NVidia update service creates local account on system. Does anyone know the users password?

Question

Nvidia update service has created a local user on several of my boxes. Does anyone know its password? I recon it could possible be leveraged as an entry way for an attacker.

Details:

wmic useraccount list full

AccountType=512
Description=Used to deliver NVIDIA program updates
Disabled=FALSE
Domain=Stationary
FullName=UpdatusUser
InstallDate=
LocalAccount=TRUE
Lockout=FALSE
Name=UpdatusUser
PasswordChangeable=TRUE
PasswordExpires=FALSE
PasswordRequired=TRUE
SID=S-1-5-21-3740843305-4162061290-2760509455-1004
SIDType=1
Status=OK

EDIT: I've dumped the hash now and it looks like this:

UpdatusUser:"":"":AAD3B435B51404EEAAD3B435B51404EE:F100FC1DF3A5300A5C265BDC7CD81E39

The hash starting iwth AAD3 and ends with 4EE is just LM hash for blank password and in this case it means that the password is over 14 characters and it cannot be stored as LM hash. The last hash (F100) is the NTLM hash which I would like to see cracked :)

Answer 1

NVidia seem to have done a reasonable job of locking this down appropriately.

I ran cain and abel, and dumped the service accounts password from LSA, it is using a very random looking password comprised of > 15 characters, using upper and lower case alphanumeric and specials like _(!, etc.

Additionally, the account is added to the deny log on locally security policies, so they appear to have thought about security on this. This is far better than having a service run under system with way more privileges.