1

I've been recently searching for a backup solution for my Windows desktop. That's when I came across this free software called EasyUS Todo Backup. (I know it's a mouthful but English doesn't seem to be their first language.) So I downloaded a copy and tried it in my VM before deploying it on the actual computer.

What immediately struck me was that the software required me to provide my Windows administrator account password when I was scheduling the backup. I was faced with the following screen and the error message if I failed to enter my admin credentials:

enter image description here

So I'm curious, from a security standpoint, how safe is it to provide these credentials to a third party software like this?

8

On the one hand, it's crazy dangerous. There's nothing more dangerous you could do on a computer than give an untrusted program administrative access to your computer. There are no limits to what the program could do; install rootkits, delete your files, add your computer to a botnet. Anything.

On the other hand, that's exactly what you do every time you run a program as administrator. So, if the program is going to do something nefarious, it doesn't need to save your password. It just needs you (the administrator) to run the program with elevated privileges. Which you probably already did before you got to this point.

As for what the additional danger is in allowing the program to save your password: Windows internally stores your password as a one-way hash. Nothing, not even Windows, can retrieve your password until you type it in yourself. But by providing the password to this program, now you're additionally storing it either plain-text or using reversible encryption. So you've decreased your level of safety by one notch. Not a ton, but it is indisputably lower now. And if they do this bit poorly, then all the worse for you.

Next, Windows actually encrypts certain key bits of your security profile using your login password. These bits are not accessible to anyone or anything until you've provided your password to log in. This is wonderful and super and all that, but it also means that nothing can impersonate you (not even this backup program) without your password. And in particular, scheduled tasks can't run as you without your password. This is just the way Windows was designed; it has nothing to do with this backup program.

And finally, since this issue with scheduling tasks to run as a user is a known problem in Windows, there's actually a core system function for storing your login credentials specifically for use running scheduled tasks. This means that the backup program doesn't have to store your password, it just has to tell Windows to do so. So it's unlikely that this backup program is directly doing anything with your password, they're probably just handing it off to Windows to use with its built-in task scheduler.

So in that case, the safety of your password would be more of a function of the safety of the Windows task scheduler, not this backup program.

  • Thank you. I agree with what you said in your first two paragraphs. My main concern though is about proving this software with my admin account password. You brought up an interesting point about Task Scheduler. But I checked, and no, this software does not create any scheduled tasks. It stores that password somewhere internally. How much more dangerous can that be? – MikeF Oct 22 '13 at 6:52
  • @MikeF It could be anywhere along the continuum between (a) using the task schedule and (b) storing your password in a text file on your desktop named my password.txt. Somewhere along that line, I'd recon. – tylerl Oct 22 '13 at 6:55
  • Btw, I contacted the vendor for which I received the following reply, You still need to input your Admin account and password of your Windows system. Then our product automatically execute the backup job. and then Please note that technical questions of free users will be not replied any more... – MikeF Oct 22 '13 at 6:56
  • Sounds like they're not very bright. I personally wouldn't trust them, but do as you wish. – tylerl Oct 22 '13 at 6:57
  • 1
    Thanks for your input. And, no, it's not in the task scheduler. I checked several times. It is not in a plain text form either. I truly don't know what they do with it... as to going back to how it should be done, this is easy. It's done by pretty much most other software running on your Windows system -- services running as LocalSystem. They have full access to the system without the need to know user passwords. – MikeF Oct 22 '13 at 6:59
2

When you choose to install software, you assign a certain amount of trust to it. You trust that the software would not do anything malicious to your computer or your data, such as send it to a remote server without your permission.

At this point in time, it wouldn't matter if the software is asking for your admin credentials, especially if you installed it with administrator rights. If it were malicious, the software can just use those admin rights to subvert any of the components in your computer. However, the software could legitimately need your admin credentials for offline backups, as you may not be logged in when it does a system backup and it needs admin rights to access system files.

TLDR: do you trust the software, do you truly know what it does behind your back, and have you already given it more permissions during install than you think it should have?

  • Please read my comment posted for @mgibsonbr's answer below... – MikeF Oct 22 '13 at 4:04
  • @MikeF: As he has provided a more comprehensive explanation for the problems I brought up (and included scheduled tasks), I am upvoting his better answer. – Nasrus Oct 22 '13 at 10:31
0

That would depend on how this software stores these credentials. If the software was installed with admin rights (and as such would already be able to do mostly all damage it could - see @Nasrus answer) then to access the file/database/whatever where the password (or some password-equivalent data) is stored one would need to be already logged on as admin. In this case it's not really a problem, as long as you trust the software. Otherwise - and if the computer is shared by multiple people - it could be a potential enabler for privilege escalation.

Ex.: Alice leaves the computer unsupervised, and Mallory accesses her account. In principle, Mallory can only damage Alice's files, since she does not have the admin credentials. However, if Alice installed this software, then there must be some file accessible by the software (and thus by Alice) containing the admin password. So, Mallory can search for this file and proceed to login as admin.

(of course, if Mallory has physical access to the computer there's a lot worse she can do, but here I'm talking about the low hanging fruit)

In short, it should be safer to install and run it as admin then as a common user (I was going to suggest creating a separate account exclusively for this software, but I think it would be futile - since it already has access to the admin credentials once you give it...).

  • Thanks. There's one essential difference between the example that you and @Nasrus brought up. When a program requests escalation of privileges and a user (me) grants it, the program does not get access to my admin password. All the program gets is an admin token. And this distinction is very important. In this case though the 3rd party program requests the password in the clear, and that is my main concern, since it's obvious that my password will be stored somewhere in the registry... shall I continue why that would be VERY bad? – MikeF Oct 22 '13 at 4:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.