Windows XP Login Hack

Hello,

I had a security breach on my Windows XP Professional system. Let me begin with what happened, my laptop was locked out but still logged in. My cousin inputted a some sort of key sequences and gained access to my desktop. He did not login with my password because he was not even in the password prompt. There is very serious backdoor for those who are using Windows XP's fast-switching login. I contacted Microsoft and as always they deny anything is wrong with thier products. Anyway, if any one knows this hack can you please teach it to me so that I may find a way to close this backdoor and hopefully seal it for good or at least figure out a workaround.

Thank You

All your cousin did was press control + alt + delete twice which brought up a username & password prompt. He simply entered' 'Administrator' in the username field, and left the password field blank and logged under the admin account built in windows. ;)

That **** is old school like Cypress hill.

Quote:

---

Originally Posted by Computernerd22

All your cousin did was press control + alt + delete twice which brought up a username & password prompt. He simply entered' 'Administrator' in the username field, and left the password field blank and logged under the admin account built in windows. ;)

That **** is old school like Cypress hill.

---

I too agree. I can't count the number of systems I was able to gain access to uasing this way!

I have always secured my systems with passwords and I have a always set admin passwords. I am aware that many oem manufacturers leave the admin password blank. I installed this OS myself and have set passwords to all accounts including the master admin's password. Yes, am also aware of the ctrl + alt + del flaw. Assure me he did not do that. He learned of a backdoor from a former Microsoft sofware developer. There is a flaw in the login screen, but he refuses to tell me. He said he promised him he would keep this secret and at this point in his life he decided that he will start keeping his promises. Whatever, I only want to seal a very annoying flaw in Windows. And with God's help someone may know what I am talking about.

Ok

so is this XP home or Pro??

and is it installed on an NTFS partition??

and other partitions??

Ya think he could of guessed your password per chance.....or had access to your computer prior to this crack...or access to a computer you have used before???

Do you use the same password for multiple accounts??

how many characters??

I am curious...what is the "Master Administrator" account??

Is that like the Local Administrator account...or a user with Admin priviledges???

AFAIK...when installing XP home...it doesnt ask you for an Administrator password during setup...and unless you go in after install and reset......its blank.

MLF

Hmmmmm,

Quote:

---

Yes, am also aware of the ctrl + alt + del flaw. Assure me he did not do that. He learned of a backdoor from a former Microsoft sofware developer. There is a flaw in the login screen, but he refuses to tell me. He said he promised him he would keep this secret and at this point in his life he decided that he will start keeping his promises.

---

And the MOON is made of green cheese, and the tooth fairy is hooking up with Santa Claus..............

Do you seriously expect us to believe that this is a "secret" that only the guy pulling your chain knows?

Why should this "former Microsoft sofware developer" only tell him?........

I will tell you what, just ring Bill Gates and co. and see what they have to say...........

And whilst you are at it, you might as well format and install Linux:rolleyes:

Quote:

---

I have always secured my systems with passwords and I have a always set admin passwords. I am aware that many oem manufacturers leave the admin password blank. I installed this OS myself and have set passwords to all accounts including the master admin's password

---

What do you mean by *master admin's password*? As far as I remember Windows XP Pro has 5 built in accounts.

1.admin
2.guest
3.user (you)
4.helpassistant
5.support_xxxxxxxxx

I'm assuming you mean #1 or #3?

Quote:

---

Assure me he did not do that. He learned of a backdoor from a former Microsoft sofware developer. There is a flaw in the login screen, but he refuses to tell me. He said he promised him he would keep this secret and at this point in his life he decided that he will start keeping his promises

---

Your cuz refuses to tell you? Hmm, you two got beef? I know me and my cuz were kool as ****. Meaning, were tight like that. If I knew of such a flaw in the login screen or he did, I know he would inform me and I would inform him of it and vice versa. Cuz = family ;)


What a coincidence don't you think? Know he wants to start keeping his promises, and be on the straight an arrow? Hmm, Doesnt make sense and when something doesnt make sense it usually means its not true.


Seriously, as we all get more involved in the story the more it looks and sounds like total Bullshit. Just my two cents.


PS if their is a flaw in the XP login screen and it comes out in the future besides the one I posted above, I will be the first to apologize to you. Until then I don't buy your story.

Cheers, CN22

Quote:

---

And the MOON is made of green cheese, and the tooth fairy is hooking up with Santa Claus..............

---

REALLY!!!!!!

I never knew :eek:

;)

MLF

Actually, I don't think there is any mystery here at all, it is just the way "fast user switching" works?

The account is already open and has had valid user and password information supplied.

When you switch users and then go back you reopen the original session as the original user.

The whole feature assumes a trusted environment that is physically secure. If you haven't got a trusted environment and don't need the feature, just switch it off.

I can see some confusion arising where you are using a password protected screensaver, but remember that is only the screensaver, the underlying session is still active;)

I believe Nihil is hit the nail on the head. Fast user switching is pretty much a bell and whistle feature anyway. hmm seems I need to spread my antipoints around...

