Windows Xp Security Question

Hello, well im a newbie to Network/windows security and i would like to go into this field. I recently purchased a book by ankit fadia(i believe that was his name) and am progressing through it. Now there are two things id like to know and recieve help on if anyone would be so kind.

To get into windows 95/98 without a pass i know that you could just hit cancel or boot into dos by hitting f8 at boot and then type "ren *.pwl *.xyz" without the quotes if im not mistaking which will rename the password files and then anything you type into the password field becomes the default pass. With windows xp this is a lot diffrent. For one i can't get into dos just by hitting f8 and i don't know if that little command works with xp. I would like some info on this and possibly the names of a few websites/books other then this one (of course im going to be here quite a while :D ) and how do get into xp without the pass incase i forget it one day. I know you can get ERD commander but i know that somewhere someone knows a way to do it without that program. I appreciate any help that is given and thanks in advance.

Well, as you might have guessed XP is MUCH different than the format that Microsoft used for 98, ME, etc. The style and formatting for each of which is different and Microsoft changed that f8 dos prompt as a security clause (forgot why tho). You should visit your local library and read up/borrow some books on Windows XP (Windows XP for Dummies, The Windows XPerience, etc) that will help your study into it and will start you off right. Hope I helped :)

Mexikanpmp,

Well you are not quite correct there...............

Windows 95, 98, 98se and ME are what I would call "stand alone desktop OSes". They do not have a true "password" in the modern sense, as they have no formal security. The original intention was to allow different users to use the same machine without getting all the stuff that other users owned/used.

There is a "default user" and if you cancel the login/password screen this is what you get in as............you will have access to all files on the system, unless they are protected by third party security software. There is no point whatsoever in changing password lists etc. as the other person could just use the same technique?

Windows NT4, 2K(Nt5), and XP are commercial systems basically intended for corporate network deployments. They have a "true" security system. In the case of 2K and XP they are not DOS based either, merely offering "DOS support."

Breaking into these depends on the skill with which the security tools/options were used, and the skill of the person breaking in. There are tutorials on locking down OSes on this site, I suggest that you read them as a start.

If you are afraid of losing or forgetting your password, I suggest that you write it down and keep it in a safe place :)

Cheers

Quote:

---

There is no point whatsoever in changing password lists etc. as the other person could just use the same technique?

---

Exactly, which virtually make's these OS'es kinda suck. The technique can be used anyway, which mean's and which make's the Win95/98/ME password system a waste.

Quote:

---

If you are afraid of losing or forgetting your password, I suggest that you write it down and keep it in a safe place

---

Another good point, but that goes along with any password-formulated thing (email's, IM, logging into things, etc).

Quote:

---

Originally posted here by Mexikanpmp
and how do get into xp without the pass incase i forget it one day. I know you can get ERD commander but i know that somewhere someone knows a way to do it without that program. I appreciate any help that is given and thanks in advance.

---

Yes there are ways to get into a XP box, without the password, but they all require that you have physical access to the machine, and a bit of time. If you were to search the forums, you could probably find references to them.
The best way is to do as nihl has suggested and store your passwords in a safe place.
I use password safe (backed up in several locations) and it is only nessesary that I really remember the one password for this program. In fact, I couldn't tell you the passwords for any of my e-mail accounts, or any other online accounts, as they are stored in password safe -- and I never see them. If somehow, my admin password for my XP was lost or "I forgot it?", I would simply load a backup copy of my safe onto another system and it would give me the password. Were I to 'lose' the password for my safe, I would be in deep chit, as I don't have a clue to how to break the encryption of the safe. But every time I change it, I note it on a card that I keep locked up in a physical safe.
Password Safe

:)
Back again,
You can also create a password recovery disk for Win XP Home/Pro.
Click 'Start', go to Control Panel, click 'User Accounts'. You will have to select a user account for which you would like to create the password recovery disk. Generally you would want to create one for the Administrator Account, but you are not limited to that. Once you have selected an account, you'll see a link under 'Related Tasks' at the top left called 'Prevent a forgotten password". Follow the instructions; you'll need a Floppy and make sure you store it in a safe place, as any one can get into the system with it. Note that you can change passwords afterwards and the recovery disk will still work, regardless.

BTW, I also read Ankits book. It is a bit outdated in a sense, and all that code in the latter half comes across as just filler, but nevertheless, its a good read. I highly reccommend
"MALWARE", by Ed Skoudis. It presents the 'nuts and bolts' quite a bit more in depth, and is also very current, published 2004. When reading books, make a note of when they have been published. That is not to say that older books are obsolete; I have bought a ton of them dirt cheap recently, mainly to get up to speed with the history and underpinnings of computers and their OSes. I find myself confronted daily with issues that are hard to understand unless
I research the old stuff, such as understanding DOS, as it is invaluable when working with the Command Line Interface. Such is the lot of us newbies; we still need to develop the foundation to be effective, and I have great respect for the oldtimers.

g8way2u

Thank you everyone for all of your replies...i know i have some reading to do before i can gain the skill to break into anything. I actually really like this field and wanted to do it as a career by hackproofing computers for money and stuff like that even though i got a long way to go.

Bluthund: I know that Ankit's book is a lil outdated but seeing that i know nothing about windows 98 because the peak of my computer experince is with XP, i have decided i will start with 98 and then move on to perhaps NT and then 2000/xp and who knows ill probably tackle linux someday but thanks for the suggestions and ill definitly check that book out.

Once again thanks for everyone that put in some helpfull info i really apperciate it. I'll get right on it ;)

Hi Mexikanpmp,

Quote:

---

I actually really like this field and wanted to do it as a career by hackproofing computers for money and stuff like that even though i got a long way to go.

---

OK I have had a few more thoughts, partly prompted by the good advice of the other posters.

Whilst I strongly believe that security should be pre-emptive and precautionary, we have to accept that it is fundamentally defensive in nature?...............like tanks came before anti-tank guns, mines before minesweepers and aircraft before AAA (apologies to any Marines out there :) )

1. Look at it from the lockdown side first, rather than exploits and intrusions.
2. Google search for "security software" "freeware" and such combinations, and just look at what is on offer, and WHAT IT PROTECTS...........this will tell you the potential vulnerabilities.
3. Don't forget the PHYSICAL security side (thanks moxnix) If your machine is physically vulnerable your "hackproofing" is useless...........for example, how do you hack a machine whose removable hard drives are in a safe? Look at physical keyloggers, and research "TEMPEST" and "Nonstop"............secure cabling, secure networks..... etc.
4. Don't forget the human element.....education, training, social engineering, usage policies?

OK, I am not suggesting that you become an expert in all these areas, but in the real world you will be a part of a team, so you need to know what the other players do? and understand the issues. "A security chain is certainly only as strong as its weakest link" ;)

Hope this helps

Cheers

creat a password recovery disk & thats all

Quote:

---

I actually really like this field and wanted to do it as a career by hackproofing computers for money and stuff like that even though i got a long way to go.

---

Uhh, no computer is hackproof. The only way to do that would be to unplug the computer entirely, lock it in a safe, and chip it off to sea.

Quote:

---

creat a password recovery disk & thats all

---

Uhm, that doesn't solve all problem's and your saying it does. What if he loses the disk? lmao, it could be the same way with writing it down on a piece of paper, what if someone else get's a hold of it?

Quote:

---

Uhh, no computer is hackproof. The only way to do that would be to unplug the computer entirely, lock it in a safe, and chip it off to sea.

---

Yes i understand that. However, not everyone knows that :D

Hi Mex.

Quote:

---

Yes i understand that. However, not everyone knows that

---

It is your moral ($$$$) duty to make them aware of the fact? :D

As in: "And for a suitable fee, I would be glad to review your security arrangements on a quarterly basis to ensure that your defences remain state of the art sir" :D

$eriously, I would also recommend that you look into "business continuity" and "disaster recovery"? let's face it, there is no real point in having a system that is like Fort Knox if some jerk at the power supply company can kill it in a microsecond, or a fire trashes the lot?

So we are now looking at:

1. Backup sites (including ready prepared offices) & data backup/security
2. Uninterruptable power supplies
3. Business processes (how long can they survive without IT)
4. Fire & flood protection
5. Anti-terrorism (they may run out of C4 one day, or even have some left?)
6. Industrial espionage (or the real thing in my experiences)

It is not an easy field to break into, so you need to be aware of these issues, as that is what will single you out in an interview?

I wish you luck, as you are at the start of your career when the end of mine is in sight :)

Cheers

Quote:

---

Uhh, no computer is hackproof. The only way to do that would be to unplug the computer entirely, lock it in a safe, and chip it off to sea.

---

Or I put a firewall on, block all ports, install software I trust, and stand beside my machine with a shotgun. Come on, I dare you to physically try to access it.

Quote:

---

Originally posted here by nihil
Hi Mex.



It is your moral ($$$$) duty to make them aware of the fact? :D

As in: "And for a suitable fee, I would be glad to review your security arrangements on a quarterly basis to ensure that your defences remain state of the art sir" :D

$eriously, I would also recommend that you look into "business continuity" and "disaster recovery"? let's face it, there is no real point in having a system that is like Fort Knox if some jerk at the power supply company can kill it in a microsecond, or a fire trashes the lot?

So we are now looking at:

1. Backup sites (including ready prepared offices) & data backup/security
2. Uninterruptable power supplies
3. Business processes (how long can they survive without IT)
4. Fire & flood protection
5. Anti-terrorism (they may run out of C4 one day, or even have some left?)
6. Industrial espionage (or the real thing in my experiences)

It is not an easy field to break into, so you need to be aware of these issues, as that is what will single you out in an interview?

