bugtraq - Re: Windows 7/8 admin account installation password stored in the clear in LSA Secrets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALvHzrFUSk1bi+-JwZRXEpyXOw+Yf9vQ3fBo93Bzgh1ajyS__g@mail.gmail.com>
Date: Thu, 11 Jul 2013 20:18:52 -0400
From: "Dnegel X." <dnegel666@...il.com>
To: bugtraq@...urityfocus.com
Subject: Re: Windows 7/8 admin account installation password stored in the
 clear in LSA Secrets

1. I didn't find an explanation about this behavior that deals with
installation password, although this LSA Secret is well known to
contain passwords, mainly from Windows XP era. Could you provide a
link?
It also hasn't been fixed in Window 8 released this year.
2. You could e.g. retrieve a password from one vulnerable machine
(where physical access or admin shell is possible) and use it against
more secure ones sharing same admin password, typically when a Windows
image is replicated over a network to multiple machines.

Anyhow, having a cleartext password residue somewhere without
documentation looks like a sad bug to me.

Xavier

On Thu, Jul 11, 2013 at 7:35 PM, Rob <synja@...fulvisions.com> wrote:
> Two things:
> 1. This was made public sometime in 2012 or earlier IIRC.
> 2. Exploiting this requires the same permission levels that would be
> required to change or access the password anyway. Where's the realistic
> security threat?
>
> Rob
>