RE: local admin account password

From: Tyler Larson (sf-lists_at_tlarson.com)
Date: 11/26/03

  • Next message: Tim Eddy: "Re: local admin account password" 
    Date: Wed, 26 Nov 2003 14:10:40 -0600
To: mark.ribbans@ctel.com.au

    Another variation that works surprisingly well is to assign each machine a
    unique password based on two obtainable values. One would be a secret key that
    only authorized administrators would know, and the other being some computer-
    specific value, such as the computer's network name (or better yet, something
    like the box's stock number or some other string written on the box itself).
    You can use a simple script to concatinate the two values, hash the result (MD5
    or the like) and display the output in a human-readable format, like Base64.

    It would be trivial to write an app to generate these passwords that would run
    on Palm or PocketPC devices, or other workstations. That way, if an admin
    needed to use the computer administrator password, he could just type in the
    computer key and his secret password, and he'd get the administrator password
    for that computer.

    Note that this sort of system does not provide any more security than the
    single-password paradigm from a social engineering point of view. All a
    malicious user needs is the administrator secret password and the simple app,
    and he can retrieve the admin password for any computer. On the other hand, it
    does protect against most external attacks--if a user found out the admin
    password for a single computer (L0phtCrack, etc.), that password could not be
    used to comprimise other systems. Furthermore, no stored passwords would be
    based on dictionary words, even if the administrator secret key is.

    This paradigm often provides sufficient accessability to the local
    administrator account to deny administative access to any network-based
    accounts, increasing your security another notch. After all, a super-secret
    local administrator account provides little additional security if you have a
    domain user with administrative priviliges.

    This paradigm works well for installations such as public access computer labs,
    where administrative access is seldom required.

    Quoting Mark Ribbans <mark.ribbans@ctel.com.au>:
    >
    > What i would do (and do do) is set up a password scheme as you suggested in
    > option 3. Just keep the scheme\algorithm to yourself or your IT team.
    >
    > There are a number of ways you can get specific information regarding each
    > specific PC, and you can then use part of this information as the password.
    > Two good examples of this would be the CPU ID (if enabled in the BIOS -
    > which you could then disable and then set a BIOS password too for added
    > security?) and the MAC Address.

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Tim Eddy: "Re: local admin account password"

    Relevant Pages

    • Re: DNS Attacks
      ... Relying entirely on one administrator is ... just like the secrecy of the secret key does. ... must be protected by just as rigorous routines. ... That's visible and would leave traces in obvious places. ...
      (Fedora)
    • [NT] User Downgraded from Administrator to User Retains the Ability to List Other Users Running Task
      ... Beyond Security would like to welcome Tiscali World Online ... Windows XP presents a new option called "Fast User Switching" (FUS). ... Eitan has found that if a user is downgraded from an administrator role to ... as shown in task manager)) via tempting the local ...
      (Securiteam)
    • Re: Is complete home security possible?
      ... > If you are a gamer, some computer games will only run in administrator ... I have a clean disk image made from Norton Ghost, ... security issues to deal with to do it monthly, ... I have been using computers since 76, never had a virus on any of my ...
      (comp.security.firewalls)
    • Re: FOR A SKILLED IT EXPERT - WIN2K SERVER - DOMAIN CONTROLLER
      ... After installing a parallel copy of WIN2K SERVER, ... Administrator access in Directory Services Restore Safe Mode. ... This reset the local policy back to ... manual security reset. ...
      (microsoft.public.win2000.security)
    • "run as" local denial-of-service enables administrative account processes to be killed
      ... Windows XP Professional with SP2 ... While a user, at any security membership ... A contributing factor to the success of the attack ... Log in to the computer as a local administrator. ...
      (Bugtraq)