full-disclosure - RE: Disabling Cached Logon Credentials

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <6C9DA3D74716D9439E53B4C097ADA3242FF3FD@mail5.vistaprint.net>
From: nduda at VistaPrint.com (Nick Duda)
Subject: RE: Disabling Cached Logon Credentials

Even with physical access you (a hacker) want to do what you have to ,
leave and still be undetected. If a hacker is going to get to a physical
server only to change the admin password and do some hack (i.e. trojan),
I would find it silly because when the admin finds out that its not a
password he supplied, that system is as good as formatted. This is why
disbaling stuff like autoplay on cd roms is a good idea, and not to just
lock servers screensavers but rather logout.

I  don't think disbaling cached logons is something to worry about if in
a secured data center, but merly a common practice for any security
professional (i.e. do the job right, or don't do it at all, don't
halfass when it comes to security)

- Nick

-----Original Message-----
From: dwr3ck@...hmail.com [mailto:dwr3ck@...hmail.com] 
Sent: Tuesday, December 30, 2003 1:29 PM
To: focus-ms@...urityfocus.com; full-disclosure@...ts.netsys.com
Subject: Disabling Cached Logon Credentials

Disabling cached logon credentials is on virtually every server
hardening checklist.

If you have your servers physically secured in a data center what is the
real benefit of disabling cached logon credentials?

Whenever a server is off the network, admins have to obtain the local
admin password.  Depending on how you handle local RID=500 account
passwords this can add significantly to downtime when resolving issues.

Does anyone know of a way to exploit cached credentials over the wire?

If someone has physical access to a system they own it anyway:

http://home.eunet.no/~pnordahl/ntpasswd/

Concerned about your privacy? Follow this link to get FREE encrypted
email: https://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
https://www.hushmail.com/services.php?subloc=messenger&l=434

Promote security and make money with the Hushmail Affiliate Program: 
https://www.hushmail.com/about.php?subloc=affiliate&l=427

------------------------------------------------------------------------
---
------------------------------------------------------------------------
---