Feeds

Stolen laptops hand hackers keys to the kingdom

Peril of purloined PCs

Next gen security for virtualised datacentres

Infosec As web apps are becoming more secure stolen laptops have become among the easiest ways to break into corporate networks. High profile firms such as Fidelity and Ernst and Young along with celebrities such as Kevin Costner have lost laptops over recent months. Concern over these thefts has focused on the exposure of data left on these devices. But the potential to use stolen kit to lift user credentials also poses a grave risk.

During a presentation at Infosec on Tuesday, penetration testing firm SecureTest explained how DIY hardware devices or software available for purchase from eBay might be used to reset or circumvent passwords set in a laptop's BIOS. "If that fails you can always take the drive out and fit it with a USB connector," explained SecureTest's Rob Pope.

A Linux tool called Backtrack, which can run from a CD loaded onto a Windows PC, might then be used to get system keys and password hashes. Windows stores the hashes of passwords derived from the LM algorithm instead of directly storing passwords. But LM encryption is weak and susceptible to brute force attack using Rainbow Crack or other tools.

SecureTest pre-computed a rainbow table of password hashes totaling 19GB. Thereafter obtaining the plain text of a password becomes a simple job of matching password hashes. Most of the hacker tools in this area are American so the inclusion of a pound sign in passwords is capable of frustrating attacks.

Next up SecureTest showed how a program called Disk Investigator might be used to extract the encrypted form of WEP key passwords or remote desktop login credential from a Windows Registry file. It showed how a program called Cain was able to decode Cisco VPN client passwords given access to a purloined corporate PC. "What we find during penetration testing is that most passwords are based either around the Lord of The Rings, the names of planets or Star Wars," said Pope.

SecureTest md Ken Munro outlined a number of defences firms might employ against the attacks the firm highlighted. Although not foolproof, use of BIOS passwords is a significant barrier against attack. Firm should avoid setting up machines that can be booted from USBs, floppy discs, CD ROMs or from a network. Strong passwords contained a mix of alphanumeric characters should be used. Finally firms should implement either disc encryption or, at minimum, the encryption of sensitive files, Munro advised. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
So, Apple won't sell cheap kit? Prepare the iOS garden wall WRECKING BALL
It can throw the low cost race if it looks to the cloud
Samsung Gear S: Quick, LAUNCH IT – before Apple straps on iWatch
Full specs for wrist-mounted device here ... but who'll buy it?
Apple promises to lift Curse of the Drained iPhone 5 Battery
Have you tried turning it off and...? Never mind, here's a replacement
Now that's FIRE WIRE: HP recalls 6 MILLION burn-risk laptop cables
Right in the middle of Burning Mains Man week
Reg man looks through a Glass, darkly: Google's toy ploy or killer tech specs?
Tip: Put the shades on and you'll look less of a spanner
HUGE iPAD? Maybe. HUGE ADVERTS? That's for SURE
Noo! Hand not big enough! Don't look at meee!
AMD unveils 'single purpose' graphics card for PC gamers and NO ONE else
Chip maker claims the Radeon R9 285 is 'best in its class'
Tim Cook in Applerexia fears: New MacBook THINNER THAN EVER
'Supply chain sources' give up the goss on new iLappy
Just in case? Unverified 'supersize me' iPhone 6 pics in sneak leak peek
Is bigger necessarily better for the fruity firm's flagship phone?
prev story

Whitepapers

Gartner critical capabilities for enterprise endpoint backup
Learn why inSync received the highest overall rating from Druva and is the top choice for the mobile workforce.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.