Penetration Testing mailing list archives
RE: Password "security" - was"Passwords with Lan Manager (LM) und er Windows" and "Whitespace in passwords"
From: "Dufresne, Pierre" <PIERRE.DUFRESNE () MESS GOUV QC CA>
Date: Fri, 14 Oct 2005 18:47:54 -0400
Hi Marco, I have read about this tool too. But there are pretty important requirements on using it. One that reassures me is that (text taken from their help file): "If files were encrypted under Windows XP (with or without SP1) or Windows Server 2003, the password of user who encrypted the files (or Recovery Agent) is needed for decryption." If one of our laptop is stolen, access to the password of the user will not be easy. Our laptops are part of a domain and the cached credentials would also be protected by SYSKEY. I am not an expert either, but I think EFS can be made stronger if you complement it with other protection measures, like SYSKEY in mode 2. I posted in this forum to see if anyone could tell me how the combination I provided could be pen-tested. Thanks -----Original Message----- From: Marco Ivaldi [mailto:raptor () 0xdeadbeef info] Sent: 11 octobre 2005 05:53 To: pen-test () securityfocus com Subject: RE: Password "security" - was"Passwords with Lan Manager (LM) under Windows" and "Whitespace in passwords" Hey pen-testers, As usual i apologize for coming late to the party, just wanted to point out this tool: http://www.elcomsoft.com/aefsdr.html http://www.elcomsoft.com/help/aefsdr/index.html?page=how_aefsdr_works.htm "Advanced EFS Data Recovery (or AEFSDR) is a program to recover (decrypt) files encrypted on NTFS (EFS) partitions created in Windows 2000, Windows XP and Windows Server 2003. Files are being decrypted even in a case when the system is not bootable and so you cannot log on, and/or some encryption keys have been tampered. Besides, decryption is possible even when Windows is protected using SYSKEY. AEFSDR effectively (and instantly) decrypts the files protected under all versions Windows Server 2003 (Standard and Enterprise), Windows XP (including Service Packs 1 and 2) and Windows 2000 (including Service Packs 1, 2, 3 and 4)." I've not tested it and i doubt it would work with the Password Startup SYSKEY option (so the setup you're suggesting should be basically safe), moreover i'm by no means a Windows expert, but EFS doesn't seem such a strong protection to me. Just my 2 euro-cents, -- Marco Ivaldi Antifork Research, Inc. http://0xdeadbeef.info/ 3B05 C9C5 A2DE C3D7 4233 0394 EF85 2008 DBFD B707 ------------------------------------------------------------------------------ Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 -------------------------------------------------------------------------------
Current thread:
- RE: Password "security" - was"Passwords with Lan Manager (LM) und er Windows" and "Whitespace in passwords" Dufresne, Pierre (Oct 03)
- Re: Password "security" - was"Passwords with Lan Manager (LM) under Windows" and "Whitespace in passwords" Thor (Hammer of God) (Oct 03)
- <Possible follow-ups>
- RE: Password "security" - was"Passwords with Lan Manager (LM) und er Windows" and "Whitespace in passwords" Dufresne, Pierre (Oct 15)
- RE: Password "security" - was"Passwords with Lan Manager (LM) und er Windows" and "Whitespace in passwords" Dufresne, Pierre (Oct 15)