1

It's well known that you can crack a windows account password using repair your computer (I'm not giving anymore details here)

What I'd like to know is if you know of technique to defend against it.

Idealy, even after booting from a USB, Windows installation drive should be locked (sort of in a box) so that you can't access and modify any file or escalate priviledges using windows cmd shell

Any idea ?

2

Pre boot authentication + full disk encryption. This will require a password (or some other authentication factor) before allowing any disk access.

  • Awesome. See this en.wikipedia.org/wiki/…. Do you think since MBR can be somehow exploited to jump over the PBA software ? – Jason Krs Jan 9 '17 at 22:23
  • @JasonKrs Interesting question. My gut reaction is no. Ideally FDE implementations would also encrypt the MBR/GPT, but some do not. That said, the MBR/GPT typically only contains information about disk layout, which shouldn't include sufficient information to decrypt and allow for SAM file editing. I'm not confident that every implementation of these concepts does this properly - YMMV with different products. – Jesse K Jan 9 '17 at 22:34
  • YMMV = ? ...Also I just saw an interresting paper saying FDE is not that secure for windows blackhat.com/docs/eu-15/materials/… – Jason Krs Jan 9 '17 at 22:36
  • Your mileage may vary. For example, some phones relied on the Qualcomm TrustZone extensions for their full disk encryption, but it turned out there was a flaw which enabled information to be extracted. Security in these situations is systemic; your various hardware and software components (BIOS, TPM, hard drive, PBA provider, etc) must all play well together, support each others capabilities, and have their features properly implemented. On android, see: bits-please.blogspot.ro/2016/06/… – Jesse K Jan 9 '17 at 22:40
  • Hmm I read a little. So to sum up FDE can still be cracked. I just saw a paper saying PBA also can be cracked with some assembly ninja moves. defcon.org/images/defcon-16/dc16-presentations/brossard/… At least, correct me if I'm wrong, PBA + FDE can be cracked BUT not by script kiddies right ? – Jason Krs Jan 9 '17 at 23:04
1

The concern of yours should not only be from "recovery mode" but also those when Windows is not in use. Most attacks modify the SAM file, which is not writable when the Local Security Manager process is running. This file contains the credentials for the local machine to permit logins. The classic case of bypassing this is when you boot to a Live CD and use tools to modify the SAM file, either to change the passwords or blank them.

The only thing that can prevent unauthorized changes is using the syskey utility built into Windows (XP/7). This acts as a "universal logon password", as a user must provide a password for Windows to decrypt the SAM file before it starts using it.

How secure syskey is, or if blanking can still be done, I honestly can't comment. The guaranteed way to prevent outside tampering is employing whole disk encryption. Select versions of Windows include BitLocker, which can serve this purpose.

Other solutions include TrueCrypt, but again employ whole disk encryption.

If you really wish to test the waters, you can use the built in file system level encryption in Windows. EFS (Encrypting File System) is tied to your password and other credentials, such that if something was to change, the certificates for encryption are "unrecoverable". This again is only available in select versions of Windows.

  • For a 1st day on this forum you are really gloiwing (joke). If the the full disk is encrypted, you can modify any file using boot CD ? – Jason Krs Jan 9 '17 at 22:31
  • check this blackhat.com/docs/eu-15/materials/… – Jason Krs Jan 9 '17 at 22:36
  • With FDE you can still modify the disk, but it will be unintelligible as it is encrypted (encoded such that only the correct password will decode the data stored on the disk). The paper outlines a flaw with BitLocker, which is hardly surprising. Other products do exist such as Truecrypt which provide FDE and have arguably been tested to a higher standard. – dark_st3alth Jan 9 '17 at 22:41
0
  1. BIOS password; always everywhere.

just to pass this you need to disassemble laptop or pc and get the hard drive out or reset it somehow.

  1. as someone said encrypt it; or keep it in a hibernation mode.

  2. you might try linux LVM to encrypt entire hard drive and creating windows partition within it. but I am not sure if it would be possible to do with ntfs file system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.