1

SYNOPSIS:

Well, as almost every one knows, the first line of defense against unauthorized access to a windows computer is the windows account password. But as many of you might know, breaching it is a breeze using bootable programs. So to protect against this kinda threat, we can prevent boot option changing using the bios password. But that can be bypassed too( BIOS hash. shshshshsh :D that's my last line of defense, I hope not too many people know about it).

The QUESTIONS:

  1. Any ideas how to prevent unauthorized access, considering the failure of the above methods?
  2. Can the password of Linux be removed, just as a windows' password could be removed using similar bootable tools?

P.S. I'm currently using TrueCrypt for my sensitive data. So I'm looking for a way to prevent any kind of access.

2
  • 1
    If you have the root password you can change the password of any user. If you are using TrueCrypt then they cannot use any known method to change the your user account's password within Windows.
    – Ramhound
    Dec 18, 2013 at 12:00
  • Unfortunately I'm only using truecrypt to encrypt an arbitrary partition and not the OS partition. So it seems that I need to be encrypting the OS partition. Thanks for the comment :)
    – Milad.N
    Dec 18, 2013 at 13:06

3 Answers 3

2

Any ideas how to prevent unauthorized access, considering the failure of the above methods?

The first thing you need to do is to prevent unauthorized physical access. Generally speaking, all bets are off against any attacker who has gained physical access to a computer. You can make attacks more complicated for such an attacker, but you essentially cannot prevent them.

Take your examples. A Windows password? Easily bypassed with the correct tools, booted off secondary media, particularly if you're only interested in getting a copy of the data. BIOS password? Pfft, remove the CMOS battery for a short while or set the CMOS memory clear jumper; the specifics will depend on the motherboard, but the technique is well known. Or connect the hard disk to an alternative system and clone it to analyze the contents later. Full-disk encryption? A hardware keylogger will give an attacker access to the password, after which decryption is trivial. Some systems offer diagnostic ports such as JTAG, which can be used to monitor the system while it is running even if it doesn't have dedicated remote-management hardware (which many servers do); will you detect something installed and surreptiously connected to such a port? And on it goes.

There's a reason why server rooms for almost anything that matters at all are behind physical access controls, including heavy doors, reinforced walls, alarm and entry-access systems, and so on. And it isn't only about the monetary value of the hardware.

Once the computer is physically secured, the easiest way is often to install and use full disk encryption with a strong password or passphrase. It should be full disk because otherwise you're basically putting up a big sign post saying "the privacy of this stuff is important enough for me to protect with encryption", and you also run the risk of data remnants showing up in deleted locations on disk, swap space and temporary files that might not even get cleaned up properly after an improper shutdown.

In addition, all "normal" computer hygiene practices still apply: make sure to keep the OS up to date with regards to patches, have proper antivirus (and anti-other-malware) software installed and running, use a firewall, be careful what software you install, run software with minimal privileges, and so on.

Note that the above is essentially equally valid regardless of operating system. Some of the things may be done slightly differently depending on what OS you are using, but the principle of what needs to be done remains essentially the same.

Can the password of Linux be removed, just as a windows' password could be removed using similar bootable tools?

Of course. As long as you aren't protecting against physical access and using on-disk encryption, or using it in a manner that can easily be circumvented, it's a simple matter of mounting the file system with software that understands the on-disk format and allows you to manipulate the relevant files.

2

You need to encrypt your drives. Even best protected BIOS is nothing as you can clone drive in no time now using simple devices.

I can suggested TrueCrypt

But keep in mind: is truecrypt audited yet ? Of course as you are using XP (or in fact any Windows) this is NOT your worry anyway as you have bigger problems.

3
  • So I guess the only way would be to encrypt the OS partitions. Right? Right now I don't how that would work with the bootloader( since the partition is encrypted ). So I guess I need to get to work and do some research. Thanks a lot Chris :)
    – Milad.N
    Dec 18, 2013 at 13:07
  • By the way, doesn't the fact that TrueCrypt uses legit and powerful encryption algorithms count for something? The whole audition for TC is really great, but I guess for me, right now it's pretty good. It's not like I'm trying to fend off NSA attacks :D
    – Milad.N
    Dec 18, 2013 at 13:17
  • 1
    You need to separate the bootloader from the main OS, so you have 2 partitions and then you encrypt the OS partition.
    – EliadTech
    Dec 18, 2013 at 13:42
1

I use True Crypt on my work laptop, and it's very, very easy to have it encrypt the entire drive. When the BIOS goes to boot from the hard drive, it prompts you with the True Crypt bootloader, which prompts you for your password, and then it hands it off to the Windows bootloader. I noticed a very small hit in performance, but that's an easy sacrifice for how easy it was to setup and how well it works.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .