by Jon Brodkin at Ars Technica.
I think a lot about cloud computing and I'm ready to go (pretty much) all in. Actually, I'm already there to a large degree. However, when I think of possibly needing to run Windows (I don't expect to), I usually think of needing to get some VM software, a Windows license, and software to boot up at least a virtual Windows machine.
It hadn't occurred to me, really, that a service could provide Windows machines on demand. You could have a fully running, personal, persistent desktop, or an ephemeral Windows machine on-demand, or even just a virtual app that runs, popping up a virtual Windows VM underneath it, again on-demand.
Showing posts with label windows. Show all posts
Showing posts with label windows. Show all posts
Wednesday, October 26, 2011
Saturday, October 30, 2010
Web Site Easily Cracks Windows 14-Char Passwords from Hash
CIO Zone has an article by Dan Dieterle has written about a web site put up at Objectif Securite which can crack a 14-character Windows password from an input hash in only a handful of seconds. Their secret sauce is using fast solid state drives (SSD) to make cracking very fast.
If you are a Windows user then it may help to know, before you completely panic, that using this technique requires getting the stored hash of a password. This means they've already broken into your computer, and have access to everything, before this could be used.
A common technique on computer systems is to take a password, use a hashing function to turn it into a long, random-looking string, and store that string on the computer. Then, to verify a password when you type it in, the hash function is applied to what you type in, a long string is generated and it's compared to the stored string. If they match, then the assumption is that the passwords match and you're authenticated.
Another assumption is that the hashing function is essentially one-way, i.e., you can't take the hashed string and immediately turn it back into a password. The above web site uses a brute-force type of attack to make this possible and break that assumption.
So, again, to use this to get your password, an attacker would have to have already compromised your system to dig out the hash string. For a single computer this isn't that big a threat.
What is the threat then? Well, at a site, say a corporate office, by compromising a single, poorly protected system, say some person's desktop, an attacker could get the hashes and then use this technique to get the password of an important user, even the site or system administrator. They would then gain immediate access to other more important systems, the entire corporate infrastructure, and important corporate data. The intruder could potentially live and operate, well-hidden, in such a compromised system for weeks or months.
Etc.
It doesn't seem that long ago that we considered eight-character passwords to be secure. I used 14-char for a while simply because that was the maximum limit Windows allowed. Now I use longer passwords (and no, I'm not saying how long), for non-Windows systems and web sites.
Pretty soon, you're going to start seeing other “factors” used to authenticate to a system. In other words, you'll no longer just type in a password, you'll have to do something else, say answer a question. Or authentication may involve something else you have with you, like a key of some sort. Some well-designed financial sites already use such techniques now.
If you are a Windows user then it may help to know, before you completely panic, that using this technique requires getting the stored hash of a password. This means they've already broken into your computer, and have access to everything, before this could be used.
A common technique on computer systems is to take a password, use a hashing function to turn it into a long, random-looking string, and store that string on the computer. Then, to verify a password when you type it in, the hash function is applied to what you type in, a long string is generated and it's compared to the stored string. If they match, then the assumption is that the passwords match and you're authenticated.
Another assumption is that the hashing function is essentially one-way, i.e., you can't take the hashed string and immediately turn it back into a password. The above web site uses a brute-force type of attack to make this possible and break that assumption.
So, again, to use this to get your password, an attacker would have to have already compromised your system to dig out the hash string. For a single computer this isn't that big a threat.
What is the threat then? Well, at a site, say a corporate office, by compromising a single, poorly protected system, say some person's desktop, an attacker could get the hashes and then use this technique to get the password of an important user, even the site or system administrator. They would then gain immediate access to other more important systems, the entire corporate infrastructure, and important corporate data. The intruder could potentially live and operate, well-hidden, in such a compromised system for weeks or months.
Etc.
It doesn't seem that long ago that we considered eight-character passwords to be secure. I used 14-char for a while simply because that was the maximum limit Windows allowed. Now I use longer passwords (and no, I'm not saying how long), for non-Windows systems and web sites.
Pretty soon, you're going to start seeing other “factors” used to authenticate to a system. In other words, you'll no longer just type in a password, you'll have to do something else, say answer a question. Or authentication may involve something else you have with you, like a key of some sort. Some well-designed financial sites already use such techniques now.
Sunday, August 08, 2010
The Windows Shortcut Vulnerability
Be sure to update Windows XP to SP3. If you haven't ever done this, now is the time. The Windows shortcut vulnerability gives malware a wide open door to attack Windows systems.
Microsoft Security Advisory (2286198)
Trend Micro
Microsoft Security Advisory (2286198)
Trend Micro
Tuesday, November 24, 2009
Avast! You Virus!
A family member called with some version of a Vundo trojan last night. I remembered a recent conversation with John Auty where he was talking about how excellent Avast was at handling that type of malware, especially with it's pre-boot checking. (It reminds me of Dr. Solomon from the old days, and the Magic Bullet!). I thumbed back through his blog posts and found where John wrote about Avast (Part 1 and Part 2).
Avast installed with no trouble (the malware was preventing AVG from installing) and, on reboot, it fixed the problem!
I've been using AVG for a while but I may have to give Avast a spin the next time I re-install or install Windows.
The home version is free. Recommended!
Avast installed with no trouble (the malware was preventing AVG from installing) and, on reboot, it fixed the problem!
I've been using AVG for a while but I may have to give Avast a spin the next time I re-install or install Windows.
The home version is free. Recommended!
Wednesday, May 06, 2009
MFT Records in Windows NTFS
While scanning a hard drive (which contains a damaged NTFS) I'm seeing the errors “Unexpected MFT record” and I wondered what that was.
The MFT is the master file table in NTFS which is described in the web page Master File Table is being like a relational database with an entry for each file (and directory).
This page and the accompanying ones seem to be an excellent resource.
Subscribe to:
Posts (Atom)