Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Apparently a computer system protected by a a login password, e.g. Windows XP, can be easily hacked by someone with physical access to it using methods like this one:

http://www.raymond.cc/blog/archives/2006/09/02/how-to-hack-into-a-windows-xp-computer-without-changing-password/

Can anyone inform me how to mitigate against this type of attack?

Thanks!

share|improve this question
1  
An even easier method apposed to using DreamPackPL is to use Kon-Boot piotrbania.com/all/kon-boot Just boot from Kon-Boot CD/Floppy, select your profile and put any password you want. –  Mark Davidson Mar 8 '11 at 14:22
    
Scary stuff. Makes password protecting Windows an almost pointless exercise. –  Django Reinhardt Mar 8 '11 at 14:56
2  
That would normally be my prompt to start slagging off windows, but scary thing is Kon-Boot works with Linux as well. –  Mark Davidson Mar 8 '11 at 15:03
1  
yeah, Kon-Boot works with everything :P nothing is safe any more –  Sigtran Mar 8 '11 at 15:26
    
Lol. Doh. That stinks. –  Django Reinhardt Mar 9 '11 at 13:10
add comment

3 Answers

up vote 17 down vote accepted

The real issue here is that the attacker only needs physical access to your hard drive in order to read or manipulate the files which contain your password hashes. There is already a thread on SuperUser which has some recommendations, which I will likely repeat here.

How to secure my Windows 7 PC?

As security compromises of a PC go, physical access is perhaps by far the worst kind. Once an attacker has their hands on your computer, most other security methods in place are easily circumvented. That said, here's what you can do to prevent or hinder these attacks from affecting your system.

  1. Use strong passwords. Make them 15 characters long at minimum, and use all four character types (lowercase letters, uppercase letters, numbers, non-alphanumerics). Also, avoid using any dictionary words in any part of the password. Lastly, do not write it down!
  2. Encrypt the hard drive. This will prevent any attacker from reading or manipulating the system files when booting into their own environment. This is the only measure that will generally survive an attack involving physical access to the system. Also, see item 1.
  3. Lock down the BIOS and Boot Order. Set the system to only boot to the system drive, and set an Administrator password on the BIOS so that this cannot be changed. Also, see item 1.
  4. Physically secure the system case. If possible, lock the system's chassis with a padlock and/or place it in a secured cabinet. A chassis lock will hinder efforts to clear the BIOS password by using jumpers on the motherboard, and efforts to remove the hard drive for loading into another system. A secured cabinet will do that, and also hinder any attempts at plugging in or loading alternative boot media. For ideal security, and if you're really paranoid, do both.
share|improve this answer
1  
+1. You got it, the physical access is giving any unixoid system the very same weakness. So it's not even limited to the "oh so insecure" Windows ;) –  0xC0000022L Mar 8 '11 at 23:43
2  
XP machines are by default more vulnerable to password brute forcing the subsequent Windows versions because the store the less secure LM hash of passwords. If you don't need this for legacy reasons turn of its generation - support.microsoft.com/kb/299656 - so you can at least get the full benefits of a stronger password. –  Bell Mar 9 '11 at 3:56
1  
@Bell - This is one of the reasons I suggested passwords with 15+ characters. Such passwords are too long to be stored in an LM hash - this is why they will generate a warning message stating that the password is incompatible with older versions of Windows. It is absolutely good practice to turn off features that are not needed, but a 15+ character password will help avoid the LM hash vulnerability even on systems which you do not administer yourself. –  Iszi Mar 9 '11 at 4:09
1  
I think the techniques described in this answer are not likely to add a great deal of security. They add a speed bump (to keep your kid brother/sister out), not strong security. –  D.W. Mar 9 '11 at 5:38
2  
@D.W. - When it comes to scenarios involving physical compromise of the system, "speed bumps" are really the best you can do. The only truly effective security measure you can put in place against this is whole disk encryption, which I did address in my answer. –  Iszi Mar 9 '11 at 5:48
show 6 more comments

One way to prevent booting from devices like CDs and USB sticks is to disable it in the BIOS and password protect it. It would then require access to the motherboard to reset the BIOS.

share|improve this answer
    
Great suggestion. Thanks! –  Django Reinhardt Mar 8 '11 at 14:04
3  
That would slow folks down, but they could still change the password on the hard drive or just read it elsewhere if they could get in to the system, unless the hard drive is encrypted as Iszi describes. –  nealmcb Mar 9 '11 at 4:34
    
Definitly, but it would prevent them if they were trying the method he asked about. –  jer.salamon Mar 9 '11 at 5:11
1  
I believe that disabling alternate boot devices is an incomplete solution unless you restrict physical access to the hardware too. Fortunately most boxes today support padlocking. –  Georgios Jun 9 '11 at 9:01
add comment

The short answer is: there is no good way to provide strong security if your enemy has physical possession of your PC. You just have to accept that as a fact of life.

  • For example, if your enemy has physical control over your PC, then he can remove the hard drive from your PC and read and write it to his heart's content on his own PC.

  • As another example, the enemy can surreptitiously introduce a key logger that records all your passwords and other key strokes. Some key loggers are small, unobtrusive dongles that fit between your keyboard and your PC, so no amount of locking down the case of your PC is sufficient to protect against that threat.

None of the answers proposed on this web page can stop all of these attacks.

You asked about mitigations. There are no great mitigations, but here are some imperfect steps you can take (in addition to the other ones mentioned here):

  • Use an encrypted filesystem. Encrypt your entire filesystem. TrueCrypt has software that is free and good. PGP sells software that's good. This will reduce the window of opportunity for an enemy to access your hard drive. Some downsides include the fact that you have to memorize and use a long passphrase. It doesn't work for unattended servers (because someone has to be around to enter the passphrase when the server boots, and also once the password is entered, for as long as the server is unattended, an enemy may be able to gain access to the data).

  • Apply as much physical security as possible to the PC. For instance, lock the case, lock the room it is located in, buy a burglar alarm, install a surveillance video camera.

There are fancy things you can do, including buying hardware security modules (HSMs) to store your crypto keys and using tamper-resistant hardware, such as a smartcard or IBM 4758. However, these are exotic techniques not likely to be cost-effective in most settings.

share|improve this answer
    
I appreciate what you're saying, but the example is Windows XP, so it's pretty clear it's not going to be an unattended server. Useful information though, thanks. –  Django Reinhardt Mar 9 '11 at 13:13
    
Useful information, but the question was specifically targeting boot-disk-based attacks. –  Iszi Mar 9 '11 at 19:32
    
@Iszi, the right way to think about security is to work out your threat model, and then figure out what security can provided against that threat model. Focusing on one attack, and ignoring the threat model, is silly. It's silly because there may be other similar attacks that are even more effective; if you stop one attack, the attacker may just switch strategies slightly to use a slightly different attack you didn't stop. Targeting only boot-disk-based attacks is poor security practice; you should start with a plausible threat model, and stop all attacks within that threat model. –  D.W. Mar 14 '11 at 6:16
    
It is true that the entire threat model needs to be taken into consideration. But, at the end of the day, we have to address all vulnerabilities in the best way possible. Certain vulnerabilities have very specific measures that can be taken to mitigate just those vulnerabilities. Certainly there are other measures to be taken which encompass more than one, but that doesn't lessen the value of a good defense-in-depth strategy. –  Iszi Mar 14 '11 at 15:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.