Re: disclosure the administrative password

From: Thor (thor_at_hammerofgod.com)
Date: 02/01/05

  • Next message: Tom Stowell: "Re: disclosure the administrative password" 
    To: "Boris Skoblo" <borsk@techunix.technion.ac.il>, <focus-ms@securityfocus.com>
Date: Tue, 1 Feb 2005 13:58:36 -0800

    This sounds like one of those "loaded" questions... This is a security
    list, so we will want to know "why." Why is a smart card and all other
    hardware not applicable? Why can't the operations be delegated? And so
    what if it is a custom logger- it's still a driver. Is it a root kit
    logger? If so, how do you know that? What actions does the admin have to
    perform that require RunAs in the first place, exactly? Answering these
    will help us give you better answers.

    Wipe the machine and prevent non-admin loading of drivers. User SAFER
    restrictions to only allow designated software to run. Initiate corporate
    policy to fire and or prosecute offending users. Use Remote Desktop on XP
    to initiate administrative tasks which bypass the hardware keystroke logger
    (until Blue Boar and I write our Terminal Services Keystroke Logger, that
    is. We're calling it Terminal Stroke.) Worse case, change the admin
    password after you have to do whatever it is you have to do as an admin on
    the box.

    T

    ----- Original Message -----
    From: "Boris Skoblo" <borsk@techunix.technion.ac.il>
    To: <focus-ms@securityfocus.com>
    Sent: Tuesday, February 01, 2005 4:50 AM
    Subject: disclosure the administrative password

    > Hi All,
    >
    > There is a usual situation: on normal users computers ( W2k and Winxp )
    > an administrator should perform an administrative actions
    > (for example, with help RunAs) thus the administrative password is
    > entered. Do exist a potential possibility that on the user's computer
    > there is keylogger.
    >
    >
    > What ways to perform administrative operations exist, thus not endangering
    > disclosure the administrative password? There are some limitations:
    >
    > 1. usage of smarts-cards and others hardvare devices are not applicable .
    >
    > 2. performed operations cannot be delegated for various reasons
    >
    > 3. keylogger is custom designed and any of existing protective software
    > yet does not find out it
    >
    > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
    >
    > Regards,
    >
    > Boris Skoblo
    >
    > ---------------------------------------------------------------------------
    > ---------------------------------------------------------------------------
    >
    >
    >

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Tom Stowell: "Re: disclosure the administrative password"

    Relevant Pages

    • Re: Unauthorized Monitoring of Email
      ... were REQUIRED to give the administrative password to the NEW OWNER'S ... administrative account as well as the local admin account on the individual ... read permissions on the store to the Administrator account. ...
      (microsoft.public.windows.server.sbs)
    • RE: Want to be administrator
      ... how would you do a REPAIR installation of XP home if it requires you to type ... in the administrative password before you can continue and you cannot access ... any user accounts features? ... keeps telling me I need to be an administrator. ...
      (microsoft.public.windowsxp.security_admin)
    • Unauthorized Monitoring of Email
      ... Change the administrative password - From what I understand, ... administrative account as well as the local admin account on the individual ... read permissions on the store to the Administrator account. ...
      (microsoft.public.windows.server.sbs)
    • Re: disclosure the administrative password
      ... >) an administrator should perform an administrative actions ... thus the administrative password is ... > What ways to perform administrative operations exist, ... keylogger is custom designed and any of existing protective ...
      (Focus-Microsoft)
    • Re: Alternative to Windows Explorer
      ... One drawback if you use that "runas" approach then you really won't know ... Administrator versus their using their actual account. ... admin, a variation of their normal account. ... > pen testing experience in our state of the art hacking lab. ...
      (Security-Basics)