepage Journal
    This sounds particularly bad, as I'm assuming that it allows you to get by the NTFS filesystem-level encryption. This feature is *supposed* to allow you to encrypt files, and make it impossible for others to decrypt, even if they steal your drive, reinstall Windows on it, etc.

    If you can just get Administrator access without reinstalling the OS (and killing the old UID tables), then this data suddenly becomes vulnurable!

  • Not just XP (Score:2, Interesting)

    by Phroggy ( 441 )
    On Mac OS X it's even easier (isn't everything?): Hold down Command-S while booting to get a root prompt in single-user mode. Or you can boot from an OSX CD and reset the root password.

    Remember that on most Linux machines, you can boot from a floppy or CD, mount the hard drive, and do whatever you want, including change the root password or replace system binaries with hacked versions. Of course a PC can be locked down (disable booting from floppy/CD in BIOS, set a CMOS password, padlock the case) while a Mac can't (that I'm aware of), but how many people do that?

    If you have physical access to the console, all bets are off. Don't underestimate the importance of physical security.

  • DMCA (Score:5, Funny)

    by _UnderTow_ ( 86073 ) on Saturday February 15, 2003 @05:36PM (#5310420)
    So, is a windows 2000 install disk now illegal under the DMCA as a circumvention device?

    • Re:DMCA (Score:5, Funny)

      by Shelled ( 81123 ) on Saturday February 15, 2003 @05:54PM (#5310528)
      Apparently so is the F8 key when used during a reboot.

    • Re:DMCA (Score:3, Funny)

      by Exiler ( 589908 )
      Since when is XP a copy protection scheme?

  • umm no.. (Score:5, Informative)

    by Suppafly ( 179830 ) <slashdot.suppafly@net> on Saturday February 15, 2003 @05:36PM (#5310421)
    An attacker can boot up XP and start the Windows 2000 Recovery Console which allows them to operate as any user, even Administrator, without requiring them to enter a password.

    Speaking from experience, the win2k recovery console makes you enter the admin password before it will let you do anything, unless they are using some version of the recovery console other than the one that comes with windows 2000 professional.

  • Different Uses (Score:5, Insightful)

    by Peridriga ( 308995 ) on Saturday February 15, 2003 @05:36PM (#5310422)
    I see alot of "I can boot linux into matnience mode and do whatever I want" and physical access restrictions etc...

    All true but, the application of XP was for desktop use -> Server Use. Linux (don't flame) is being primarily used for backend server systems. I don't see many secretaries choosing what boot level to start up in the morning.

    XP was supposed to provide a secure desktop enviroment for a networked organization (Enterprise Offices, Schools, Universities, Etc..)

    The fact that I can walk up to any (supposedly) secure desktop (that access isn't always tightly safegaurded) and gain Administrative Access (usually meaning also access to your entire network behind the firewall) is a big deal. Especially since it requires nothing less than the previous version of the software.

    Look more carefully at the big picture before spouting off the party line....

    • Sigh. (Score:5, Insightful)

      by NetJunkie ( 56134 ) <jason.nash@gmai l . c om> on Saturday February 15, 2003 @05:40PM (#5310456)
      This gives you LOCAL administrator access. Meaning, you can do what you want on THAT system. It doesn't give you the keys to the whole network. Just like rooting a Linux workstation doesn't mean you just rooted everything on the network.
      • Any foothold is a foothold...

        They teach you that the first day :-)
      • ---Just like rooting a Linux workstation doesn't mean you just rooted everything on the network.

        It does if you allow it by use of root owned ssh keys, or by the R servers. In the similar way, if you root a WinNT machine, you can grab the SAM and convert it to unix passwd type, and JOHN it. If network logins are in there, you've hit gold mine.

      • And that stops network access how? (Score:4, Interesting)

        by nlinecomputers ( 602059 ) on Saturday February 15, 2003 @06:04PM (#5310585)
        Well if you go local access then I can install a keylogger or change passwords or create users that can get net access on the next reboot. Once you got local the network isn't far behind.

        Not that most Linux boxes are any better. Most can be breached with a floppy.

