Showing posts with label encryption. Show all posts

Tuesday, April 2, 2013

Lock/Unlock Computer With Pendrive

SYSKEY is a utility that encrypts the hashed password information in a SAM database in a Windows system using a 128-bit encryption key.

SYSKEY was an optional feature added in Windows NT 4.0 SP3. It was meant to protect against offline password cracking attacks so that the SAM database would still be secure even if someone had a copy of it. However, in December 1999, a security team from Bind View found a security hole in SYSKEY which indicates that a certain form of cryptanalytic attack is possible offline. A brute force attack then appeared to be possible.

Microsoft later collaborated with Bind View to issue a fix for the problem (dubbed the ‘Syskey Bug’) which appears to have been settled and SYSKEY has been pronounced secure enough to resist brute force attack.

According to Todd Sabin of the Bind View team RAZOR, the pre-RC3 versions of Windows 2000 were also affected.

So this is pretty cool, right? Well, I really like the idea of keeping this on Floppy so that it requires a floppy disk (a sort of 2 factor (hardware/software) authentication?).

Naturally I wanted to go a bit further and use this on a USB drive instead of storing to a Floppy. I can’t see myself carrying a floppy and a USB floppy drive around with me. After all, this provides another layer of security.

NOTE: I haven’t tested copying data from 1 USB to another USB to see if it works as a backup. This way you could lock up a USB drive as a spare if needed.

Here’s how to get this to work using a USB drive.

1. Insert your USB drive into your system and wait for it to be recognized and install any necessary drivers.

2. Fire up disk management and re-assign the drive letter it was given to “A”.

Start up disk management by clicking Start and typing diskmgmt.msc

Right-click the USB drive and choose to assign driver letter or path.

Assign it to letter “A”

Accept the warning message

Now your USB drive is “A”

3. Run Syskey and save encryption to USB Drive “A”

Click Start and type syskey followed by hitting Enter

Syskey launched; Click “Update”

Choose “Store Startup key on floppy disk” and click “OK”

You’ll be prompted to enter your diskette. Make sure your USB drive is inserted and writable.

4. Reboot and have fun. Don’t lose your USB disk! Also, to revert this, you can run syskey again and choose to store it locally instead of “on a floppy disk”.

All Saved Password Location

Google Chrome:

Chrome Passwords are stored in a SQLite file the sites name and sites username is in clear text but the password is seeded in a Triple DES algorithm. The file is called Web Data and is stored in the following location

XP – C:\Documents and Settings\Username\Local Settings\Application Data\Google\Chrome\User Data\Default

Vista – C:\Users\Username\Appdata\Local\Google\Chrome\User Data\Default

Trillian:

Note- I have just realised the new version of trillian the passwords made be stored/encrypted differently

Trillian Passwords are stored in .ini files the first character of the password is encrypted with XOR with the key 243 then the password is converted into hex. The file is based on what the password is for so if it was icq it would be icq.ini (for new versions I think they are all stored in a file called accounts.ini or something similar if you open it up with notepad you will see all the data + the encrypted password). The files are stored in the following location:

XP (old version) – C:\Program Files\Trillian\users\

XP (new version) – C:\Documents and Settings\Username\Local Settings\Application Data\Trillian\user\global – I am not sure on exact but it is somewhere their

Vista (old version)- C:\Program Files\Trillian\users\

Vista (new version)- C:\Users\Username\Appdata\Roaming\Trillian\user\global

MSN /Windows Live Messenger:

MSN Messenger version 7.x: The passwords are stored under HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\C reds\[Account Name]

Windows Live Messenger version 8.x/9.x: The passwords are stored in the Credentials file, with entry name begins with “WindowsLive:name=”. They a set of Win API functions (Credential API’s) to store its’ security data (Credentials). These functions store user information, such as names and passwords for the accounts (Windows Live ID credentials). Windows Live ID Credential records are controlled by the operating system for each user and for each session. They are attached to the “target name” and “type”. If you are familiar with SQL you can think of target name and type as the primary key. Table below lists most frequently used fields in Windows Live ID Credential records.

Paltalk:

Paltalk Passwords are using the same password encryption algorithm. Paltalk passwords are stored in the registry. To encrypt the new password Paltalk looks at the serial number of the disk C:\ and performs a mix with the Nickname. The resulting string is then mixed again with the password and some other constants. The final string is then encoded and written to the registry.

AIM, ICQ and Yahoo Messenger passwords that are stored by Paltalk are encoded by BASE64 algorithm.

