http://news.zdnet.com/2100-1009_22-5865318.html

but there are many ways around this… if I can get the admin password then I can install rogue hacking softwares right?

what if I have a rogue keylogger service running in a computer that can log all keystrokes? you can find implementations of this that sends logs to a hacker’s email in the background.

I can easily install a keylogger by logging in as a rogue admin. The hacker will just wait until the password arrives to his inbox.

even the strongest encryption passwords typed while the OS is running is always hacked. If the hacker gets the logs of keystrokes all of the OS level security like EFS is useless.

Here’s a detailed description of why that attack won’t work:

(Reference this site: http://technet.microsoft.com/e.....t.10).aspx )

Resetting Local Passwords on Windows XP

Windows XP has new behavior regarding locally changed passwords and EFS. In Windows 2000, when a local user password was reset by an administrator, the administrator or third party could theoretically use the newly changed account to log on as the user and decrypt the encrypted files. In Windows XP, the changing of a local user password by an administrator, or through a method other than by the user, will block all access to previously encrypted files by the user.

In summary, the profile and keys of the user will be lost and will not be available to the account with the reset password. Windows XP gives the following warning when attempting to reset a user account password:

Warning Resetting this password might cause irreversible loss of information for this user account. For security reasons, Windows protects certain information by making it impossible to access if the user’s password is reset.

This feature helps to guard against offline attacks and prevents rogue administrators from gaining access to encrypted files of other users.

Windows EFS could also be easily hacked if you can have the admin password, and there are a lot of write-ups on how to do this on the Net: http://internetbusinessdaily.n.....-password/
Once you get the admin password, it’s easy to change all the passwords of each PC user. I am sharing computers and securing data on the OS level is a nightmare!

This problem made me look out for an ever more stronger security solutions that will run BEFORE boot time so even when my laptop is stolen, I could be assured that my whole disk is protected (not only my Outlook files!). I use a product called checkpoint to do this and I am yet to find a hacking software for this product: http://www.checkpoint.com/prod.....index.html
I configured my setup in such a way that even if they know the OS admin password, they can’t boot or change it without my pre-boot checkpoint password!

Ofcourse, security doesn’t stop there… in computers there is always a way to hack around passwords!

Use Windows EFS to create an encrypted folder (go to My Documents, create a folder called “Encrypted” or something like that, right click it, select “Advanced” and select “Encrypt this folder”), then create an UNENCRYPTED PST file located in that directory. Now, when you log into Windows and open Outlook, the PST file is available, but if someone else logs into the machine or steals the hard drive, the PST file is scrambled.