Yes, it does assume trust. I believe that there are third party applications that will improve the security by ensuring that the original session remains locked, and requires a user password to reactivate access.

In response to AObaba's request for a "workaround":

I suspect that the hotkey that will bring up the user switching uses the "Windows Key". You can disable this in the Registry if you want:

http://www.intelliadmin.com/blog/200...s-hotkeys.html

Another approach would be to select your own hotkey sequence rather than the default ;)

I do not accept that this is a "security breach", as it is how fast user switching is supposed to work. I have no use for FUS so I have it turned off.

I can't remember but I think that it is "on" by default? I also seem to recall that the default hotkey might be WinKey + S.

It could be a security issue, however, if your machine is used by other persons whilst unattended. But, I would consider this to be a user created problem, just as if you left your workstation logged on and unattended. The obvious solution is to logout.

I would also point out that fast user switching is supported by Mac OSX and some of the latest Linux distros, but I do not know if they behave the same as Windows.

Yes by master admin I do mean the default admin. I know this story seems out of it and I to would not believe it if it hadn't happenned to me.

My purpose of this post was not to listen to others ridicule me. If someone has any knowledge of this then please enlighen the rest of us.

I got this website from a post that I found regarding a very similar incident. I tried to dig up the original post but it was old and removed. I was hoping that my post may refresh someones memory.

Please if you have any knowledge on this subject share or please keep your comments to yourselves. I respect websites like this where people share thier knowledge and help others in thier computer related problems. There is enough crap in this world, don't let it spread here :cool:.

If you bother to read my last two posts you will see a full explanation.

FUS is working entirely as intended and designed. If you don't believe me, just Google for "Fast User Switching" and read the Microsoft knowledgebase articles about it, particularly the one about its architecture.

It is intended to allow two people to share a single computer without the need for one of them to log off. Obviously this means that the user of the second session can restore the first session with all the rights of that user. This is because it was legitimately opened and hasn't been closed.

There is no rocket science, no hidden agenda, no conspiracy theory.................. that is how FUS works, period.

The feature is designed to make things easier for people in a home environment who need to be able to share a computer at short notice. If you do not believe this, please explain to me why you cannot run FUS on an XP pro box that is part of a Windows 2000 Server domain???????????

The very concept of FUS in a corporate network is a security breach. You might as well have the box running Windows 98SE.

In your case, this breach is compounded by the fact that you seem to log on with the default administrator account :eek: If you are going to use FUS, you should never leave an account with administrator rights open. In fact the general, collective wisdom is that you should ONLY log in as administrator when you absolutely need to; and then log off as soon as you are done.

[ Please check out the "run as" functionality if this is a problem]

As for "ridicule"............. you ought to know by now that to go to an internet forum requires you to have a pachydermal personality.

Also "crying wolf" is likely to get you a less than sympathetic reaction.

Your cousin spun you a bullshit yarn, and you bought it....... I found that rather amusing......... he pulled your chain and you fell for it :D

Just look at it realistically? if you are a professional developer you don't leave systems with gaping security holes in them; and if you did, you sure as hell wouldn't mouth off about it. Unless, of course, you had ambitions of flipping burgers or throwing trash for the rest of your life.

Quote:

---

In your case, this breach is compounded by the fact that *you* seem to log on with the default administrator account :eek: If you are going to use FUS, you should never leave an account with administrator rights open. In fact the general, collective wisdom is that you should ONLY log in as administrator when you absolutely need to; and then log off as soon as you are done.

---

Exactly. ;)

By default, the name Administrator is given to the account with full control over the computer.

To increase security, start by renaming the Administrator account and then creating an account named Administrator without any permissions. That way, even if your cousin is able to log on as Administrator, he won't be able to access any system resources.

Quote:

---

Your cousin spun you a bullshit yarn, and you bought it....... I found that rather amusing......... he pulled your chain and you fell for it

---

He fell for it hook, line and sinker! I bet your cousin was laughing his ass off at you. ;) I know I was. ;)

Cheers, CN22

http://seclists.org/vuln-dev/2001/Dec/0239.html

*Near the bottom of the page, the person talks about a fake logon screen}

This one {trojan} was usable not long after XP came out, but i'm pretty sure that sp2 had a patch that fixed that one. so me thinks you need to updatez ur box ya'h?
ohh and tell your cousin he's dreaming.. :D :eek: :drink:

CN22, I take the point, and whilst you are at it, I would also recommend disabling the "Guest" account that is a default in XP. Do not delete it, but allow it to be found as useless? If you need one, create another of your own and call it something different.

The danger there is that the account seems reassuringly incompetent, but is a known access portal, and could be used in conjunction with an escalation of privileges exploit?

To return to the original theme of the thread: It seems to be rather a matter of understanding your own personal "security model" and tailoring your system to comply with this?

For example, this is a stand alone box that my wife sometimes uses. She has another box with software more suited to herself that we also both use. We use a common logon because this is what I would call a "trusted environment" that is physically secure. I have turned off all services that are not required such as file sharing, networking and printer sharing, although we do share a printer by means of a simple physical switching box.

