Family Matters (and a hacker)...

[Clements]

Me and my (retarded) uncle fell out because he was using my PC without my permission.

I created a User then Password-Protected it so that my PC seemed impenetrable (The password was impossible to guess, take my word for it).

Obviously in a huff, he scoured the internet to find a way to hack into my PC, and suceeded, turning off my password somehow, and then he deleted my dail-up connection (I think by accident) and tried to retrieve it but couldn't (what a retard).

-First of all, how did he get passed my security? He COULD NOT have known the password. Only I know it and I haven't told anybody. The Guest account is off.

-How do I block him? I thought of taking wires to Uni with me so he can't turn the PC on, but he'll cotton on to this by bringing wires from the PC he has access to at home.

He has a mental age of about 12 I'd say (he is 23 years old, and very dim), so he shouldn't take much beating, so any advice is very much appreciated.

[Moose Jr.]

-First of all, how did he get passed my security? He COULD NOT have known the password. Only I know it and I haven't told anybody. The Guest account is off.


The default password for the Administrator account in XP and 2000 is "Administrator". It's common knowledge, so he probably just stumbled on to a site with this info after typing "hacking + newphew's + computer + password" into Google. :)

If you hadn't changed it to something else before, it's the most likely path he took.

[Trotterwatch]

MooseJR


I created a User then Password-Protected it so that my PC seemed impenetrable (The password was impossible to guess, take my word for it).

[Moose Jr.]

Trot:


I created a User then Password-Protected it so that my PC seemed impenetrable (The password was impossible to guess, take my word for it).

You can't create something that already exists.

[Clements]

I know how the arsehole did it. After quick Google-ing, and a successful hack into my own PC and account, I worked it out.

He must have went into safe mode first, clicked the default 'Administrator' account (needs no password). From here he can access the Contol Panel and Remove my password from my own account, enabling him to log on my account without knowing my password, the bastard.

Is there any way of stopping him doing this? I don't want him having Admin access to my PC, he'll tear it apart.

Edit: Hmm, is it possible to Password Protect this otherwise hidden 'Administrator' account? It seems that you can only protect this account when you first install windows and have to create an account for yourself.

[The Khan Artist]

Well, you can always chang the administrator password. I can't recall off the top of my head how to do it in WinXP outside of setup, but it is possible.

EDIT: OK, a bit of Googling give me this:

Start --> Run --> control userpasswords2

Why this functionality isn't in the standard users control panel, I don't know.

[Clements]

Well, you can always chang the administrator password. I can't recall off the top of my head how to do it in WinXP outside of setup, but it is possible.

EDIT: OK, a bit of Googling give me this:

Start --> Run --> control userpasswords2

Why this functionality isn't in the standard users control panel, I don't know.

Right, I changed the Admin Password via Safe mode, but your method works a treat too and is easier to do. He is BLOCKED! :matrix: (unless he is using another method that is, doubtful though)

Thanks to all you guys. Right now if you are reading this topic and have a vulnerable Admin account, do what I just did if you want your account safe. This lame exploit should have never existed.

[GogoTheMimic]

Damn, I could've used that trick in high school... :\

[LazerTag]

best way to stop someone who has direct access to the PC is to get a removeable harddrive case and take your harddrive with you when you leave.

that's what I do with my wife, damn hacker! :teehee:

[vampireuk]

Have a password right at the POST screen, then he can't even boot the damn thing up :D

[jollyrancher]

There's always a way to hack it if it's only password protected. If the computer's security is important to you the best thing to do is get a PC that you can lock with a key.

[cooliscool]

Have a password right at the POST screen, then he can't even boot the damn thing up :D

If he did that, his uncle would probably find the clear CMOS jumper (or switch, depending on board), or put in a different cmos battery while he's using it. :P

[pj64er]

best way to stop someone who has direct access to the PC is to get a removeable harddrive case and take your harddrive with you when you leave.

that's what I do with my wife, damn hacker! :teehee:

thats what i thought of too as i was reading this thread. if all else fails, take your harddrive(s) with you.

[AlphaWolf]

Well, if you are truely wanting to keep him off of it, then you would get one of those cases that you can physically lock, and only install a user secured operating system on your computer (e.g. all NT based OSes, or linux, no DOS or Windows 9X, period,) and then disable booting to anything other than the hard disk in your bios. This is of course assuming that he won't go so far as to render physical damage to the computer (if he does, then your just fucked no matter how you look at it.) Heres why:

In Windows NT and beyond, microsoft decided to be smarter than they were in the past, and not store decryptable passwords (this is actually how everybody else has been doing it for years). Basically, the passwords are stored as a hash, so when somebody enters a password, the OS can only tell if the password is correct or not, but even the OS itself can't know what the exact password is.

