0

I'm using a Windows 7 64 PC in my company.

Today I found a strange username on the login screen. I checked and found some users' folders inside my Windows directory. Only my account from company domain and local admin can log in on this PC. The IT team and I discovered that someone from the weekend shift team cracked the local admin user (we think they use the infamous Hiren's boot tool). He also added a user group with all users from my company. So anyone can log in to the PC. And anyone is given admin permission so they can access all my files.

Some other guys took advantage and used my PC without permission. They're all gonna face the consequence later but the security hole is still there.

How can I prevent this case to happen? Or I have to deal with the fact Windows sucks and anyone can overwrite the admin's password.

Improve this question
4
  • Remove all the removable media drives i.e. CD/DVD drives, USBs etc. Keep the primary hard drive as the first boot device, put a password on the BIOS setup and lock down the system so that no one with a screw driver can open it and change the jumper settings. Windows doesn't suck. It won't make any difference what OS you use on it with the current setup and it will be equally easy to put a live CD in it and bypass the login screen. – void_in Jan 18 '16 at 14:03
  • Fire the perp, then flog him, then fire him again. Nuke the PC and reinstall. – Deer Hunter Jan 18 '16 at 14:42
  • @void_in: I'm working with android phone so disable usb drive is out of question. I think bios lock is a solution but I'll check if there is any problem may occur. And Windows sucks, try to crack root password on Linux. – jcp0908 Jan 18 '16 at 14:44
  • @Deer Hunter: lol if I could, I would. – jcp0908 Jan 18 '16 at 14:48
1

This is an issue for virtually every OS. To understand the core problem you should look at the "Immutable Laws of Security" [1]: https://technet.microsoft.com/en-us/magazine/2008.10.securitywatch.aspx. Mainly Law 3: "If a bad guy has unrestricted physical access to your computer, it's not your computer anymore."

Even if they did not add an admin account they could simply boot from a Linux boot drive and access all of your files stored on your system. This would leave even less evidence then adding a new account.

The answer to all this is full disk encryption. This will not protect the computer but it will prevent anyone from accessing and editing your files. Microsoft BitLocker is included in Windows 7 Ultimate/Enterprise and Window 8/10 Pro.

The comments and other answers outline methods to make it harder for people to boot onto the computer.

Improve this answer
2
  • Yeah the BIOS method is not practical after I think about it. I can't put a lock or a cage just to prevent people to reset the BIOS. But I think M$ should learn from Linux with shadow file. It's can be hacked but not by any kid which can use Google. – jcp0908 Jan 19 '16 at 9:14
  • And even if you lock the BIOS there is nothing stopping the attacker from removing the HDD and editing it on another computer. – AstroDan Jan 20 '16 at 16:42
2

First of all, lock the workstations down with a BIOS/UEFI password. This is common practice for enterprise networks. If the device is yours, then do it yourself. This prevents systems other than Windows from booting. Also make sure you disable the XPE network OS loader.

At this stage, you cannot be certain the computer is 'OK' from now on since it was easy to install remote services from a bootable USB/Hiren's/Linux based memory OS. Reinstall Windows would be your next action. Wipe the drive on installation. If you do not own the device, then tell the same thing to your IT team since they should have been aware of these actions.

Before reinstalling Windows, you can take a look at the local event logs. This should give you some more info on when the accounts were created.

In addition to the above and comments below, you might also want to question the knowledge of the people who are responsible for security (or IT). Every system administrator should be fully aware of the danger that comes with unprotected access to configuration.

Improve this answer
6
  • I checked the event log first of course. There is logging in info there but who added the goddamn group is still unkown. Some user profiles are created months ago, so only they can answer it. – jcp0908 Jan 18 '16 at 14:59
  • This is really going to be on the IT people to handle the forensics part of it, but there may not be enough to find the person. Really, if you want security, you have to lock down everything from BIOS (like what Yorick suggested) to the USB slots to prevent them from being used. That way IT has to approve of any USB devices, and if they lock the chassis, even better. There are more things that can happen to improve security, but none of it is convenient. – dakre18 Jan 18 '16 at 15:03
  • Windows logs go back far. New local groups are logged for sure. There is the possibility they altered the events (unlikely, but possible as admin). – Yorick de Wid Jan 18 '16 at 15:05
  • If the system is known to be compromised, the local event logs cannot be fully trusted as they could have been tampered with. This is why it is so important to immediately send logs to a centralized server for aggregation and reporting. If network based logs (netflow, etc) are available, check those too as it will provide scope for incident containment. – user2320464 Jan 20 '16 at 20:15
  • @dakre18 What are the inconvenient things? I agree that locking the firmware and all peripherals is necessary, as well as locking the chassis, but what are the other methods? Placing the computer in a locked room that requires a passcard to enter? Placing all data on centralized servers, with the desktops being terminals with no ability to store data? – Demi Nov 28 '17 at 23:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.