4

I use syskey in windows XP and Windows 7. I've read Microsoft's article but I have questions.

  1. How does this solution increase security?
  2. What are differences between using Syskey in a client that joins an Active Directory with a certification server vs. a workstation? Does syskey achieve more security if used in a client that joins a domain controller?
  3. In windows XP and 7, this command makes a floppy. Are there any way to make a USB removable device? or a wireless device that will allow me to log in with a Bluetooth wave device?

2 Answers 2

3

I'll answer only the first question.

If hashed Windows passwords are stored in the clear they are susceptible to two kinds of attack:

  • Crack the hashed passwords using brute force. This is can be done because Windows doesn't use a slow password hashing algorithm like PBKDF2 or bcrypt.
  • Pass the hashed password to the Windows kernel. This attack is described in this SANS
    paper
    .

So Windows encrypts the hashed passwords with syskey. The problem is: if syskey is stored on the same machine as the hashed passwords then this doesn't do much - an attacker with access to the (encrypted) hashed passwords most likely also has access to syskey and can decrypt the hashed passwords. Therefore it's important to keep syskey on a separate device such as a removable disk.

6
  • only if copy the files in the floppy disk are useful ? or make a iso copy with ultraiso? (or another iso maker) Oct 30, 2012 at 9:59
  • 1
    As long as syskey is not stored on the Windows machine but in a removable storage device you should be OK. Graham Hill wrote in his response that if you map a USB drive to A:\ syskey will be written to that drive. If so that's probably you're best bet. Oct 30, 2012 at 11:48
  • thanks to @graham hill, so instead of Floppy Drive i can .. 1- in disk management with change drive letter or 2- share a folder and map it (by it's FQDN ) as drive A: Oct 30, 2012 at 12:50
  • 1
    The drive has to be present at boot, so a network share is not going to work. Oct 30, 2012 at 13:49
  • if i have nessesary points to +1 your comments , do that , but now im 13+ and only i can say thanks for this Note Oct 30, 2012 at 14:05
5

Addressing each part in turn:

1) This control protects against the following threat scenario: An attacker gets physical control of the machine's hard disk. They extract the local SAM database, which contains password hashes for the accounts on the machine and brute force them to get the passwords which they use to log onto another machine they do not have physical control of. SYSKEY works by encrypting the local copy of the password hashes and writing the encryption key to a floppy. You provide the floppy with the key on at system boot.

2) Any machine that isn't a domain controller only stores hashes for local accounts in it's SAM database, so it doesn't really change the attack if the client is participating in a domain or not.

3) Apparently SysKey just writes to whatever's been assigned the drive letter A:, so if you force a USB key to use A: in Disk Management, it'll work. The drive must be present and mounted at boot, so you have to use a floppy or USB disk, not a network share or device. You should also store the floppy/USB (and any backups you make of it) separately from the machine, since the threat is that physical control of the machine is lost.

Lastly, in more general terms, you're doing it wrong! You've implemented a control without knowing what it does. Do a proper risk assessment, understand the threat, then select the control.

It's quite likely, for example, that implementing full disk encryption and using strong passwords and tightening physical security on the device will be more than enough to manage the risk of someone carrying out the attack described above.

5
  • is it secure if i backup a copy of floppy Disk and attach in my gmail? or encrypt with winrar? Oct 30, 2012 at 12:57
  • Absolutely not. Oct 30, 2012 at 13:43
  • 1
    @GrahamHill Encrypting it with a decent password in winrar, whynot?
    – Luc
    Oct 30, 2012 at 13:45
  • i think compressed & encrypted with password by winrar is secure Oct 30, 2012 at 13:54
  • 1
    Ah, good point Luc, I'd forgotten that WinRAR uses AES. Oct 30, 2012 at 14:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .