I feel some serious points have been missed here, and hope to bring them to light.
Can malware launch the kind of attack used against stolen database
password files?
I am not aware of current malware which intentionally seeks out, and attempts to access password databases such as those used by Keepass and others. The reason tends to be one of ease and time.
Most novice users will store their passwords in a plain text file, or use something easy to guess. Those users that have password databases, tend to use much stronger passwords. In addition, they tend to regularly update passwords in the database, and the database password it self. Why case after something that is likely to change anyways?
Further more, graphical interfaces are used to access these files. Malware becomes very complex when it has to integrate abilities to access GUI programs. Malware could directly access the file, but again could prove quite a trick as a whole understanding of the database format would have to be programmed in.
Keepass has a "two way obfuscation" method, which attempts to break keylogger attempts to sniff passwords as they are being entered automatically. It does this by randomizing which parts of the password are entered by the clipboard (copy & paste) and that by direct virtual key presses.
Moving or exporting a database off a computer system would draw attention, but would likely be much more common. This however, could result in stale credentials, as the passwords in the database have likely been updated since exfiltration.
EDIT: I should probably make a note here that malware routinely targets the insecure storage of passwords in internet browsers, games, and such. Unless you use a "master password" in such scenarios, malware can just access the stored credentials from a file or such.
How securely is my computer password stored?
This largely depends on the Operating System (OS) your computer has. Pre-NT Microsoft Windows versions (95/98/etc.) used a very poor scheme that allowed for reversing of the stored passwords. A later upgrade stored user's passwords via a mathematical hashing function. You can read the details elsewhere, but it is intended such that it's one way. You can predictably and reliably take a password to this hashed form, but not the other way. Verification is done by taking user input, passing it through a hashing function, and comparing it to the stored result.
Windows XP and later used a method called NTLanManv2 (NTLanMan version 2, or NTLMv2 for short) by default. This is considered to be much more secure, as unlike previous versions of windows, allowed for case sensitivity, a longer user input, and upgraded storage and retrieval mechanisms. NTLMv2 is still used in Windows, including the very new Windows 10.
The critical flaw in this system is that it does not include salting. This is something Linux/Unix based systems have included for sometime.
Just as each individual salts their own food to their own particular preference, a salt for a hash does the same thing. It provides uniqueness to the hash to a particular computer system. Attackers may use something called a Rainbow Table in a way to decrease the time required to figure out someone's password.
A Rainbow Table works by calculating hashes for passwords in advance. It works on the concept of "time-space trade off". By taking space, you can gain an advantage of time, as you are now just comparing the stored hash of a password against a list or table of hashes. The easy way to think of this, is looking up a phone number in your contact book for a name, a rainbow table does the same thing but with passwords.
Salting prevents this preemptive attack because the passwords are unique to that particular system. A rainbow table would have to be generated for each system, effectively removing the usefulness of such tables.
Linux/Unix also uses much more secure hashing algorithms. Where as NTLMv2 is based off a MD4 hashing algorithm, modern versions of Linux/Unix use SHA1, and SHA2 derivatives (such as SHA-256). The computing time required to generate these hashes can prove slow if done over and over, effectively slowing down attackers.
Under both systems, only administrative/root users can access the stored user credentials. Under Windows, an administrator can not directly access the credential store, but find ways around to access it (such as a backup).
There are specialized pieces of hardware or "computers" that excel at generating hashes of passwords. Using FPGAs (Field Programmable Gate Arrays), time taken to generate passwords is greatly decreased.
Would the malware need to know my password anyway, as presumably it
would have my logon authority?
Not in all cases does malware share the user's privileges. Windows Visa introduced the concept of UAC (or User Account Control). By default, a program will work at the lowest level of privileges. It may require or request administrative privileges. Whether it does this for legitimate reasons is hard to determine. Administrative privileges are required to install software, drivers, modify registry keys, add a program to start up, and so on.
UAC was introduced because many users under Windows XP used an Administrative account for day to day use.
Red Hat Enterprise Linux, and it's down stream CentOS provide a warning when signing into a Root account that it's not recommend to use root for anything besides what absolutely requires root privileges.
Ubuntu does not allow you to directly sign into root as part of their philosophies (and probably quite silly). Users must use sudo
to run something as root. This requires to be a account that is able to "sudo" (called a sudo-er), and knowledge of root's password.
This is where problems can arise. With a weak password, malware could gain access to system privileges in theory. I have only heard of this by word of mouth, and never in practice. It would require guessing the password repeatedly, and generate "noise", or attention that a attack is in progress. There are also a multitude of defences to prevent repeated password guessing.
In many cases, it's much more common for malware to dump passwords from system/computer memory. In the case of Windows 7, it is certainly possible under systems that cache passwords in certain ways, to access a "clear text" or plain text version of passwords stored in memory.
Malware doesn't even need to know a user's password, as they use vulnerabilities in the OS, and other pieces of software to escalate their privileges to that of an administrator, or system/root level.
So what function does the password then serve? What is there left to
protect?
For home systems, passwords serve as a deterrent to unauthorized access by those in the same household. You likely wouldn't want your son or daughter to have administrative access to install things that could contain malware, or change system settings resulting in the system no longer working.
It's not uncommon for thieves to simply access files on a Windows computer by plugging the drive into their own system, or by running another OS instead. This is why it's recommended to physically destroy, utilize a degausser, or wipe hard drives by writing schemes when recycling a computer. There's more about securing a "live" system with EFS below.
In an enterprise environment, because credentials are not stored on the local system, it allows the enterprise to prove that only someone with knowledge of the password could login to that account. That allows the corporation to blame and legally justify termination or prosecution of an employee (either with wrong or right justification). Accounts also allow enterprises to delegate access to certain files/shares, and select appropriate access to network resources on a per-user level.
In a portable system, most passwords prove to be "security theatre" or the appearance of security. Windows based systems are susceptible to password wiping, where one can boot into another operating system, and simply "blank", "wipe" or remove the password of an account. This is done via modifications to the SAM file.
Newer Android and iOS systems feature hardware encryption, which uses the user's password (or some form of a password) potentially combined with a unique hardware key to ensure data stored at rest is unreadable to other parties.
Windows is capable of such a system as well, with EFS or Encrypting File System. It is available on the professional versions of Windows (ex. Windows 7 Pro). It works at a file system level, and prevents other users (even with administrative levels) reading data encrypted with a certificate. An advantage of this is that it is tied to a user's account, and can allow multiple users to access the same files. In addition, it also nulls or puts in jeopardy by attackers who blank or remove a user's password under Windows because the key to access EFS certificates is also removed, effectively removing access to encrypted files. Other operating systems can not read the encrypted files because they do not have the keys to decrypt them.
Does this depend on the operating system?
As demonstrated in other previous questions, yes, it very much depends on the operating system.
Do I need the same strength of password for a limited account as an administrative one?
EDIT: To reflect the change of the last question, here are some relevant details.
If you visit the 2nd last question, I mentioned the fact that division of accounts allows for easy tracking of who did what in a corporate environment. In a home or home office, this is probably an insignificant thing. If allows people their own "space".
For home use, the administrative password should be hard to guess, and different from other online accounts you may use. Here you are many concerned about local people guessing your password.
If you run a mobile home office, or are part of an enterprise, you will want secure passwords for all accounts, as it's part of access control for email, and others. If an attacker gains access to the account, they don't have administrative privileges, but they can:
- Impersonate another user, and abuse a trust (phishing)
- Launch an attack, shifting blame to this user
- Explore other targets, as they now have "inside" access.
These again aren't such a worry in a home environment.