BIOS Security

If I wanted to set up a LAN where people could use computers, but I would lock the BIOS so that it would not allow for them to run boot disks and such for security purposes, would there be a way of someone working around it?

Assuming I'm using a PhoenixBIOS 4.05, Windows NT, would there be scripts that would allow someone to extract the BIOS password and boot from a disk? Or maybe even use a master password. If so, what would these thing be. If there are master BIOS passwords there's obviously nothing I can do but for scripts, I could prevent them with custom virus detection.

Yeah, pulling the battery off the motherboard would do it.

Well, I already locked up the cast so it couldnt be opened, and if they do, I could see them do it from the head desk, so its not really an option. But when the computer screen is not facing me, I don't know what they are up to.

Some things to consider:

- disable the floppy and cdrom drives. This will avoid a person being able to boot and use "scripts" to disable/alter the bios settings

- use security screws on the cases. This will prevent someone from opening the case up and removing jumpers/batteries to wipe out the BIOS settings

- if possible, lock the machines up in a secure setting. This along with the other two options will mitigate some of the risk of someone gaining physical access to the machine.

No security system is perfect but making it harder helps.

I'm with MsMittens on this one, if you're suppling them with a LAN to use - just don't allow the use of floppies and/or cdroms.

It takes a little more of the person sitting at the head-desk's time, if you want to offer them the option of saving to a floppy/cd-rom just have a folder setup for them to save into and require them to ask the person to save it for them. (Ergo don't even have floppy drives or cdroms in any system except the one at the head-desk)...

Likewise, if you want them to be able to install games to play - (big if their) - then require them to ask that person to do it for them. (For this occurance it maybe easier to just put some sort of lock over the fluppy/cd-roms that the head-desk person can unlock)...

That'd be my suggestions...

RRP

We have systems that have floppies, ZIP, CD-ROM, DVD, DVD +R and DVD -R, combos and whatnot. We secure the BIOS and set a specific boot order, HD then NIC (that way if some creative student blows away the hard drive, it will boot top the NIC and try to get a fresh image). When we get ready to re-image, we open the BIOS, add the DVD to the top of the boot order, then DeathDisk the systems (uses DelPart), and reboot.

This allows the students to use the floppies, ZIPs, CD, DVD, even the USB thumb drives, without allowing them to boot from them.

We prevent messing with the internals (BIOS reset jumpers and such) by locking the cases.

I assume you are using win2kpro. You can just create user accounts and restrict their access to almost anywhere you want inthe network. You can also change the bios settings by pressing del key or F8. So computer won't boot-up from cd or floppy drive. Why would someone wanna crack bios password anyway? They would go for the administrator password to get the whole control over the network.

http://www.techtv.com/screensavers/a...339621,00.html

http://www.pwcrack.com/bios.shtml

I therefore agree with MsMittens

Quote:

---

- disable the floppy and cdrom drives. This will avoid a person being able to boot and use "scripts" to disable/alter the bios settings

- use security screws on the cases. This will prevent someone from opening the case up and removing jumpers/batteries to wipe out the BIOS settings

- if possible, lock the machines up in a secure setting. This along with the other two options will mitigate some of the risk of someone gaining physical access to the machine.

---

Dr _Evil

but what worries me is that someone might be able to run a BIOS crackers from the Windows NT to reveal the BIOS password. Are there such tools?

such as?

Most command-line utility can do it

Dr_Evil

Quote:

---

Originally posted here by VladiO
such as?

---

Look around and you can find them using Google but if you have done as was suggested earlier and give them a restricted account with limits on what programs can be run (user and computer policies) plus have a firewall that limits downloads then you shouldn't have any problems with this.

You also cant always be watching everything, and somebody wearing a jacket with a nifty Network security shir underneath could go right past you, then when they get to a computer that is inyour blind spot take off the jacket with the shirt underneath to sooth the suspicions of other users (many people dont understand how easy this is to do, and how many people actually fall for those thinkgeek shirts lol). reenabling the drives is just a matter of going to safe mode, or getting to the registry (which no matter what restrictions you put on from a win machine it will always be easy).

The best bet is to physically unplug the drives. You can leave them in there, but with those security screws in place (along with educated users, with signs warning of possible vandalism attempts) it will make it extremely hard for the person to go through. The AIM thing, where they have the warnings that say nobody from AOL will try to get billing or pw info is a great example to follow!!! Signs and fake cameras with a possible TV that shows one camera feed will discourage even the hardest crackers...unless they are a previous employee who knows all your tricks :)

I'm not responsible for how you use the info, but NOTHING is truly secure!!!! Reminds me of a quote that I read in one of LoDs technical journals (and quite famous in other places also) before I realized they were obsolete (yes, laugh it up lol I had just started and didn't know crap hehe). Here is the quote:

"The only system which is truly secure is one which is switched off and unplugged, locked in a titanium lined safe, buried in a concrete bunker, and is surrounded by nerve gas and very highly paid armed guards. Even then, I wouldn't stake my life on it.'' Dr. Gene Spafford

Quote:

---

I'm not responsible for how you use the info, but NOTHING is truly secure!!!! Reminds me of a quote that I read in one of LoDs technical journals (and quite famous in other places also) before I realized they were obsolete (yes, laugh it up lol I had just started and didn't know crap hehe). Here is the quote:

"The only system which is truly secure is one which is switched off and unplugged, locked in a titanium lined safe, buried in a concrete bunker, and is surrounded by nerve gas and very highly paid armed guards. Even then, I wouldn't stake my life on it.'' Dr. Gene Spafford

---

Right....

Google will probably give you a list. I know from experience (shame on me) that you can run most BIOS crackers from a restricted account. The archives here at AO should have BIOS crackers. Is this at a school/university? Also pulling out the battery or messing with the jumpers in a computer lab is blatantly obvious and almost immediate removal.

Quote:

---

(which no matter what restrictions you put on from a win machine it will always be easy)

---

Not if you set it up correctly. Although I think it would be better if Windows switched to a *nix like multi-user system.

Here is a sight that has some information.

-Sam-

Thanks, its a whole lotta good ideas. I've looked through the BIOS password command line scripts and still I don't see a way of preventing them.

Someone could easily dump the 6kb file in binary into an email, re-assemble the source code locally, and find the BIOS password.

This is still the only thing that worries me.

Oh certainly. There is no such thing as 100% perfect security but making it harder for someone to do this helps mitigates some of the risk. So keep that in perspective.

For sure, that's why I've set up decoy cameras/security systems. Really freaks out a thief to see "Protected by Guard Dogs" or "24/7 Closed Circuit Surveillance" when they try to rob you.

its easy. u password protect the bios with the highest number of letters and u update the bios. only allow for the hd to boot then the nic. make sure they cant choose the boot order by pressing a key. then when thats done u disable all files that controll startup stuff. io.sys command.com stuff like that.

default BIOS passes can be found at ankitfadia.com
worth a try

Hey I thought that site was down.Its up again !


Thanks

Dr_Evil