Huge securtity hole in offline files

[zag]

So I implemented off-line files last summer for our admin staff as an extra level of backup on their workstations to hold a local copy of files.

 

Today a student came to see me to explain he had found a way to access any of the admin staffs files simply by unplugging the network connection and clicking on the offline files icon and then view files. To my shock he proceeded to open up the documents of one of our senior admin managers and the permissions seemed to allow this for even his locked down account. There were no problems opening any of the files.

 

So my question is did I just set this up wrong? or is it an inherent problem with synchronising files to a local computer.

Edited February 7, 2008 by zag

[cookie_monster]

Offline files is really a notebook technology for use where users have their own notebook. I wouldn't cache any important documentation on a shared workstation as the files are placed in that folder.

 

Unpluging the network cable can get around policies i'm sure it has been discussed on this forum before and a few solutions were suggested have a search and see what you find.

 

You can use EFS to help secure the data but i still wouldn't use it on shared PC's.

 

http://www.microsoft.com/windowsxp/using/security/expert/encryptoffline.mspx

Edited February 6, 2008 by cookie_monster

[cookie_monster]

Having said that the document says that only admins should be able to view other users docs are your users admins on the local station?

[kxv2020]

I would use Volume Shadow Copy instead from the description that you describe.

[FN-GM]

Why have the kids got access to the admin machines?

 

Z

[Heebeejeebee]

Why have the kids got access to the admin machines?

 

Z

 

My thought exactly.

 

Offline files is a real PITA - even for laptops. VSC is the better option but it won't give access to (old versions of ) files if they're disconnected from the network.

 

HBJB

[FN-GM]

We don't use offline files a bit of a pain in the arse if you ask me.

 

Although they do seem to have improved in Windows Vista.

 

Z

[sahmeepee]

Importantly, setting up EFS to protect offline files doesn't work if you deploy it via GPO - you must apply it manually, at least in XP. From the article linked above:

 

"One limitation of the encrypted offline files database is that files and folders will not be shown as an alternate color to the user when working offline."

 

^^ that is highly misleading and I'm sure would give many people a false sense of security. Whilst testing it I went to the length of using a disk editor to manually check that the data written to the sectors was indeed NOT encrypted when the policy was applied via GPO. It did do a good job of disabling the GUI to make you think it had applied properly though.

[zag]

Why have the kids got access to the admin machines?

 

Z

 

They don't, a member of the admin staff logged onto a computer in a shared room about a year ago, the files have stayed in the off-line folder ever since.

 

Also the student has a totally locked down account, as soon as they disconnected it from the network they gained the ability to read the offline files whatever permissions are set on them, that's why this is so worrying.

[psydii]

Anyone got a spare suppport call to microsoft they're willing to use on this... I'd be interested in what MS say.

 

 

Also this does directly contradict my personal experience... What are the permisions on the network copy of the FILEs?

[Jona]

Are you not just seeing a side effect of this issue??

http://www.edugeek.net/forums/showthread.php?t=7509&highlight=unplugging+network+cable

http://www.edugeek.net/forums/showthread.php?t=5232

 

Cheers

Jona

[psydii]

Hotfix and adm update for encrypted offiline files.

http://support.microsoft.com/kb/810859

 

Security Permissions are not maintained on the CSC

http://support.microsoft.com/kb/271830/

[monty]

We use offline files for all our staff and apart from the occasional hiccup we don't experience many problems at all. It can be difficult to explain to the teaching staff that if they try to synchronise a large folder that it will take time.

I've never had a user be able to access others offline files, the permissions stay the same as if they were still on the domain as the computer should cache the user credentials.

Perhaps if it happened a year ago, the permissions were different at that time? you should still be able to check the permissions applied to the files in the offline folder.

You can use group policy to control the local settings so that if the domain is not available or the computer is now standalone that there are still restrictions in force. Mine are set so that no one except admin can logon if the domain is not available.

Check the settings in - computer conf>windows>security>local policies>

[zag]

Security Permissions are not maintained on the CSC

http://support.microsoft.com/kb/271830/

 

Thanks!!!! that was it, The laptops are fat32.

 

Because the FAT and FAT32 file systems lack the necessary structure to store file ACL settings, and the Offline Files feature is a per-computer setting, all users of a Windows 2000 client may be able to access the locally-cached copies of offline files.

 

There not joking when they say Microsoft is not the most secure OS!

Edited February 7, 2008 by zag

[sahmeepee]

Hotfix and adm update for encrypted offiline files.

http://support.microsoft.com/kb/810859

 

I'd forgotten about that hotfix. Although it presumably does work, the downside is that for laptops which are already deployed it's an order of magnitude harder to apply the fix than just to manually set the policy.

 

"This symptom occurs only if the user logs on interactively by using the keyboard." L to the O to the L!

[enjay]

"This symptom occurs only if the user logs on interactively by using the keyboard." L to the O to the L!

 

Yeah, I wondered about that too! I know there are other methods of logging in, but the use of the word "only" suggests that the keyboard is but one of the common methods, and not the one used 99.9% of the time.

[srochford]

Thanks!!!! that was it, The laptops are fat32.

 

Because the FAT and FAT32 file systems lack the necessary structure to store file ACL settings, and the Offline Files feature is a per-computer setting, all users of a Windows 2000 client may be able to access the locally-cached copies of offline files.

 

There not joking when they say Microsoft is not the most secure OS!

 

They're also not joking when they say that most computer problems are down to the user!!

 

this is a bit like complaining when someone breaks into your house and it turns out that you hadn't bothered to lock the door.

 

Microsoft software is not perfect but if you don't set up the machine properly (and NTFS drives have been around for about 15 years so there's not really any excuse for not using them) then there's no chance of any security.

[cookie_monster]

Lol i was thinking about asking if they were FAT32. The amount of laptops that used to come from manufacturers with HD's formatted as FAT32 Toshiba were terrible for it. I think it's extremely poor.

[sahmeepee]

Lol i was thinking about asking if they were FAT32. The amount of laptops that used to come from manufacturers with HD's formatted as FAT32 Toshiba were terrible for it. I think it's extremely poor.

 

Acer also did it until recently (presumably they've stopped now they've gone Vista). Their official word on it was that it was because you can't change an NTFS drive to FAT, but you can do a "convert c: /fs:ntfs" to convert FAT to NTFS. I'm not sure of a good reason for wanting to go back to FAT, but there you go!

[zag]

In our case we had fat32 because the machines were built with an older version of ghost. A quick "convert C: /fs:ntfs" and the problem is fixed now. Thanks for the help edugeekers.