[TOOL] Safe Run As - Keylogger Protection
From: SecuriTeam (support_at_securiteam.com)
To: firstname.lastname@example.org Date: 7 Mar 2005 10:30:13 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
- - - - - - - - -
Safe Run As - Keylogger Protection
This tool is created to protect administrative passwords against
keyloggers. Administrators passwords are stored in the AES encrypted file
on the removalable storage (flash-drive, floppy). Then, when you need to
use 'run as' command you launch saferunas.hta, and provide username and
Password are decrypted and cmd.exe is launched with selected user's
privileges. Edit.hta tool can be used to create and modify file with
1.This tool doesn't protect against smart malware which can copy password
file and steal encryption key.
2.You cant choose program to run. Coming soon.
3.In this version password entered is used as AES key directly. This is
bad idea. PKCS#5 version is coming soon.
4.Attention when you run GUI application as high privileged user, you are
vulnerable for Shatter-style attacks (see shatter vbs for example).
The tool can be obtained from:
The information has been provided by <mailto:email@example.com> Sergey
To keep updated with the tool visit the project's homepage at:
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: firstname.lastname@example.org
In order to subscribe to the mailing list, simply forward this email to: email@example.com
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.