3 ms·

user comment on imgur: "As a network manager, disable startup repair via group policy. Fixed." Does this fix it?

by ominous 12y ago

IkmoIkmo 12y ago
Just this one method, yeah. But unless you encrypt your harddrive you're not going to really get security when someone has physical access to your device.
- arca_vorago 12y ago
  There are other things you can do though. FDE, encrypted bootloader, BIOS passwords (on boot if important enough), removal of DVD Drive/USB ports as an option. Security isn't binary, it's about layers and compromises based on use case.
cordite 12y ago
If the trick is to modify the contents of the file system, then surely booting from a Linux stick or likewise could suffice too.
mkaufmann 12y ago
Yes because the recovery menu won't be accessible than (which is needed to replace the sticky key executable) The settings can be changed with bcdedit: bcdedit /set {default} recoveryenabled No bcdedit /set {default} bootstatuspolicy ignoreallfailures Additionally booting from USB/... should be disabled in the BIOS/UEFI options and also access to that should be password secured. Further more because the person has physical access, the computer should be locked away so that the harddrive can't be accessed. Also all cables should be secured so that no sniffer can be plugged in between. This also especially includes the USB ports on the monitor if those are enabled.
- arca_vorago 12y ago
  Note: Make sure to run bcdedit commands with elevated privileges. I am currently working on adding this into my ansible test AD replacement.
falcolas 12y ago
NOT TESTED: I imagine that as long as you don't have a startup disk, it would. If you have a startup disk, you could likely kick off the repair from the disk. To paraphrase another comment from imgur: If the hacker has physical access to the machine, it's now their machine.
dguido 12y ago
No, if I exploit your computer and have admin rights, I can use this technique to enable persistent access to it over RDP. This is a common technique that hackers use in enterprise networks.
- Someone1234 12y ago
  Meh. If someone has admin on a machine then they can re-establish access in a number of ways (e.g. their own VNC service, their own Powershell instance bound to a port, malware, etc). Binding sticky keys to CMD is one of the worst ways as it can be detected easily (either via people trying to use Magnifier and getting CMD, hitting shift 5x times, etc), it can be fixed by Windows updates even by accident (and will be fixed via SFC), and could allow other competing "hackers" to access the machine. I've never seen anyone use this trick in reality and I've certainly never read about "hackers" using it. They typically like to use a tiny single-file VNC server with a hardcoded user/password.

user comment on imgur: "As a network manager, disable startup repair via group policy. Fixed." Does this fix it?

by ominous 12y ago

user comment on imgur: "As a network manager, disable startup repair via group policy. Fixed." Does this fix it?

Just this one method, yeah. But unless you encrypt your harddrive you're not going to really get security when someone has physical access to your device.

arca_vorago 12y ago
There are other things you can do though. FDE, encrypted bootloader, BIOS passwords (on boot if important enough), removal of DVD Drive/USB ports as an option. Security isn't binary, it's about layers and compromises based on use case.

cordite 12y ago

If the trick is to modify the contents of the file system, then surely booting from a Linux stick or likewise could suffice too.

mkaufmann 12y ago

Yes because the recovery menu won't be accessible than (which is needed to replace the sticky key executable) The settings can be changed with bcdedit: bcdedit /set {default} recoveryenabled No bcdedit /set {default} bootstatuspolicy ignoreallfailures Additionally booting from USB/... should be disabled in the BIOS/UEFI options and also access to that should be password secured. Further more because the person has physical access, the computer should be locked away so that the harddrive can't be accessed. Also all cables should be secured so that no sniffer can be plugged in between. This also especially includes the USB ports on the monitor if those are enabled.

arca_vorago 12y ago
Note: Make sure to run bcdedit commands with elevated privileges. I am currently working on adding this into my ansible test AD replacement.

falcolas 12y ago

NOT TESTED: I imagine that as long as you don't have a startup disk, it would. If you have a startup disk, you could likely kick off the repair from the disk. To paraphrase another comment from imgur: If the hacker has physical access to the machine, it's now their machine.

dguido 12y ago

No, if I exploit your computer and have admin rights, I can use this technique to enable persistent access to it over RDP. This is a common technique that hackers use in enterprise networks.

Someone1234 12y ago
Meh. If someone has admin on a machine then they can re-establish access in a number of ways (e.g. their own VNC service, their own Powershell instance bound to a port, malware, etc). Binding sticky keys to CMD is one of the worst ways as it can be detected easily (either via people trying to use Magnifier and getting CMD, hitting shift 5x times, etc), it can be fixed by Windows updates even by accident (and will be fixed via SFC), and could allow other competing "hackers" to access the machine. I've never seen anyone use this trick in reality and I've certainly never read about "hackers" using it. They typically like to use a tiny single-file VNC server with a hardcoded user/password.