Printable View
Does the strength of my login password in xp protect me from hackers on the internet, or does the login password only protect you from someone sitting there physically trying to type your password to get into your account?
My login password is not a network password, right?
thanks in advance
XP password on your user account is for physical access to your box or for folks wanting to use your user account remotely from across the network. If a user account has administrator rights, it should be secured with a very strong pass.
For example:
User Fred has a username 'Fred' with administrator rights. It's the only account on his system he ever uses. His computer has 2 other user accounts on it he may or may not know about (yes, there's really 3 or more but we won't count MS's backdoor accounts) depending on his level of experience with WinXP - Administrator, and Guest.
On a reasonably secure system, Guest is disabled. Administrator will be passworded strongly, as will Freds, but Fred isn't a reasonably secure kind of guy. In fact, he's not too computer literate at all, being an average user. He has no password on his user account (it takes too long to login that way), and has one on his administrator account that the tech who installed his operating system had the foresight to implement for him. Fred can't remember that password, nor does he even know it exists.
Joe Cracker lives down the street from Fred. He hates Fred, and lusts after Fred's hot redheaded wife, and knows Fred happily takes risque pictures of her with his digital camera. Fred thinks Joe's an alright guy who's a bit computer savvy, and goes to him with computer problems.
During the months Joe works off and on teaching Fred how to defrag and disk cleanup, he gets Fred's wireless dsl router information - enough to set up a VPN session with Fred's computer. The rest is academic: Joe vpn's to Fred's box while Fred's asleep. He uses Fred's user account (without password) to access the files therein, snatching many lusty pics of the redhead of his dreams in the process. Since Fred's account has administrator rights, he goes into the User Accounts and adjusts the Administrator password to one of his choosing. He then plants a trojan that will email him every picture Fred downloads to his computer from his digital camera automatically. Now it doesn't matter if he ever 'fixes' Fred's problems again, he gets free pics of Fred's wife, and has full remote-access to Fred's computer whenever he bloody well wishes. Joe can use it to steal from Fred, set up Fred to look like he's been involved in criminal activities, or set Fred up so his wife leaves him...
Pretty bad scenario, ya think? ANYTHING that offers you an option to use a password, please do, and use a strong one.
Your XP login password give access to that account on your local machine. This can be physically or remotely. It should be a strong password and greater than 14 characters.
Network passwords are somewhat different as they are usually protected by some sort of "three strike rule" that allows a certain number of attempts before breaking the connection for a period of time or deactivating the account. As you can imagine an 8 character password contains a vast number of combinations so a dictionary or brute force attack is not practicable given the limited number of permitted attempts and the actual time required to submit each password.
If, on the other hand you get rooted trojaned or backdoored then you have bigger problems than your password strength.:eek:
To create long passwords that you can remember either use a "pass phrase" or just "pack" your password with set characters, for example:
1234567890"mypassword"|ZXCVBNM<>?
There you have your password packed with all the numbers and the bottom row of the keyboard on upper shift.
:)
why bother to crack password, if somebody can add another password.
password protection policy now a days is not an effective line of defence even you have uncrackable password.. why i would bother if just add another one.
1. You cannot "add another password" you can only reset the password of an existing user.Quote:
Originally Posted by furigay
2. You can create a new user account.
Both of these require administrator rights and both of them are very obvious.
So, why would you want to crack the password of an existing user?.............. well the only reason I can see is to commit some sort of criminal activity........ it is identity theft.
What you want to do is impersonate an existing user, such that they do not know (their password remains the same, and still works), and that the administrator does not see a new user account.
Password protection is still very valid, as it provides an audit trail and makes users accountable ;)
Hi,
How do you do that ?Quote:
why bother to crack password, if somebody can add another password.
password protection policy now a days is not an effective line of defence even you have uncrackable password.. why i would bother if just add another one
May be you are talking about user rights escalation ?
Maybe I did not understand the post correctly, but I took it to be that someone with administrator rights can either change the existing password or create a new user?Quote:
Originally Posted by TejasV
Both of these would be almost instantly noticed?
Anyway, a password is not like a telegram, you do not have to pay per letter:D
Also, from a user viewpoint, a strong password can be good, as it means that it won't be your account that was used?
Thanks all and |3lack|ce for that example...
|3lack|ce, would the xp home/pro user have to have Remote Desktop, Terminal services, NetBios or any other services that opens a port running for someone to access the machine remotely like what you've described, say if Joe never had physical access to Freds machine to gather that information? Say I see no ports open when I do netstat, are there any hidden exploitable ports still open that simply don't/won't show up in netstat?
Also, |3lack|ce , could you further elaborate on those MS's backdoor accounts?
When I do net users command I only see Administrator, Guest, and a limited account I've set up.
To increase the strength of the login password, there are several things you can do.
1. Use randomly generated passwords. Do not use words or phrases. This will prevent dictionary attacks from succeeding.
2. Long passwords. Passwords over 14 character will invalidate an LM hash as an added value. Not to mention the fact that brute forcing takes an insane amount of time for a long password... or a massive rainbow table.
3. Special characters. Using certain characters from the unicode character set from 0128 to 0159. As with a password over 14 characters, this invalidates the LM hash and forces Windows to use an NT hash.
To see what accounts you have on your PC, try this... http://www.belarc.com/free_download.htmlQuote:
Originally Posted by screwd
Screwd, Dalek will help with his link on the 'ms backdoor' accounts -
On the other stuff, sorry, I don't give lessons - however there are several methods I'll describe in general:
Remote desktop, vpn (via sniffing/cracking), trojan (backorifice used to work wonderfully for this), social engineering, etc. A careful user can avoid these methods though by tightening his security and paying attention to who's asking what questions when. A more careful user will become educated into the areas of what port normally handles what functions on one's machine - I've seen boxes accessed through email listening ports, ftp listening ports, in addition to tcp/ip listening ports, all depending on what a malicious attacker would wish to accomplish.
As to why someone would want to do this, there's several things - I direct you to the 'what do hackers want' thread on this forum, and give you a few off the top of my head (In addition to those previously mentioned):
Because they can and you said they can't (a challenge).
Because they have a reason to mess with you (you pissed 'em off).
Because they want your machine for a zombie network (they need your resources).
Because they want your money, credit, etc (yep, there's that ID theft again previously mentioned in this thread).
Because they want to frame you for a crime (plant the unsavory illegal pron on the box, call the cops anonymously) (who knows? did you REALLY torque 'em off? Steal a girlfriend? Dump their sister?)
Not really sure what you're trying to accomplish here so I'm staying as non-technical as possible. If you're just an average user who wants to know his percentages of being hacked, well, they're bloody low if you're careful which sites you surf and where you download programs. If you've actively proclaimed you're better than someone, or your system is uncrackable, or even if you sneezed on the wrong person at just the wrong time, those odds increase dramatically, but still remain low if you're careful.
Did I stress be careful enough? I'll say it again. Be Careful and ya won't get hit. In fact they'll never notice you or consider you not worthy of their time and effort, or risk of incarceration if they're caught at it.
Now if you're worried about Spyware on your box, or all that spam you're getting...that's a whole different set of stripes on the zebra, and can be discussed in an entirely different post.