Is there a way anyone can access the system32 folder on Windows without being logged in? If so, how would he do that and how to prevent it.
7
-
1Can you clarify what you mean by "without being logged in" ? Do I have physical access to the machine? In which case, am I allowed to reboot off a USB stick?. Can I take out the hard drive and put in into another machine, then put it back? Basically, please give us more context for the question.– Mike OunsworthCommented Feb 10, 2016 at 14:11
-
I mean if someone comes up to a computer and turns it on but doesn't know the password to login, so yes he has physical access.– John SmithCommented Feb 10, 2016 at 14:12
-
How much physical access would one have? If one can physically get inside the machine or get into the BIOS setup, then there is no way to prevent access to the system folders.– rustyxCommented Feb 10, 2016 at 14:19
-
2If I can access BIOS, then I can change the boot settings to enable "Boot From USB", and then boot into my hacker linux which ignores your Windows permission settings.– Mike OunsworthCommented Feb 10, 2016 at 14:27
-
3Yup, take 20 mins and try it for yourself - go download Ubuntu Linux onto a USB stick, boot into it, and you'll see that you can access any file on your hard drive (unless it's encrypted).– Mike OunsworthCommented Feb 10, 2016 at 14:33
|
Show 2 more comments
2 Answers
Everyone has read access to system32, but only administrators have write access. If you want to write to system32 as a Windows user, you need to conduct what is called a privilege escalation which elevates a normal user to admin. This can usually be prevented by proper user management and configuration since there are many possibilities to elevate privileges.
But: If someone mounts your Windows file system in a non-Windows environment (Linux, OSX), the file access permissions set by the Windows kernel will be ignored and thus everyone using a live boot can easily write to system32. You can only prevent this by configuring the clients in a way that booting from USB or other devices is impossible.
-
1... what about booting off a USB stick? Can I write to it then? ... I think the question needs clarification about what is meant by "without being logged in". Commented Feb 10, 2016 at 14:08
-
@MikeOunsworth Thats a really good point! Ill update my post. Commented Feb 10, 2016 at 14:09
-
I response to the comment that we are allowing the attacker to have physical access to the machine:
There's a running joke in security called The 10 Laws of Security. Law #3 is
If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.
So yes, if the bad guy can walk up to the machine, reboot it off a USB stick into an OS of their choice, or take out the hard drive, or plant a chip on the motherboard, etc, then you've already lost; there's not much you can do to prevent him accessing / modifying your machine. Using full-disk encryption raises the bar, but then I will plant a key-logger on the motherboard to collect your admin password, then come back in a few days and log in as you.
That said, if you are only concerned with a running system (ie the admin will be notified if the machine shuts down, or on startup it performs a "restore from deep freeze") then there are things you can do to prevent system32 from being tampered with. For that case, @AdHominem's answer about setting proper user management / permissions applies.
answered Feb 10, 2016 at 14:20