The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\Paltalk\[Account Name]

Google Talk:

Google Talk passwords are encoded/decoded using Crypto API. Encrypted Gmail passwords are stored by Google Talk in the registry under HKEY_CURRENT_USER\Software\Google\Google

Talk\Accounts\[Account Name]

Firefox:

The passwords are stored in one of the following filenames: signons.txt, signons2.txt, and signons3.txt (depends on Firefox version)

These password files are located inside the profile folder of Firefox, in [Windows Profile]\Application Data\Mozilla\Firefox\Profiles\[Profile Name]

Also, key3.db, located in the same folder, is used for encryption/decription of the passwords.

Yahoo Messenger 6.x:

The password is stored in the Registry, under HKEY_CURRENT_USER\Software\Yahoo\Pager

(”EOptions string” value)

Yahoo Messenger 7.5 or later:

The password is stored in the Registry, under HKEY_CURRENT_USER\Software\Yahoo\Pager – “ETS” value.

The value stored in “ETS” value cannot be recovered back to the original password.

AIM:

AIM uses Blowfish and base64 algorithms to encrypt the AIM passwords.

448-bit keyword is used to encrypt the password with Blowfish. The encrypted string is then encoded using base64. The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\America Online\AIM6\Passwords
Filezilla:

Passwords are stored in a .xml file located in Filezilla on appdata their is sources for this

Internet Explorer 4.00 – 6.00:

The passwords are stored in a secret location in the Registry known as the “Protected Storage”.

The base key of the Protected Storage is located under the following key:

“HKEY_CURRENT_USER\Software\Microsoft\Protected Storage System Provider”.

You can browse the above key in the Registry Editor (RegEdit), but you won’t be able to watch the passwords, because they are encrypted.

Also, this key cannot easily moved from one computer to another, like you do with regular Registry keys.

Internet Explorer 7.00 – 8.00:

The new versions of Internet Explorer stores the passwords in 2 different locations.

AutoComplete passwords are stored in the Registry under HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2.

HTTP Authentication passwords are stored in the Credentials file under Documents and Settings\Application Data\Microsoft\Credentials , together with login passwords of LAN computers and other passwords.

Opera:

The passwords are stored in wand.dat filename, located under [Windows Profile]\Application Data\Opera\Opera\profile

Outlook Express (All Versions):

The POP3/SMTP/IMAP passwords Outlook Express are also stored in the Protected Storage, like the passwords of old versions of Internet Explorer.

Outlook 98/2000:

Old versions of Outlook stored the POP3/SMTP/IMAP passwords in the Protected Storage, like the passwords of old versions of Internet Explorer.

Outlook 2002-2008:

All new versions of Outlook store the passwords in the same Registry key of the account settings.

The accounts are stored in the Registry under HKEY_CURRENT_USER\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\[Profile Name]\9375CFF0413111d3B88A00104B2A6676\[Account Index]

If you use Outlook to connect an account on Exchange server, the password is stored in the Credentials file, together with login passwords of LAN computers.

ThunderBird:

The password file is located under [Windows Profile]\Application Data\Thunderbird\Profiles\[Profile Name]

You should search a filename with .s extension.

Digsby:

The main password of Digsby is stored in [Windows Profile]\Application Data\Digsby\digsby.dat

All other passwords are stored in Digsby servers.

Wednesday, March 27, 2013

How to crack Windows Logon password

Cracking windows logon password is not so difficult. You can get many offline password crackers which could change/clear the existing password (like offline nt password and registry editor) or cracks the existing password (like oph crack). Just download their ISO images ,burn them,insert to CD ROM and then things are simply self explainatory. I am writing this post to make you clear that how actually these password crackers work.

Okay when you set windows logon password, it is obviously stored in a file somewhere in windows.

The password is stored in SAM file placed in %systemroot%\system32\config (like C:\windows\system32\config).

Now why we just dont try to open SAM and see all stored passwords. Okay lets do it, go to C:\windows\system32\config and open SAM. You must get an error that " it is in use by some another application". Actually we cant open SAM file when windows is running . Even if anyhow we manage to access the content of SAM file, we won't get the passwords in clear text but they are encrypted.

So , what is SAM file ?

SAM stands for Security Accounts Manager. SAM is database stored as registry in windows that stores windows users passwords in hashed formats( LM and NTLM). These are usually called as hashes.

What are hashes ?

Hashes are kind of encryption. A hash function is a one way function. One way means, if plain text

is converted into hash, it can not be converted back plain text. Remember this is the most important

point that they are one way functions.

What is windows authentication procedure ?

When ever a user creates new account in windows, its password is convetred to hash and stored in SAM database.When user logins, the password is converted to hash and is compared with the stored hash in SAM database, if both the hashes match , the user is authenticated.

How to access SAM file ?

SAM file can not be moved/copied or opened when windows is running. It can be accessed only when windows is offline/not running . Got confused that how can we use the windows files when it is not running ?

