Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In a typical home user situation with a PC connected to the internet via a router, suppose we are not concerned with protecting the machine from people with physical access. Does setting a password on a Windows XP user account help secure the machine from remote exploits? (compared to a passwordless account).

With no password set at all, remote desktop access is (should) not be possible. Are there other attack vectors where having a password reduces risk? In short, what is more secure?

share|improve this question
    
Within your question you are talking of 2 different sorts of attacks: remote exploit and remote desktop access. Which one do you really want to protect your computer from? –  daniel Azuelos Jun 25 '13 at 10:09
add comment

3 Answers

up vote 5 down vote accepted

No, there is no additional protection against remote exploits, but you should always set an account password wherever humanly possible, for a whole host of reasons not related to remote code execution bugs.

Remote exploits usually result in code execution, and that code would run under the privilege level of the user that was running the exploited service or application. As such, the password mechanism is entirely bypassed.

This is especially the case for services running under dedicated service accounts, such as NETWORK SERVICE, LOCAL SERVICE, or SYSTEM, which don't technically have passwords in the first place - they have NTLM hashes with random values, and login is disabled for them.

The only protection I can see is in a scenario where a low-privilege user (e.g. a limited or guest account) runs an application that is open to the network, and that application is exploited. From there, a passwordless account is a target for horizontal privilege escalation, or vertical privilege escalation if the account runs as administrator.

All in all, I would suggest that a password is always set on all user accounts, but not for remote exploitation protection reasons. There are so many other reasons to set a password.

share|improve this answer
    
I think that a password should be set to any account, unless you can prove that any server code is correctly protected against any form of priviledge escalation. –  daniel Azuelos Jun 23 '13 at 21:54
1  
@danielAzuelos That's exactly what I said in the last paragraph. –  Polynomial Jun 24 '13 at 8:37
    
→ Polynomial: I read it, and agree. But your answer started with a clear No. And I'm afraid this is the part of your answer fast(small) readers will retain :(. –  daniel Azuelos Jun 24 '13 at 9:20
1  
@danielAzuelos You seem to be confusing misconfiguration with remote exploits. Misconfiguration might involve getting access to a service via a weak or missing password on an account, but it doesn't require there to be any bugs in the service software. Remote exploits require a vulnerability to exist in the software, which is completely unrelated to configuration. There's an important distinction between the two. –  Polynomial Jun 24 '13 at 13:50
1  
@danielAzuelos "A well known example in security history is the use of guest accounts (on any kind of systems) to lead to a remote exploit of a system." - this is a configuration issue, not an exploitation issue. Having no password on a guest account doesn't make a damn bit of difference to a remote attacker if he can't authenticate remotely as guest. Remote exploits do not heed normal authentication policy - they bypass it. Also keep in mind that vertical privilege escalation on Windows has nothing to do with passwords - all Administrator accounts are forced to use passwords. –  Polynomial Jun 25 '13 at 13:18
show 6 more comments

Well, if you have no external hardware firewall (mostly there is one in the router) and you have file services enabled or things like that, then the remote side could simply connect to your \system\c$ share and place any malware there or whatever. With RPC access the attacker could place things into the registry, etc. If your firewall is blocking that, you're safe against these attacks.

Keep in mind that XP is out of Microsoft support in a few months. That means that if a new remote exploit gets discovered, you won't even get a security bugfix for it.

share|improve this answer
    
"then the remote side could simply connect to your \system\c$ share and place any malware there or whatever" - this hasn't been possible for a long time, assuming the systems are patched to SP2 or later. –  Polynomial Jun 24 '13 at 13:46
add comment

Are there other attack vectors where having a password reduces risk?

The fleshy things that poke the keyboard are well known to be exceptionally insecure and often are more exploitable than the operating system itself.

Perhaps you should revisit not being concerned with protecting the machine from them, as well as applying principles of least privilege (to the point of having 2 accounts for yourself so you're not admin when you don't need to be.)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.