full-disclosure - Safe Run As

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: offtopic at mail.ru (offtopic)
Subject: Safe Run As

Safe Run As - keylogger protection

This tool is created to protect administrative passwords against keyloggers. 
Administrator's passwords are stored in the AES encrypted file on the removalable storage (flash-drive, floppy). Then you need to use "run as" command you launch saferunas.hta, and provide username and encryption key. 
Passwords are decrypted and cmd.exe is launched with selected user's privileges. 
Edit.hta tool can be used to create and modify file with encrypted passwords. 

Attention! 
- This tool doesn't protect against smart malware which can copy password file and steal encryption key. 
- You can't choose program to run. Coming soon. 
- In this version password entered is used as AES key directly. This is bad idea. PKCS#5 version is coming soon. 
- Attention - when you run GUI application as high privileged user, you are vulnerable for Shatter-style attacks (see shatter vbs for example).

http://www.security.nnov.ru/soft/srunas/ 

(c)oded by offtopic@...l.ru