The fundamental principles as I see them are:

1. If you don't use a service, disable it.
2. If you don't use an application ALL the time don't let it load at startup.

This seems to make good sense to me from a security angle because it minimises the targets for exploit. Also, if you are running a service that you do not need or use, you are unlikely to understand how it works, or to keep an eye on security issues relating to it.

From another angle, the less you have running, the fewer resources you are using, so your system should run better? Speed, contention, conflicts and so on?

With specific reference to "Fast User Switching" (FUS):

This is a utility to allow several people to use the same desktop hardware at the same time; whilst retaining their own personal identities and settings, and their current logged in session.

In effect, it is an attempt to make NT systems work somewhat like the old "home user" OSes Microsoft sold.

It should be noted that it is intended for a trusted environment, and is fundamentally insecure. This insecurity would be exacerbated if one of the logged on accounts had administrator rights.

In any eventuality, one is able to traverse through the logged in sessions and restart them as if you were the user who originally started the session.

This is by design, it is not a weakness, unless you allow it to become one.

If you REALLY DO have a need for this Windows facility, I would strongly recommend that you look at third party solutions that permit retaining ongoing sessions whilst requiring original user login credentials to reactivate the session. ;)

Otherwise, you should logout of any session that has enhanced privileges.

If you want an audit trail, then you can get physical token systems from third parties.

Yes, and it also improves performance by not allowing valuable ram to be wasted on services/programs that aren't being used.

Hi JPnyc, to avoid taking this thread too far off its tracks, I have started a new thread here:

http://antionline.com/showthread.php?t=275359

I think that it is an interesting enough side topic to discuss how people handle the security requirements of multiple users needing differentially authorised access to a shared hardware resource.

We obviously agree that performance issues run side by side with security here................. in fact I find it a big grey (gray:D) area when systems instability gets involved. I am thinking of the potential security implications of destabilising a system?

:)

I agree with all senior members here. After reading all the posts till, now, I am speechless. Of course I too think that this is one of those several lies which many users (even experienced ones) start believing in that it is true! Now there is something called as 'over the shoulder hack' where a person can look up the keys pressed by a user while he was entering the password.

If AOBaba is not sure about if it has never happened to him, I think this is what would have happened.

Another small point which I think you could ask to your cousin: "Which portion of Windows did his 'former Microsoft developer' work upon?"

I think if your cousin takes too much time to answer that question, in most probabilities, he may be lying. I do not have anything more to say as all of what I could think has already been discussed.

Of course if your computer is really patched with all latest updates, it is very unusual that such a hack exists. Even if it would have exitsed, it must not have gone unseen in the 6 year lifetime of windows by any hacker, developer all over the world!

Vulnerability in IBM Windows XP default hidden Administrator account allows local Administrator access
http://www.secnap.com/alerts.php?pg=5

Windows Vista vulnerable to Sticky Keys exploit
http://www.avertlabs.com/research/blog/?p=218

Plug an iPod or USB stick into a PC running Windows and the device can literally take over the machine and search for confidential documents, copy them back to the iPod or USB's internal storage, and hide them as "deleted" files. Alternatively, the device can simply plant spyware, or even compromise the operating system. Two features that make this possible are the Windows AutoRun facility and the ability of peripherals to use something called direct memory access (DMA). The first attack vector you can and should plug; the second vector is the result of a design flaw that's likely to be with us for many years to come.

http://www.schneier.com/blog/archive...g_compute.html

Ehhmmm... USB doesn't use DMA. Firewire does..

Autorun doesn't work when the machine is locked.

WEll, I think faust's reply is completely out of topic.

The most vulnerable thing with any computer is the person sitting in front of it.

I can't see how not putting a password on the Administrator account can be seen as a vulnerability.

It comes down to user error in my eyes......if you don't put a password on an account then what is to stop someone logging on with it? Nothing.

I can understand MS not shipping it with a password - as it would have to be the same default password on every installation, which is tantamount to not having a password in the first place.

If they used different password, then not only would it be an administrative nightmare, they would also have some pissed off dumb users who couldn't work out what the password is.

Agreed they should force a user to initially set a password in XP home (XP Pro does prompt for one) but residential users don't like being forced to do anything and MS is at the end of a day a business like any other and needs to keep their home user customer base happy.

I think that faust's underlying concept is that if you don't have physical security then you can be owned?

Quote:

---

I can understand MS not shipping it with a password - as it would have to be the same default password on every installation, which is tantamount to not having a password in the first place.

---

That is very true, but I do agree that home editions should at least prompt for a password and let the user decide.

Quote:

---

Agreed they should force a user to initially set a password in XP home (XP Pro does prompt for one) but residential users don't like being forced to do anything and MS is at the end of a day a business like any other and needs to keep their home user customer base happy.

---

Yes, the approach is consistent with earlier domestic versions of Windows, but domestic computers are now at much more of a risk than they were back then.