Timeline for Does setting a user password on Windows XP help protect against remote exploits compared to no password?
Current License: CC BY-SA 3.0
14 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 26, 2013 at 9:04 | comment | added | athena | → schroeder: for security specialists, you're right this kind of remote exploit isn't a direct deep within Windows code or server code attack. But for everybody, this isn't called a "local exploit" either ☺. For my many millions users, an exploit of any form of vulnerability which can be initiated from the outside of the OS is a "remote exploit". I hope I made here my point clearer to avoid any confusion towards the real victims of everyday remote exploits. | |
| Jun 25, 2013 at 22:45 | comment | added | schroeder♦ | @danielAzuelos Guest accounts are used to login, then to kick off local exploits. The fact that the person executing the exploit is not local to the machine does not make the event a remote exploit. | |
| Jun 25, 2013 at 13:18 | comment | added | Polynomial | @danielAzuelos "A well known example in security history is the use of guest accounts (on any kind of systems) to lead to a remote exploit of a system." - this is a configuration issue, not an exploitation issue. Having no password on a guest account doesn't make a damn bit of difference to a remote attacker if he can't authenticate remotely as guest. Remote exploits do not heed normal authentication policy - they bypass it. Also keep in mind that vertical privilege escalation on Windows has nothing to do with passwords - all Administrator accounts are forced to use passwords. | |
| Jun 25, 2013 at 10:16 | comment | added | athena | → Polynomial: remote exploit may strike directly within a faulty code arriving within a system process. Some other exploits will take advantage of an access with no password and then use a faulty code to gain a system priviledge. A well known example in security history is the use of guest accounts (on any kind of systems) to lead to a remote exploit of a system. | |
| Jun 24, 2013 at 13:50 | comment | added | Polynomial | @danielAzuelos You seem to be confusing misconfiguration with remote exploits. Misconfiguration might involve getting access to a service via a weak or missing password on an account, but it doesn't require there to be any bugs in the service software. Remote exploits require a vulnerability to exist in the software, which is completely unrelated to configuration. There's an important distinction between the two. | |
| Jun 24, 2013 at 13:47 | comment | added | Polynomial | @danielAzuelos Remote exploits don't require you to know the password - that's why they're exploits. If you're referring to gaining access to the system via access to legitimate services, that's a different story, and it's not what OP asked about. If no password is set on an account, you cannot RDP to that account by default. SMB access might be possible, but that would only allow access to resources that were explicitly shared with that user. Either way, it's outside the scope of the question. | |
| Jun 24, 2013 at 13:40 | comment | added | athena | → Polynomial: do you mean that on Windows XP an account with no password doesn't permit a remote exploit? Is there a security mechanism that would block any remote account access when its password is missing or empty? | |
| Jun 24, 2013 at 9:51 | history | edited | Polynomial | CC BY-SA 3.0 |
added 175 characters in body
|
| Jun 24, 2013 at 9:50 | comment | added | Polynomial | The question was "does setting a user password on Windows XP help protect against remote exploits?", and the answer to that is no. An account password offers no protection against remote exploits. An account password offers protection against a range of other things. However, I have modified the opening sentence to make this clear from the outset. | |
| Jun 24, 2013 at 9:20 | comment | added | athena | → Polynomial: I read it, and agree. But your answer started with a clear No. And I'm afraid this is the part of your answer fast(small) readers will retain :(. | |
| Jun 24, 2013 at 8:37 | comment | added | Polynomial | @danielAzuelos That's exactly what I said in the last paragraph. | |
| Jun 23, 2013 at 21:54 | comment | added | athena | I think that a password should be set to any account, unless you can prove that any server code is correctly protected against any form of priviledge escalation. | |
| Jun 23, 2013 at 9:21 | vote | accept | arjan | ||
| Jun 22, 2013 at 16:27 | history | answered | Polynomial | CC BY-SA 3.0 |