But, there is one pitfall to this: It's possible to erase the password hash and reset the checksums so that the OS basically assumes that there is no password, or the password is set to some kind of default, which of course anybody can know (or you can even simply change the hash to match a password that you know). There exist (http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html) bootable images for both floppy disks and cdroms that contain a set of utilities that do exactly this, and don't require any intelligence on the end users part other than to be able to make the bootable medium in the first place, and then follow some simple instructions.

Sure, you could try to set your bios to not boot to anything other than the hard disk, but there are two easy ways of getting around this. The easiest way is to just pop out the watch battery in the motherboard, and use a wire to short the anode and cathode ends, which will discharge your cmos and reset the bios settings, to include your bios password (some motherboards even include a nice labeled jumper to do this without removing the battery). Another way is to simply take the hard disk to another computer, and boot this utility set from there.

Currently I have only seen one type of PC that is actually immune to this: laptops. 99% of all laptops you buy actually store the bios password to a flashrom chip, so you can't simply reset the bios. Also, most of them (including mine :D ) have a feature that encrypts the hard disks entire Master Boot Record based on your password hash, rendering the data on it basically useless unless you have a few hundred bucks to spare to have a data recovery professional get it off of there for you.

I have not seen one desktop motherboard have any of these features, so, that leaves it up to you to ensure that nobody physically breaks into your PC. The reason that laptops have these features is because they get stolen much easier, and it makes it that much harder for the thief to make use of your laptop, or even worse, steal the data off of the hard disk, which often times is worth more to them than the actual laptop itself is.

So far as removing hard disks whenever your not using your computer: 1) pain in the ass 2) internal HDDs are easily damaged by repeated removal/reinsertion 3) external HDDs are slower and cost more. Best of luck in securing your computer :happy:

[Moose Jr.]

With all the great suggestions I think the biggest danger now is him finding this thread... :freak:

[kazooie]

I think you're all missing the most obvious method. Why not just break all his fingers with a hammer?

[flow``]

there is a program here that might help you..

http://www.xp-smoker.com/securexp.html

havent tried it, just read the little info about it. ran across it at some random website.

[AlphaWolf]

there is a program here that might help you..

http://www.xp-smoker.com/securexp.html

havent tried it, just read the little info about it. ran across it at some random website.

This software will by no means secure you from what I meantioned earlier. This is mostly meant for preventing your average moron from being able to run arbitrary programs by e.g. hiding the "run..." option, or using any other simple tactics.

The only thing you can do is something like preventing somebody from reading arbitrary files on your hard drive using EFS, but that only protects each individual file you encrypt, and is only really usefull if you have e.g. some porn you want to hide.

[My95ZR2]

QUOTE: I think you're all missing the most obvious method. Why not just break all his fingers with a hammer?

Step 1: Go to wal-mart
Step 2: Buy a 5 pound sledge hammer
Step 3: Have a "meeting" with him
(Step 3.5: Name your sledgehammer)
Step 4: Introduce the third member of the "meeting" (your sledgehammer)
Step5 : Have your sledgehammer "shake hands" with your uncle

:D

Adam

[smegforbrain]

Why this functionality isn't in the standard users control panel, I don't know.

Because Microsoft thinks that people are too fucking stupid to have total control over their own computers, regardless.

This is the same logic behind the fact that the Windows stupid Messenger program is still enabled by default in Windows 2000 and XP.

[Tagrineth]

Because Microsoft thinks that people are too fucking stupid to have total control over their own computers, regardless.

Amusingly enough, for the most part, they are exactly right.

Remember, MS is selling its OSes to the mainstream masses, not to the 1337 |-|4(|<3|2$.

[ingonab]

Install Linux instead. He won't know what hit him. :D

[Doomulation]

Hehe...that's nice suggestions. But I suppose he wouldn't have to go that far...
But m$ oses will always have loopholes...you'll have to live with it.

[RJARRRPCGP]

Well, if you are truely wanting to keep him off of it, then you would get one of those cases that you can physically lock, and only install a user secured operating system on your computer (e.g. all NT based OSes, or linux, no DOS or Windows 9X, period,) and then disable booting to anything other than the hard disk in your bios. This is of course assuming that he won't go so far as to render physical damage to the computer (if he does, then your just fucked no matter how you look at it.) