Technological security solutions won't protect you from local attacks a local attack occurs when the
attacker had physical access to a given element of the network.
You can protect your network against this type of attack by restricting physical access to computers
to achieve that.
You can employ specialized firms set up cameras or lock the server room door.
We will now do an exercise that will show how serious a local attack can be.
The exercise is as follows.
There are two computers on which a system other than the default one has been booted.
The first one was run with a Microsoft tool.
It's called Dirt and it's part of the Microsoft diagnostics and recovery tool set this tool allows you
to change user's passwords offline.
That is without booting the primary operating system in the case of the other computer.
One of the functionality is of the offline entry password and registry editor was used.
It's a widely available free program which allows you to delete a local user's password.
In both cases a person who gets physical access to the computers will gain administrator privilege.
It takes as much time as turning on the computer turning it off and turning it on again.
Let's try that for ourselves.
We'll start with an attack on Windows 7.
A word of explanation put the CD into the drive the computer's booting from CD and not from the hard
drive.
Right now the darte is being loaded and it will start up in a minute.
The passwords of Windows local users are stored in the same file.
This is a security account manager file with the password in the file are encrypted.
It's called multiple encryption despite such protection using darte.
You can modify the file and using enty password and registry editor you can delete it.
Encryption doesn't protect against the modification or deletion of information.
It only protects its confidentiality
dirt tools can only be obtained by Microsoft Partner Program members.
The software isn't publicly available but it's often needed it comes in handy when a user forgets her
password or when a system is attacked by a virus that can be deleted
in the first case you can change the password of a local user who doesn't have a domain name in any
given company.
In the second case you can start the computer with dart and then start an anti virus scan or anti rootkit
tool.
In this environment
this is much more effective than starting the already infected system once again.
We want initialized network connectivity.
We would like to remap the drivers
reaches the American keyboard layout.
Now Dart is gathering the information on the operating system installed on the computer
shortly Windows 7 should be recognized as the operating system
as you can see.
It looks like a standard recovery tool window that you would use to create a startup disk in every version
of Windows.
We will choose an additional option.
Microsoft diagnostics and recovery tool set.
You can see a graphic interface presenting a set of tools one of the tools called locksmith allows you
to reset a local account restart locksmith
which was the account password we like to change.
For example the Administrator account
Microsoft diagnostics and recovery tools wouldn't allow us to not set a new password
now will choose a password that you normally wouldn't use because it's too easy to guess.
The new password is pass.
Then you click next and the whole procedure is over.
You can change every user's password in this way.
Next you shut down the program remove the CD and start the computer again.
Now the operating system will boot normally.
The string of letters we've typed will now be the administrator password
after the system is booted.
We can log in to the Administrator account typing pass into the password box
Microsoft is concerned about security.
So Windows require us to change the current password after the first startup.
When the password is changed we'll be able to log in having full administrator privilege.