0

I've come across this tool "Hiren" , and it allows me to enable the builtin Administrator, as well as change passwords of local users just by booting up the USB stick with its ISO. I couldn't find any explanation on why or how this works. Isn't this a gaping security hole for Windows? Apparently this is super easy and you don't even need a third party tool to achieve this. So, could anyone explain to me how exactly that process works, and if there is any protection against this (maybe encryption / Bitlocker? ).

EDIT: I don't mean, how do I use Hiren, but rather how does Hiren work. I want to understand the technology behind it, so to speak.

Improve this question
3

1 Answer 1

Reset to default
1

I couldn't find any explanation on why or how this works.

The OS has a file which contains a list of all user accounts, together with their password hashes. Editing the file to change the password hash to some known value (e.g. the hash of nothing) will result in the OS expecting that new password.

In Windows, that file is SAM (part of the Registry). Linux has /etc/passwd and /etc/shadow.

Isn't this a gaping security hole for Windows?

No, it is generally not considered a security hole in any OS. The account system is meant to do its job while the OS is running – if it's not running, then its rules no longer apply; you could as well use Hiren to copy all the files out (bypassing the ACLs aka "file permissions" that the main OS would enforce), or to swap one .exe with another (making Minesweeper.exe steal all your files). Really, instead of booting Hiren, you could just take the system disk out, connect it to another computer via USB, and do the same thing.

In other words, if the attacker has physical access to the device (or just its system disk), then it's usually considered that the attacker gaining physical access was the real security hole.

Of course, with laptops and other mobile devices, security access is much easier to get, and the most commonly accepted solution is device encryption – having the entire system disk encrypted, e.g. through Windows BitLocker, would prevent someone from accessing any of the files inside. (Most modern CPUs have acceleration for encryption, so it doesn't make the system slower at all.)

(Disk encryption should be combined with Secure Boot to prevent e.g. tampering with the passphrase prompt, although realistically for most people it's more towards "may/should" than "absolute must".)

Though do keep in mind that the login password is also directly used to encrypt certain user-specific data. Resetting the password in this way (or really, in any other way, including if you had used legitimate Administrator powers to do so) will cause that user's EFS-encrypted files, or DPAPI-protected data like browser passwords (in some browsers), to become forever inaccessible. So if you're unable to use BitLocker, then EFS may help just a little bit.

Apparently this is super easy and you don't even need a third party tool to achieve this.

Hiren is a third-party tool.

Improve this answer
3
  • Thanks so much for that detailed answer! So, those password-encrypted user files are only being re-encrypted by the "legitimate" Windows password change process, but not with Hiren because Hiren (or any equivalent method) only changes this one hash entry, and nothing else. Would I gain access to those "lost" files again by changing the password to what it's previous value was? Since Windows doesn't salt passwords, it should result in the same hash
    – Washbear
    Dec 7, 2021 at 12:15
  • The NTLM hash is irrelevant – it is not used as input for deriving encryption keys (after all, the hash is as easy to read from the SAM file as it is to overwrite). Instead the key is derived from the whole original password. Second, that key isn't used to decrypt files directly, but only the "DPAPI master key" (which then decrypts EFS certificate keypairs, and those decrypt files), and from what I know, if the DPAPI master key is found to be un-decryptable due to password mismatch, it'll get thrown away – making the stored private keys (EFS and others) impossible to regain access to.
    – u1686_grawity
    Dec 7, 2021 at 12:26
  • That being said, you can back up the EFS keypair specifically to a .pfx file through Certmgr.msc (recent Windows versions actually keep prompting you to make a backup of the EFS key as soon as you begin using EFS), then import the .pfx file anytime later (even on a different PC) and you'll become able to access the previously encrypted files. (Just make sure you export the private key and get a .pfx file, not a .crt file...)
    – u1686_grawity
    Dec 7, 2021 at 12:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .