I recently worked on a computer issue for family we all know how that is.... where they purchased a laptop and they did not change the admin password. I did crack this and fixed it but realized how vulnerable my network at work was to this kind of attack. basically I used a linux type disk to do this I won't go into details so that I don't give any information or how to's.but I wanted to know how can I prevent people from doing this to my laptops or desktops. basically how do I prevent programs from taking the hash and deciphering the password . I don't want to prevent all boot disk as I may need them for recovery myself. I wasn't worried as much when these programs just reset the admin password because I would be able to tell but when nothing changes and they just learn the password that can be very dangerous. any advice on this is greatly appreciated.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
A pen-tester I know told a story of one client from the pre-dot-com-bust era...
Their admins thought they were doing so well in security... so their CxO hired this guy to come in an audit their measures. Their conference room had a large glass window into their in-house data center. While the admins were at one end of the table, the pen-tester and CxOs were at the other. The sys admins were bragging about how they thought they were so well secured... while the pen-tester was opening documents on his laptop for the CxOs that he shouldn't have been able to access... After a short time, he excused himself to go to the bathroom... and instead, went into the data center and pulled the power cord on their mail server. He watched in amusement as the admins had all their pages going off simultaneously and they turned around to see him waving at them. He plugged the server back in, and returned to the conference room, where he proceeded to explain what could be done to prevent things like that... of course, he LOCKED THE DOOR to the datacenter as he left.
I'm not 100% certain I'm retelling it 100% accurately... but I know very well it's a 100% plausible story. Physical security is at least as important as security policies and encryption... imagine if a competitor posed as a delivery person or something and came in and pulled the plugs/drives from a bunch of servers REALLY quickly because the door was STUPIDLY left unlocked... no data is stolen... but possible corruption and BAD PR as they have an outage that their competitors don't have...
It depends on your clients - BIOS is NOT a Microsoft product, but there are SOME BIOS I've heard of (I think on Dell OptiPlex systems, for example), that you can control through a centralized management solution - not sure if it would be SPECIFICALLY Active Directory - but SOME kind of centralized management.
Really, that has to be supported by the computer manufacturer...
Skip the bios pass, doesn't solve the issue and every MB maker has a way to reset to nothing, Dell it's a jumper, others is to remove the Cmos battery, and for me, it's removing the HD from the case because who wants to fiddle with looking up what jumper to move :)
As stated above, HD encryption, be it a managed solution like PointSec, a stand-alone suite like TrueCrypt, or a SeaGate FDE hardware encrypted drive[momentus] (dell sells these too for many LT's)
Again, booting off a CD or removing the hd and getting access to the SAM to BF the pass's via a Rainbow table or good ol JTR or LC5, a bios pass does nothing. You also don't even need to BF the pass, you can simply write a file to all users->startmenu->startup and it will install a rootkit/keylogger etc... as soon as you login.
If that seems out of the realm of possibility then you may also consider the option in syskey for a password to boot. Does not protect from the last scenerio, however it does add an password that is asked for before any password stored in the SAM database. Syskey is enabled in XP by default, however it presents no challenge for password tools, the only, again the only other syskey option that has any potential to thwart password cracking is to store the syskey files on a floppy. I'd advise against it, as there are easier and better solutions such as TrueCrypt.
http://www.experts-exchang
http://support.microsoft.c
http://www.wave.com/produc
If nothing else, make sure you have good backup's, this is a tool I can't recommend enough:
http://www.newegg.com/Prod
Works on IDE/SATA for LT hard-drives and 3.5" dirves, it's great!
-rich
Can't lock a LT, nonetheless, I think there are better options available, that's all. I do lot's of recovery and bios passwords annoy me ;) And the case is never locked, but your right, it should be if your going to rely on that method, I didn't mean to imply otherwise, but I see that it looks that way. I'm jaded, that all that is
-rich
Business Accounts
Answer for Membership
by: leewPosted on 2008-11-04 at 10:25:20ID: 22878987
It's a problem.
You CANNOT be secure... you can only manage risk...
Disable booting from other media and put a BIOS password in place. Then lock the cases with locks. This will allow YOU to enter BIOS and alter the boot config if you have to, otherwise, the users cannot boot off such media.
Better still replace everything with thin clients.