Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reset a Windows 8 Password without using any third party software

reboot.pro

Post reply on HN
Print view View original

21–30 of 34 posts

Re: Reset a Windows 8 Password without using any third party software

#21

Post by bloblaw »

antoncohen wrote: post #19
Deestan wrote: post #17

Earlier quoted context omitted.

The article assumes you have enough access to boot the computer from an alternative medium. They can't just "fix" that short of forcing full disk encryption.

I was referring to the login GUI running with full privileges, meaning any time someone finds an arbitrary code execution vulnerability in the GUI they can get full admin access. I wasn't referring to using a boot disk to reset a password. As far as I'm concerned that's a feature not a vulnerability, and it's a feature Windows makes unnecessarily hard to access.

The "GUI" is in the kernel (gdi32.ll, user32.dll, comdlg32.dll, etc). What you see at the CTRL+ALT+DEL screen is actually the "SYSTEM" user's desktop.

You are, however, technically correct, but finding arbitrary code execution vulnerabilities in the "GUI" these days is not a trivial task. And if you've done that, you can do anything you want to the system.

As Raymond Chen (Windows API developer) would say "that would involve being on the other side of this airtight hatchway".

Re: Reset a Windows 8 Password without using any third party software

#22

Post by bloblaw »

Xylakant wrote: post #11
Aardwolf wrote: post #9

Earlier quoted context omitted.

Yes it is: remove harddrive. Put harddrive on other PC. Read contents of harddrive. Or even reboot the existing PC with an OS on USB or optical drive. Unless the HD is encrypted of course, but that is not what this article and password is about.

Well, given that you can install a keylogger on the usb keyboard nowadays, it is - even with encrypted harddrives. Or you can freeze the RAM, remove it and read the encryption key. However, encryption makes things quite a bit harder.

The trick with defeating cold boot attacks (aka freezing the RAM) is easily mitigated by a system administrator that forces the system to hibernate instead of sleep (aka write volatile memory to disk).

It can also be mitigated by requiring not just the TPM chip, but also a PIN, PASSCODE, or a PASSCODE that is cycled ever 60 seconds or so (on something like an RSA fob).

This presumes the system has a TPM chip, or a similar mechanism that can provide an original point for a trusted boot.

Re: Reset a Windows 8 Password without using any third party software

#23

Post by antoncohen »

EvanAnderson wrote: post #20
antoncohen wrote: post #7

I can't believe they haven't fixed that. I discovered that the login prompt ran with system-level privileges in Windows 95. I used it to play Duke3D in computer class when I was 14. You could press Ctl+Alt+Del to bring up Task Manager, from Task Manager you could choose to run a command, and run explorer.exe. It would start Windows with full admin access.

Windows 95 had no security model. There are no "system-level privileges" in Windows 95. If you could execute any code on the machine you "owned" it. There were some contrivances in the shell to attempt to limit user access, but nothing serious like the security architecture of Windows NT.

You are correct that Windows 95 did not have the security model of NT, but administrators could limit what users were allowed to do in the Windows shell. If I logged in with my user account I could not play the game I wanted to play.

"You can restrict what users are allowed to do from the desktop and what they are allowed to configure using Control Panel." - http://technet.microsoft.com/en-us/library/cc751094.aspx

Re: Reset a Windows 8 Password without using any third party software

#24

Post by eli »

antoncohen wrote: post #7

I can't believe they haven't fixed that. I discovered that the login prompt ran with system-level privileges in Windows 95. I used it to play Duke3D in computer class when I was 14. You could press Ctl+Alt+Del to bring up Task Manager, from Task Manager you could choose to run a command, and run explorer.exe. It would start Windows with full admin access.

They did fix it. It's called BitLocker and it encrypts your drive. The password was never intended to stop people with physical access and the ability to boot to a disk. Consider the process for resetting your Ubuntu password: http://www.howtogeek.com/howto/linux/reset-your-forgotten-ub...