I wish you luck, as you are at the start of your career when the end of mine is in sight :)

Cheers

---

I also am aware of this and as time passes getting a job or starting a business becomes much harder. That is why i am not only going to study network security but am already starting some books on HTML, i have pretty good photoshoping/Macromedia MX studio skills and am going to start on java after html. I am also thinking about reading one of my C++ books and am looking for maybe 1 more field to study. If i can't find a decent job after all this study "I QUIT!" LOL! Right now i only know how to build/troubleshoot computers both on hardware and software and i know may way fairly around windows xp which is enough to fix my own problems and build/upgrade my computers without the need of a professional company.

I do have plenty of time before i have to worry about anything seeing im 16(junior in high school and 17 this year) but once im in college i won't have time for all of this as i will be studying other things (probably major in business) and screwing around...heh.

Thanks for the advice and replies i do appreciate it.

W4197


That is what is engraved on the breech block..............guess that makes it one of the first P.14s that the US shipped to the UK in WWI? (I think that Remington and Springfield were also in the act?.....mine is a Winchester :) )
It was a commercial Mauser '98 action chambered for the British .303 round (My Mauser '98 was made at the Erfurt Arsenal in 1908....beautiful engraving.....engine turned bolt..........)

Both have been converted to .308WIN (7.62x52 NATO) (no skiddies, that is NOT a new MS operating system for you to play with :) )

Pooh, will your shotgun reach out to 600 yards?...............OK when I was young, I could do 1200..............metallic sights, of course............otherwise, it is an L39A1, or an L96A1 :p

I could get access old (deceased) chap!

Cheers

Quote:

---

I do have plenty of time before i have to worry about anything seeing im 16(junior in high school and 17 this year) but once im in college i won't have time for all of this as i will be studying other things (probably major in business) and screwing around...heh.

---

Keep in touch with this site.....even if you do not post, I am old enough to be your grandfather.....just :D but there are all age groups and interests here...

You have a good attitude for things as they are today..............excellent!

And I admire the fact that someone of you age is so mature in their outlook........"old head on young shoulders" is what we call that over here :)


I sincerely wish you the best of luck


Johnno

they basically have different in security like what i read from nihils msg, that XP, NT or for network based computer while 98,95 win are stand alone but OS that is build for networking must have a greater security than stand alon computer.. that y it's best to use unix or linux OS give a better security than windows <--- heheheh just my opinion ... but use windows for gaming porpuse ...

Sgear17

I take your point, you are now in the server area? OK I agree VMS, CICS (forgot it :) ) and those mainframe OSes are fireproof because punks do not have a 415 volt triple phase power supply, and the box is bigger than their bedroom............


Just my thoughts?

nihil, are you that old? :D

BTW, CICS is an application, not an OS. MVS is an OS.
Isn't it 380 volt triple phase power supply? And why not having it has something to do with fireproof?

Peace always,
<jdenny>

Quote:

---

Originally posted here by nihil
Sgear17

I take your point, you are now in the server area? OK I agree VMS, CICS (forgot it :) ) and those mainframe OSes are fireproof because punks do not have a 415 volt triple phase power supply, and the box is bigger than their bedroom............


Just my thoughts?

---

Not quite true :D

IBM produced a standard PC version of their mainframe CPU which would fit on a PC PCI card.
You could then install this on a normal PC, and it would behave as if it were a mainframe.

I've seen this working in the distant past, as we installed OS/390 on it, had 10 CICS users, and connected an old fashioned tape drive to it using the massive old channel cables, by using another specially designed card.

:cool:

In defence of Nihil: as a child of the 50's myself, it's not that old.
and the electricity supply varies around the world. UK = 3 phase 415v = 240v per phase.
trust me 240 + 240 = 415 when the phase angle is put in ( generation is a cycle? (not THAT type of cycle) 3 take off points = the phases, and the angle between them = 360/3 = 120) In the US of A the voltages are different, as are the values from practically every other country. Don't even ask about the frequency (Hz) me Electrical geek ?? for the last 30 !!!! years.

Hi jdenny,

1. Yes I am
2. Quite right, now I think on it it was a MVS/CICS environment, MVS being the OS............the VMS was used on Digital/VAX boxes (PDP11s?) for process control etc.
3. The industrial supply over here is 415volt three phase, except for construction sites where our safety laws require 110v single phase.

I guess my point is that mainframes are not likely to fall into the hands of skiddies because of their size, unusual voltage, and thinking on it, the fact that a lot of the old ones are water cooled, and require quite a sophisticated environment (degaussing, air conditioning etc).

Also I doubt if most skiddies could be bothered with learning a mainframe OS? and the systems tend to be internally facing rather than external? Outside connections tend to be through Windows and *nix servers?

darkes: thanks for that, never came across it myself but I bet the cards weren't cheap? I do remember playing with an IBM machine that physically looked like a PC, but was a miniature AS/400..................that was in the £ '000s!!!

Cheers

Quote:

---

Or I put a firewall on, block all ports, install software I trust, and stand beside my machine with a shotgun. Come on, I dare you to physically try to access it.

---

No problem.. nothing a good ole' napalm bomb wouldn't do, or a nice revolver that I could use to snipe you from across tha street with wouldn't do :D Not saying I would do this, btw.. :D