      • Re:Sigh. (Score:5, Insightful)

        by sean23007 ( 143364 ) on Saturday February 15, 2003 @06:23PM (#5310687) Homepage Journal
        Having root access on one machine on the network is a good first step for someone who wants to gain more access all over the network. With root access, keylogger services can be installed and run on that computer, logging everyone's username and password who uses that computer. Additionally, packet sniffers can be installed that can do the same for neighboring computers. Just because this doesn't give a hacker total access to the network immediately doesn't mean it isn't a security concern for the network...

    • -1 Overrated (Score:5, Insightful)

      by Sanity ( 1431 ) on Saturday February 15, 2003 @05:52PM (#5310517) Homepage Journal
      Come on, we know you love Linux but give it up! - Windows is no more or no less vulnerable than Linux when you have console access as has been pointed out repeatedly. If you can gain access to a computer, be it Linux or Windows XP, you can access the data on that computer.

      By trying to claim that this is somehow a win for Linux, you are simply proving your that you are willing to ignore facts when advocating Linux. This makes you just as bad as Microsoft's marketing drones.

      • Re:-1 Overrated (Score:4, Funny)

        by Tony-A ( 29931 ) on Sunday February 16, 2003 @12:04AM (#5312379)
        Windows is no more or no less vulnerable than Linux when you have console access as has been pointed out repeatedly.

        Windows is vulnerable when you have console access.
        Linux is vulnerable when you have console access.
        All vulnerabilities are created equal.
        Windows is just as vulnerable as Linux. (or CP/M or DOS)

        Actually Linux is effectively less vulnerable since people tend to question why it was rebooted. A freshly rebooted Windows system is considered "normal".
    • In a networked organisation, data is generally stored on servers, not on workstations. Servers are usually reasonably secure physically (I know this isn't always the case, but they are generally more secure than workstations), so I don't see your point. (You did realise that this would only give you access to the local machine, not the entire domain or forest did you ?)

      Only some places store important data on workstations:
      - Small businesses with peer to peer networks (I guess this would be bad for them)
      - High security places where data cannot be shared on a network (These places generally don't believe in electronic security so they take their physical security to a very high level)
      - Places where users are either poorly trained or incredibly stubborn (These places have only themselves or the lusers to blame)

    • Re:Different Uses (Score:5, Funny)

      by martinflack ( 107386 ) on Saturday February 15, 2003 @06:16PM (#5310652)
      I don't see many secretaries choosing what boot level to start up in the morning.

      I do, where I work. Some days it's high heels, some days its sandals, generally the boot level gets higher at the end of the week... in fact on Friday they're often wearing those sexy "fuck me" high boots in preparation for going out later.

  • Knoppix (Score:2, Informative)

    by zulux ( 112259 )
    Even easier - download Knoppix, Burn the ISO and boot off the Knoppix CD.

    Presto!

    It even mounts all the FAT/NTFS partitions and puts little icons on the KDE desktop for you. Click, browse and copy!

    (Knoppix is a rather full Linux x86 distribution that boots off of a CD and doesen't need any hard drive to work. You get a greay KDE desktop and a lot of tools.)

    • Re:Knoppix (Score:5, Informative)

      by Proc6 ( 518858 ) on Saturday February 15, 2003 @06:14PM (#5310638)
      And let me be the first to say, Praise Jesus for Knoppix. I had a pair of mirrored disks created in Win2K Server. After the server exploded I put them into an XP Box (NTFS is NTFS right? Wrong.) - I used XP's disk admin to "reactivate disks", as soon as I did that, they became completely unreadable with either XP, or even in a different 2000 server at that point. Many various attempts at various things basically left me with NTFS disks I simply couldnt read with Win2000 or XP.

      I booted Knoppix. It saw the NTFS partitions fine. The disks appeared on the Knoppix desktop. I opened an FTP connection to another machine, copied off the important files, and was done.

      I will ALWAYS have a copy of Knoppix around.

  • And with our late-breakings story is reporter, Mr. Blatantly Obvious:

    "It's just horrible out here! Who would have guessed that the greatest remote access security measures available today could do nothing to protect the integrity of MasterCard's server from a man with a CD-writer!"

  • Err... (Score:5, Informative)

    by Wakko Warner ( 324 ) on Saturday February 15, 2003 @05:37PM (#5310432) Homepage Journal
    Why not just use one of *several* NT password recovery disks? They work on XP, as well. I've used this one [eunet.no] to bust into several Win2k Pro machines we'd forgotten the password for.

