Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there a way to secure Windows 8 against this login bypass? Basically an administrator can rename the utilman.exe (for example, to utilman.exe.bak) then copy cmd.exe to be utilman.exe, then at the login prompt someone can just do WinKey+U and get a fully working cmd prompt with Administrator privileges. How can this be stopped? Perhaps some way to change permissions so that utilman.exe cannot be renamed or modified etc?

share|improve this question
1  
I think this should be addressed by mighty MS as an exploit, maybe they should check that file at launch for integrity, correct signature or checksum, whatever. –  Kitet Jan 26 '13 at 23:25
7  
It doesn't matter. If someone got onto your computer and had the rights to rename utilman.exe, you have already lost the battle for security. –  Mark Allen Jan 27 '13 at 1:15
    
Mark said it already: someone has already compromised your computer. Why bother after that? Your question has no practical value. –  Jan Doggen Jan 27 '13 at 20:43
    
@Jan Doggen Yes I take your point. What is the point of the Windows login system at all then if they give you access to an Administrative rights shell at startup by pressing a hotkey? At least things like boot from CD-ROM can normally be disabled to stop user accessing CMD that way, but in Win 8 as far as I can tell you can't get rid of F11 recovery console. –  fpghost Jan 28 '13 at 19:48
3  
I'd say this isn't so much an exploit as it is simply mucking with Windows after having gained access. An exploit would grant a restricted user full rights to a machine. You can't perform this "exploit" without Administrator rights in the first place. It's a fun trick, but that's all it is. –  Ben Richards Feb 7 '13 at 21:51

4 Answers 4

up vote 2 down vote accepted

BIOS and hard drive boot passwords, and encryption (or more likely a combination of them).

Check out this other SU question: BIOS Hard Drive Password Security?

It has lots of good answers explaining the differences and advantages.

Also check into full disk encryption.

Encryption is probably the only way you're going to prevent someone from fiddling with the bits if they can get their hands on the drive.

share|improve this answer

Think simple.






                     Remove the U key from the keyboard and weld the wire in place.
                     -- that's going to throw off even the most presistent of hackers







Should anyone choose to complain, persuade them by informing them of their ignorance. They should know you acted out of virtue to protect their privacy. Provide an additional numpad configured to substitute zero with u for the really difficult users. In the end, they will thank you!

share|improve this answer

There is no way that you can keep utilman from being renamed. Even if there are permissions on it that prevent Windows from renaming it, you could rename it by booting from a Linux live CD.

You could set a password in the BIOS and then set it to ask you for that password every time you start your computer. BUT that password can most likely be reset by removing the CMOS battery.

share|improve this answer
1  
OK, I guess that can be perhaps combated by stopping user from modifying boot order by password protecting BIOS (assuming user won't reset it via opening up the computer). Any other way to stop this utilman security hole then? the current way I've been accessing it is via F11 recovery console allowing access to command promt on boot up, so if I can stop it being renamed from there that will probably be enough. –  fpghost Jan 26 '13 at 19:12
    
Updated my answer... –  ChrisN Jan 26 '13 at 19:20
    
Also i see there's more tools to reset passwords by booting from CD or USB. Install whole drive encryption then. –  Kitet Jan 26 '13 at 23:42
    
You can't rename or replace utilman.exe from a linux live disk without the bitlocker password if bitlocker is enabled. –  SecurityMatt Jan 30 '13 at 4:06

Just attach an invalid debugger to it so it does not execute

something like : cmd ( with admin privileges )

REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\explorer.exe"

of course you don't actually need to replace the utilman.exe if you are an admin, you can just use

REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe"

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.