So how do we hold back the hordes when the barbarians are already past the gates? In this article I hope to point out some of the common security problems with campus environments and some of the solutions. Many problems may not be solvable because the solution would be counter to the mission of your organization, but with a watchful eye many troubles can be averted.

Local Security on Windows Boxes

It’s an old computer security axiom that if an attacker has physical access to a computer, then he has complete access to the software and data on that computer. It’s well known that all one has to do to get a blank local Administrator password on a Windows 2000 box is to delete the SAM file (on most Win2k systems: c:WINNTsystem32configSAM), a trivial thing to do on a FAT32 file system with a DOS boot disk. Think you’re safe because you use NTFS and/or XP? Think again. With a handy Linux boot disk an attacker can reset any local password, including the Administrator account. There is also Bart’s PE Builder that lets the user make a bootable CD with a cut down version of Windows XP that gives the user complete read/write access to NTFS drives. By using Sala’s Password Renew from a PE Builder boot CD attackers can change any local password they want, including Administrator, or add new admin level accounts altogether.


Now some reader may be thinking: “Those

are just the patron access machines - my staff workstations and file servers are still safe because they are behind locked doors.” Let me share my little horror story about network privilege escalation:

First local frat boy Steven becomes a local admin on a workstation using a boot disk. He then copies off the SAM and SYSTEM files for later cracking with Cain or L0phtcrack. Many folks use the same local admin passwords, allowing Steven to attack other boxes from across the network using the cracked credentials. He then installs a key catcher like WS Keylogger, or maybe something like Fake Gina on the box. Later on, one of the support staff with admin privileges to the file servers and most of the workstations on campus logs in to do some work and in the process has his user name and password saved for later retrieval by Steven. Now Steven has access to most of the boxes on the network.