Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The Firewire DMA hack Inception allows for the password checking subroutines on a local Windows box to be overwritten, allowing any password to be entered for a locked computer. My question is about the impacts of this on a networked system.

When logging in to an Active Directory controlled system, the system is given a token that it can use to gain access to network resources for the user without the user having to re-enter their password. Is this token kept when locking the system or reacquired when unlocking?

I am trying to better understand the possible risks of an Inception derived attack on a corporate network. If it only allows access to the local system, it is significantly less of a risk factor than if it is also able to gain access to network resources associated with the user.

share|improve this question

2 Answers 2

Honestly, I don't know. What you could do is log in to a computer requiring a network connection to log on (no offline profiles), make some test connections to show that the token is working. Then lock the computer remove the network connection and log back on. Turn off your domain controller, and If you cant get onto any network shares then the computer had to re authenticate to the controller.

share|improve this answer
    
Hmm, that does seem to be a good test case, unfortunately I don't have a lab handy I can test it in atm. :( I'll give you a +1 for a good suggestion of how to test it though.) –  AJ Henderson Jun 11 '13 at 3:38

AFAIK the token is never destroyed as the session is still present, but that doesn't mean the token doesn't get stale. The token gets refreshed on an unlock.

share|improve this answer
    
I suppose more directly, my question is that if the lock functionality is broken so that it returns true for any password, is the network token still viable or is it broken just like if you were to hack the local password file. –  AJ Henderson Jun 10 '13 at 20:54
    
I don't have a test lab set up to run Inception, but the trivial case to test this is can you run a new network process or create a new connection once you run inception. Reviewing the literature on MS access tokens ( msdn.microsoft.com/en-us/library/windows/desktop/… ) my suspicion is that even if the network tokens went bad, they're really just impersonation tokens, so they'd just be renewed using the primary token for the user. –  Brandon Franklin Jun 10 '13 at 23:40
    
@BrandonFranklin - right, but since locking the computer requires re-entry of the password, it may or may not get a new token (similar to how some security permission updates work on a lock/unlock). –  AJ Henderson Jun 11 '13 at 1:51
    
If you run it in the lab, let us know. I'm curious. The particulars of access token refresh are poorly documented, even in the sysinternals stuff. –  Brandon Franklin Jun 11 '13 at 2:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.