LINUX Finding Local Passwords

[bwestlake]

Is their anyway to stop linux from finding windows local passwords?

[difinity]

Maybe if the drive was encrypted. Other than that restricting the BIOS to only boot to the hard drive and putting a password on would reduce the possibility.

[OB1]

I'm not sure there is.

Permissions don't apply if you haven't booted from the OS enforcing them.

 

In what situation? Using a live CD? Are you dual booting? Which distro & which version of windows?

 

EDIT: difinity, beat me to it.

 

If you're dual booting you can set linux not to mount the windows partition at startup. How depends entirely on your distro.

Mounting partitions/drives is restricted to root usually.

Edited March 12, 2012 by OB1

[dhicks]

Is their anyway to stop linux from finding windows local passwords?

 

You mean is it possible to stop someone booting from a Linux-based boot CD or similar and using a Rainbow Tables-based tool to have a go at cracking your Windows passwords? As pointed out above, physically secure the PC as much as possible (encrypt the harddrive, stop booting off CD or USB, and make sure they can't simply walk off with the PC or laptop). Otherwise, use strong passwords - random-looking mixtures of letters and numbers at least 8 characters long. If you look up Rainbow Tables on Google you'll get a couple of good articles from Microsoft and on Wikipedia which explain the basic principles, along with advice on making a password strong enough to withstand the average Rainbow Tables-based attack.

[difinity]

Why crack the password, much easier/quicker to blank the password. That's what the popular Linux password editor does. It doesn't matter how complicated or long it is.

[AngryTechnician]

Why crack the password, much easier/quicker to blank the password. That's what the popular Linux password editor does. It doesn't matter how complicated or long it is.

 

It depends on your end goal, but in general, password exposure is always more serious than a password reset because:

 

1. Most people re-use passwords, so you would likely get access to other systems as well without having to compromise them.
   
2. If you reset the password, the user will likely realise their account has been compromised and act accordingly. If you simply discover their password, they may be none the wiser.
   

 

This is why anyone whose 'forgotten password' procedure is to email the existing password needs to be shot.

[difinity]

I did just realise after i had posted why knowing the password might be wanted. I've only ever blanked the password.

[dhicks]

Jeff Attwood's post on the subject is quite good, if a few years old now:

 

Coding Horror: Rainbow Hash Cracking