    - A.P.

  • Hey look everybody, Linux has a hole too! (Score:5, Insightful)

    by His name cannot be s ( 16831 ) on Saturday February 15, 2003 @05:38PM (#5310435) Journal
    Hey look everybody, Linux has a hole too!

    At the grub prompt:

    boot: linux single

    duh!

    Seriously, how is this news? Nearly every system I've worked with can be comprimised with access to the physical box.

    *yawn*
    • Except that you an put a password on grub to prevent people doing this.

      From the GRUB info page:

      password --md5 PASSWORD
      If this is specified, GRUB disallows any interactive control, until
      you press the key

      and enter a correct password. The option `--md5'
      tells GRUB that `PASSWORD' is in MD5 format. If it is omitted, GRUB
      assumes the `PASSWORD' is in clear text.

  • Physical access (Score:5, Informative)

    by Tyreth ( 523822 ) on Saturday February 15, 2003 @05:38PM (#5310438)
    I know that physical access makes a machine vulnerable in most cases. But that is because people don't password their bootloader, don't password their bios and disable boot disks.

    Take these precautions and you can be fairly secure with physical access. Add an encrypted file system so that if someone steals your hard disk you are safe. Then padlock the PC.

    Those are reasonable steps for a Linux machine (and I may have missed some, please let me know if i did). Now with a windows xp machine it looks like you also need to disable cdrom access. An unreasonable step.

    But am I misunderstanding this? Does this mean that there is a way for programs to be made to bypass Administrator password? If so why would this be limited to a windows 2000 disk? What's stopping someone from making a program that enters into Recovery Console, removing the need to be physically present or have a windows 2000 CD. Unless you actually have to boot from CD, but the article makes it sound like you can use the CD after the PC boots.

  • Who is this guy anyway? See the photo in the upper right hand corner of the page, with the cherubic face? Doesn't he look like a white Gary Coleman?

    Oh who am I kidding... noone will go and read the article anyway, and I'm probably the only one reading slashdot old enough to remember "Diff'rent Strokes"

  • This IS a bigger issue (Score:4, Interesting)

    by standards ( 461431 ) on Saturday February 15, 2003 @05:39PM (#5310450)
    Although I originally thought "well hey, if your data center isn't secure, and you can't trust your operators, well, you're hosed!"

    But then I got to thinking about this a little bit more. Microsoft's primary customer is the one that doesn't have a secure data center. Additionally, it's not out of the ordinary to reboot Windows XP computers.

    Just think... I run a small business (about 10 people) and I electronically secure my XP server the best I can.

    Then the secretary calls and says "oh, I just installed XYZ for you, so I rebooted the server". OK, no big deal.... that happens all the time.

    But THEN, instead of simply rebooting, he manages to steal all of my corporate data...

    Ouch!

    So those who live in the datacenter might see this as a problem that we solve with physical security. But for the regular small XP shop, well, you just can't have physical security without spending $$$.

    Of course, in my shop, we reboot on average once or twice a year. So it's a little harder to reboot with the goal of ripping data. Then again, our operators have root access...
    • Uh...what? The fact you can't physically secure your system is your problem. No one elses. Put it in a locked room. A locked closed. A locked safe with a hole in the back for power. :)

      Any system, ANY system, can be hacked with physical access. If you want more protection encrypt the filesystem. That's about the best defense. If I have physical access I can pick up the computer and walk out with it. Then I can spend all the time I want cracking it.

  • This strange? (Score:3, Informative)

    by ciryon ( 218518 ) on Saturday February 15, 2003 @05:39PM (#5310452) Journal
    It requires physical access to the computer. You can do the same from many operating systems, for instance Linux [virginia.edu] and Mac OS X [macosxhints.com].

    But the thing is probably that micro$oft said this thing would be impossible since winxp is so secure. Whatever.

    Ciryon

  • This is no different for any decent OS.

    If you have physical access to a Unix system you can get root access using similar bootable media approaches and edit password files to your heart's desire.