Here comes the concept of Live Operating systems. A live CD is containing a bootable OS. Just insert it in CD ROM and you can use it without any installation.

How to crack Windows password ?

Okay suppose we have got access to SAM file and have password hashes. Dont you think its useless because hashes cant be coverted to plain text ? Lets see, what we can do.

We ( I mean automated tools) can actually do two things.

1. Clear/Change password :Clear the existing hash and put new hash (we know alogrithm to convert plain text to hash) in order to change/clear the password. This is how offline nt password and registry editor work. It doesn't give you the orignal password but helps you to change/clear it.

2.Crack password Make a long list of all possible combinations of alphabets,numbers and convert them to hashes.Compare every hash with hash we obtained from SAM file and hashes could be cracked. This is exactly how OPH crack works. It has already saved hashes of many possible combinations of letters/numbers stored in tables called as rainbow tables.

How to crack Windows Logon password

The password is stored in SAM file placed in %systemroot%\system32\config (like C:\windows\system32\config).

So , what is SAM file ?

SAM stands for Security Accounts Manager. SAM is database stored as registry in windows that stores windows users passwords in hashed formats( LM and NTLM). These are usually called as hashes.

What are hashes ?

Hashes are kind of encryption. A hash function is a one way function. One way means, if plain text

is converted into hash, it can not be converted back plain text. Remember this is the most important

point that they are one way functions.

What is windows authentication procedure ?

How to access SAM file ?

Here comes the concept of Live Operating systems. A live CD is containing a bootable OS. Just insert it in CD ROM and you can use it without any installation.

How to crack Windows password ?

Okay suppose we have got access to SAM file and have password hashes. Dont you think its useless because hashes cant be coverted to plain text ? Lets see, what we can do.

We ( I mean automated tools) can actually do two things.

Friday, March 15, 2013

RHEL6 volume encryption using LUKS

Hi there,

Few days ago I was trying the LUKS (Linux Unified Key Setup) volume encryption on RHEL. It worked pretty well, until I [re]boot the system (to mount the encrypted volume automatically from /etc/fstab) and I was presented with the famous Give root password for maintenance (or type Control-D to continue): screen. I figured it out sorta hard way, so it's mainly for the future reference and for those who experience[d] the same problem.

I tried on a virtualized system but the same thing can be done with any file-system - sda/vda/LVM etc. So, if the target file-system is /dev/vda6, this is should be done to prepare and map the file-syatem:

 # cryptsetup luksFormat /dev/vda6
 # cryptsetup luksOpen /dev/vda6 cryptVL

at this point, "/dev/mapper/cryptVL" will be created. The next step is:

 # mkfs.ext4 /dev/mapper/cryptVL
 # mount /dev/mapper/cryptVL /mntVL

to format and mount the file-system. Just to mention that /cryptVL is the directory, where I mounted the newly built encrypted file-system and that should created beforehand (the normal "mount" thing).
Up to this point, it will work just fine but if you put an entry like this:

/dev/mapper/cryptVL /mntVL ext4 defaults 1 2

in the "/etc/fstab" to mount this on boot, you are finished. Because /dev/mapper/cryptVL is not a permanent mapping, hence it doesn't survive a reboot.

To make it happen: After adding the "/etc/fstab" entry (and of course before [re]booting), you need to put a line in the "/etc/crypttab" following this format:

< name _of_the_block_device > < path/to/the/actual/device > < password | none > [ list of options ]

So, if "/dev/mapper/cryptVL" is the name of the resulting encrypted block device and "/dev/vda6" is the path to the actual device, the entry should be:

cryptVL /dev/vda6 none

If the third field is "none" the system will ask for the LUKS password during boot. For the password less booting, you need to put the password in a file like this:

# dd if=/dev/random of=/root/luks.key bs=32 count=1
# cryptsetup luksAddKey /dev/sdb1 /root/luks.key
# echo "cryptVL /dev/vda6 /root/luks.key" > /etc/crypttab

(The path and the name of the key file could be anything of your choice but should be matched in every entry)
After that, if everything goes well, you should be booting into your encrypted device.

The worst case scenario

If you happen to manage to paralyzed your system already, you will see the after entering the "root password", you still won't be able to modify "/etc/fstab", even though root has rw permission. the only way to fix this is to boot into "single user" mode. To that: press any key in the grub-menu screen > press "a" to append > add "single" at the end of the line > predss "b" to boot.

But that's not enough. After booting into the system, you have to issue this:

# mount -w -o remount /

to actually remount the root file-system in read-write mode. Now you will be able to comment out/delete the line from the /etc/fstab and the system will boot normally.

Hope it helps. cheers!!!