bugtraq - Re: Office 10 applications & flashdrives can be used to browse restricted drives

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <421F598F.3010300@syneticon.de>
Date: Fri, 25 Feb 2005 17:59:59 +0100
From: Denis Jedig <seclists@...eticon.de>
To: "Discini, Sonny" <Sonny.Discini@...tgomerycountymd.gov>
Cc: bugtraq@...urityfocus.com
Subject: Re: Office 10 applications & flashdrives can be used to browse restricted
 drives

Discini, Sonny wrote:

> SYMPTOMS
> After you establish a group policy to restrict access to a drive by
> selecting the Hide these specified drives in My Computer and Prevent
> access to drives from My Computer options, you can use a Microsoft
> Office program to browse and read the contents of the drive.

I just hope it won't disappoint you in some way, but using a policy 
setting that would advise Windows Explorer to hide drives from users 
does not necessarily mean, users can't access the underlying devices 
anymore.

The setting you used to prevent access is not a security feature but 
rather a convinience setting. It will always be possible to go to the 
command shell and view the drives from there. Or to use any third-party 
file manager (or even the file manager out of Windows NT 4) to bypass 
the Windows Explorer setting to hide drives.

If you want to _really_ prevent access to data, either use appropriate 
ACLs (when using fixed drives) or use appropriate third-party-software 
which will run as a driver and have hooks into filesystem calls in order 
to *really* prevent acces to unwanted media.

Denis Jedig
syneticon GbR