    If you have physical access you can defeat security.
  • I have a computer class where every student needs to use cd's and floppies. These win2k boxes have typical security policies that don't let us modify system options, install programs ect. It would suck if we had to ask a teacher everytime we need to stick a disk in or shut down the machine. You can't always get rid of physical access.
  • Linux, Solaris...etc. I bought some used Sun workstations that had both prom passwords and root passwords. Both were easily overcome with pulling the prom (giving it a null password) then booting from a solaris cd, remove the root password from the shadow file, plug the prom back in, use the eeprom command to nullify the password burned into the rom. SGI's are even easier, just use the reset password jumper on the motherboard. Laptops are a bit harder, the password is burned into a surface mounted chip. (Don't bother posting links to circumvent laptop passwords. I don't advocate it.)

  • Posted by.... (Score:5, Funny)

    by His name cannot be s ( 16831 ) on Saturday February 15, 2003 @05:44PM (#5310474) Journal
    Posted by timothy [monkey.org] on Saturday February 15, @03:27PM
    from the if-you're-denser-than-dark-matter dept.
    An anonymous reader (really timothy) writes "According to this story seen on Slashdot this morning, any moron can get postings onto slashdot. Turns out, access to a fucking keyboard and timothy at the queue is all that is needed to bypass all (well, most) of the story submission process features in slashdot. An idiot can write up completely bland and stupid observations, and Timothy will post them. This method even allows the most moronic story to get posted on a Saturday, something which normally the staff at slashdot reserves for Tuesday."

    Never has my sig been more correct:
  • if they have physical access to the machine, they can simply plop the drive into another computer and be able to read the drive
  • If you have physical access to the machine just steal the damned HD and take it home.

    Once you've done that you have all the time in the world anyway, but stick it in a machine with the same OS and your root access will get you anywhere.

  • Another Slashdot/MS Troll (Score:2, Informative)

    by t0ny ( 590331 )
    awh ya, the slash whoring on brainless MS bashing is in the house again.

    If you want to prevent something like this from happening, kiddies, just go into the bios and disable booting from floppy or cd-rom. Then, set a really good ol' fashioned password on your bios.

    Interestingly enough, not only does this follow computer security best-practices, but will actually help secure non-microsoft products too.

  • Whats the point...I'll just post my own.
    Let me summarize the 4 comments on this article:

    1) Blah Blah physical access blah blah
    2) Grumble grumble linux too grumble grumble
    3) Hehe DMCA hah ha hehe he
    4) slashdot sucks and its comments are stupid.

  • I wonder if this guy's copy of XP is running on an NTFS file system or a FAT32 file system?

    If it's FAT32, then no wonder. A Windows 98 boot disk would be sufficient to access any file on the hard disk! The system recovery console won't ask for an Administrator password because it isn't necessary to access a FAT32 partition.

    This guy couldn't possibly be trolling for his little spam^Wnewsletter, could he?

    Naaaaaaaaah

    Nathan

  • An attacker with only local access to the machine and a sledgehammer is capable of launching a permanent denial of service attack on the box.
    I know for a fact this works with Windows XP, but I presume this vulnerability exists in other OS's.

  • Knoppix (Score:5, Interesting)

    by jsimon12 ( 207119 ) on Saturday February 15, 2003 @05:57PM (#5310547) Homepage
    Or just get this ISO and boot, WHAMMO instant access, and it is 100% free, unlike the Windows 2000 CD:

    http://www.knopper.net/knoppix/index-en.html

  • Easy enough fix (Score:4, Insightful)

    by VirexEye ( 572399 ) on Saturday February 15, 2003 @05:58PM (#5310548) Homepage
    Simply disable cdrom and floppy boot in the BIOS and set a password so these settings can't be changed. Sure people can still get at data by taking apart the box but that becomes a bit more obvious in a public or office environment.
  • This is only one option if you have physical access to the machine. Check out some of the tools on http://www.sysinternals.com; especially the NTFS DOS file system driver. If you have access to the machine you can boot off a floppy and use the driver manipulate the file system. They also make some really cool recovery tools you can use to get to systems via a serial connection and recover them.

  • And this just in. . . (Score:5, Funny)

    by kfg ( 145172 ) on Saturday February 15, 2003 @05:59PM (#5310557)
    The security of a lockable tower case can be broken with a common Sawzall.

    Ashcroft declares possesion is a terrorist computer crime.

    KFG

  • http://home.eunet.no/~pnordahl/ntpasswd/ (Score:5, Funny)

    by t0qer ( 230538 ) on Saturday February 15, 2003 @06:04PM (#5310577) Homepage Journal
    http://home.eunet.no/~pnordahl/ntpasswd/
    (o)---Pu t that karma right here.

  • What about bootable cd-rom or floppy? (Score:3, Interesting)

    by geekee ( 591277 ) on Saturday February 15, 2003 @06:15PM (#5310647)
    In either Windows or Unix, can't I simply boot from a cd or floppy and gain root access? The only thing that makes this exploit interesting is that you can get access to the computer without interrupting normal operation.

  • Oh my -- my Mac too (Score:3, Insightful)

    by krray ( 605395 ) on Saturday February 15, 2003 @06:18PM (#5310669)
    Wow -- as much as I'm, well, a Mac man now (w/ Linux holding all the keys and data :) ...

    I too just booted my Mac into single user mode and can access EVERYTHING. Oh my!

    Give me any Mac and putting it in 'T'ransfer mode ... wow, I can COMPLETELY copy somebody elses computer. Oh my! ...we *all* know how seriously flawed Windows security it, but come on -- this is a non-issue. Put me on the console of a Cray and I can "hack" into it too in about 5 minutes.

  • I think I see the problem (Score:3, Interesting)

    by darkonc ( 47285 ) <stephen_samuel@b ... m ['gre' in gap]> on Saturday February 15, 2003 @06:31PM (#5310739) Homepage Journal
    From the description in the article:
    • Anyone with a Windows 2000 CD can boot up a Windows XP box and start the Windows 2000 Recovery Console, a troubleshooting program.
    • Windows XP then allows the visitor to operate as Administrator without a password, even if the Administrator account has a strong password.
    It looks like you may hot have to boot off of the CD to get access to the system.

    If this reading is accurate, then even machines with a CMOS password which have been set to boot only from the HD would be vulnerable.

    More importantly, it would indicate that there is a back door to the XP security system. If somebody figures out the basis of such a backdoor, it could make for a very nasty virus/worm.

    Hopefully, I'm just misreading the whole thing (quite possible).

    • Windows 2000 recovery console is only available at boot time from the CD. It can't run once the system is booted.
    • Another part of the issue (whether or not you have to boot off of the CD) is that admins have been led to believe that you always need a password to get admin access. The XP rescue disks still need an admin password to get full access to the system, so admins might be lulled into believieng that people booting off of their CDs aren't as big of a threat as they really are.

      Consider this as an example of Insecurity through obscurity.

  • Grow Up... PLEASE. (Score:3, Interesting)

    by Doomrat ( 615771 ) on Saturday February 15, 2003 @07:29PM (#5311003) Homepage
    It makes me sad that Slashdot is looked upon as representative of Linux geeks.

    How incredibly pathetic do you have to be to poke fun at a windows exploit involving local access to the machine? Do you somehow think that Linux isn't just as vunerable? Wasn't it only 2 or 3 months ago that an article was posted here about security ending when a hacker has physical access to a computer?

    You Slashdot editors are a sad bunch of zealots. You are doing more harm for Linux advocacy than good. Thank god you're just a bunch of spotty geeks running an unimportant news site - if you took these sort of hypocritical attitudes somewhere which mattered, you'd end up in serious trouble.

  • Encrypting your SAM key (Score:4, Informative)

    by scubacuda ( 411898 ) <`moc.liamg' `ta' `aducabucs'> on Saturday February 15, 2003 @07:30PM (#5311004)
    I have not done this, but according to this article [techtarget.com] you can secure your SAM key on XP:

    You can encrypt your SAM file with SYSKEY and selecting the option to store the encrypted key on a floppy disk. Keep in mind that the floppy disk will be required during the system boot phase. Storing the encrypted key on the local drive is not as secure, since there are utilities available to manipulate the password hash. Make a backup of the floppy disk and store in a safe, in case your original floppy disk gets damaged.


    Equally important to protecting your SAM file, is having an understanding of the services you are running. Make sure that you disable unnecessary services for security reasons and to free up system resources. I've included below some of the services that I would disable by default. Keep a configuration file or maintenance log of the changes made to each host in your peer-to-peer network.

    NOTE: Make sure you make a full backup of your system before making changes.

    Services to disable:

    • Application Layer Gateway Service ? if not using Internet Sharing
    • Automatic Updates ? this can work for you or against you; at some point, someone will hack this process to propagate an attack on your system
    • Background Intelligent Transfer Service ? used by Windows Update
    • Error Reporting Service ? self explanatory
    • Internet Connection Firewall ? unless you are sharing Internet
    • NetMeeting Remote Desktop Sharing ? enable when you need it
    • Remote Access Auto Connection Manager ? unless sharing Internet
    • Remote Desktop Help Session Manager ? enable when you need it
    • Remote Access Connection Manager ? unless sharing Internet
    • Routing and Remote Access ? unless sharing Internet
    • TCP NetBIOS Helper Service ? used for WINS
    • Terminal Services ? enable when you need it
    • Upload Manager
    • WebClient

  • No, No, NO!!! (Score:5, Informative)

    by alexburke ( 119254 ) <alex+slashdotNO@SPAMalexburke.ca> on Saturday February 15, 2003 @08:07PM (#5311185)
    No, No, No.

    NO!

    You can launch the Recovery Console from CD (or hard drive -- hell, I have it installed on all my machines (winnt32 /cmdcons /unattend), but from within the Recovery Console you can ONLY log on to a Windows installation as Administrator (or whatever account was originally called Administrator if it was renamed), and you *do* require the password for it. NO OTHER ACCOUNT WILL WORK. (You are not even prompted for the user to log in as.)

    If you're stupid enough to leave the Administrator password blank on your box, then yes, you can just press Enter at the prompt and you're in -- however copying to a floppy, and access to directories Administrator doesn't have rights to access, are DISABLED by default unless you enable "Recovery Console: Allow floppy copy and access to all drives and all folders" (Control Panel > Administrative Tools > Local Security Policy > Local Policies > Security Options). Note this doesn't remove the login requirement -- it only adds more access once you've logged into the Recovery Console.

    It's a moot point anyway -- even if you have the Welcome Screen enabled (where Administrator doesn't appear unless there are no other accounts defined), you can just hit Ctrl+Alt+Del twice to blow right past the Welcome Screen and pop up the normal GINA logon dialog, where you can log on as Administrator (or whoever), and whatever password (or blank, if you don't specify one during installation -- thank God Windows Server 2003 warns against an insecure Administrator password during Setup).

    ...

    Okay, I've somewhat calmed down now.

    Even though I'll bet 75% of posts to Slashdot are made from Windows machines, I find it unbelievable that trash like this makes the front page, let alone goes unrefuted for this long.

    Sheesh...

    *sigh*

  • Old News (Score:3, Informative)

    by SLASHAttitude ( 569660 ) on Sunday February 16, 2003 @02:27AM (#5312870) Homepage
    Unless this can be done remotely this is very old news. Every NT/2k/.net admin worth his salt has known this since nt4 if not before. It is the something if you have a slack or gentoo cd and have local access to linux box. There is not much that can be done if you have local access. In my mind this is what is wrong with the security world today. A lot of people taking shit like this to far. This is not an exploit and should not be treated as such. You should note it and not let just anyone have physical access to your network.

  • Another way to 0wn a Windows box (Score:3, Informative)

    by Zog The Undeniable ( 632031 ) on Sunday February 16, 2003 @04:37AM (#5313152)
    There's a Linux-based boot floppy which purports to change any user's password (including Administrator) on any Windows NT/2000/XP box. I can report that it works perfectly on XP. if Administrator has been renamed, no problem: it picks up the account with a SID of 500 and suggests that might be the one you're after. All good clean fun. You can get the floppy disk image from here [eunet.no].

    I suppose the moral is to remove all floppy and CD drives from your corporate PCs. Disabling floppy boot in the BIOS will keep the haX0rs out for about 20 seconds, as this is how long it takes to flip open the case and short out JP1 to reset the BIOS password. If they have to bring their own floppy drive it slows them down a bit more, plus it's rather obvious.

Slashdot Top Deals

The reason that every major university maintains a department of mathematics is that it's cheaper than institutionalizing all those people.

Close