Re: Reset a Windows 8 Password without using any third party software

#25

Post by Xylakant »

bloblaw wrote: post #22
Xylakant wrote: post #11

Earlier quoted context omitted.

Well, given that you can install a keylogger on the usb keyboard nowadays, it is - even with encrypted harddrives. Or you can freeze the RAM, remove it and read the encryption key. However, encryption makes things quite a bit harder.

The trick with defeating cold boot attacks (aka freezing the RAM) is easily mitigated by a system administrator that forces the system to hibernate instead of sleep (aka write volatile memory to disk). It can also be mitigated by requiring not just the TPM chip, but also a PIN, PASSCODE, or a PASSCODE that is cycled ever 60 seconds or so (on something like an RSA fob). This presumes the system has a TPM chip, or a si…

The trick is also easily defeated by turning the machine off instead of letting it sleep. Certainly. You could as well just go and make the case locked and hard to break, possibly coupled with an alarm. I was just pointing out that "encrypted disk" does not mean "100% secure".

Re: Reset a Windows 8 Password without using any third party software

#26

Post by illuminate »

Xylakant wrote: post #11
Aardwolf wrote: post #9

Earlier quoted context omitted.

Yes it is: remove harddrive. Put harddrive on other PC. Read contents of harddrive. Or even reboot the existing PC with an OS on USB or optical drive. Unless the HD is encrypted of course, but that is not what this article and password is about.

Well, given that you can install a keylogger on the usb keyboard nowadays, it is - even with encrypted harddrives. Or you can freeze the RAM, remove it and read the encryption key. However, encryption makes things quite a bit harder.

Are there seriously examples of the RAM-freezing working, or is this a theoretical attack?

Re: Reset a Windows 8 Password without using any third party software

#27

Post by mganon »

antoncohen wrote: post #23
EvanAnderson wrote: post #20

Earlier quoted context omitted.

Windows 95 had no security model. There are no "system-level privileges" in Windows 95. If you could execute any code on the machine you "owned" it. There were some contrivances in the shell to attempt to limit user access, but nothing serious like the security architecture of Windows NT.

You are correct that Windows 95 did not have the security model of NT, but administrators could limit what users were allowed to do in the Windows shell. If I logged in with my user account I could not play the game I wanted to play. "You can restrict what users are allowed to do from the desktop and what they are allowed to configure using Control Panel." - http://technet.microsoft.com/en-us/library/cc751094.aspx

Because of the absence of an underlying security model, this very often did not work properly, i.e. you could workaround pretty much every kind of "restriction" on Windows 9x by smart mouse and keyboard only moves.

Re: Reset a Windows 8 Password without using any third party software

#28

Post by eps »

zokier wrote: post #4

basically by replacing utilman you can execute arbitrary code with system(?) privileges? does the login manager check the signature of the executables? Full-disk encryption sure is nice thing to have, even if it isn't bulletproof.

Checking signatures obviously won't help here.

Re: Reset a Windows 8 Password without using any third party software

#30

Post by UnoriginalGuy »

antoncohen wrote: post #19
Deestan wrote: post #17

Earlier quoted context omitted.

The article assumes you have enough access to boot the computer from an alternative medium. They can't just "fix" that short of forcing full disk encryption.

I was referring to the login GUI running with full privileges, meaning any time someone finds an arbitrary code execution vulnerability in the GUI they can get full admin access. I wasn't referring to using a boot disk to reset a password. As far as I'm concerned that's a feature not a vulnerability, and it's a feature Windows makes unnecessarily hard to access.

The "login GUI" is actually the process that launches user's sessions and then passes control of the screen/input to that session. It has to have "better than" administrator level access to do so (since it has to broker administrator sessions).

Even if you ran the actual GUI as some special user, that GUI would still have to be able to do a bunch of powerful things using SYSTEM level services, so any exploit would be equally as powerful if it went after the SYSTEM login GUI or the login service.

What you're suggesting would be meaningful feel good security with no actual teeth. Attackers would just use the boot disk to alter a different file or process.

Post reply on HN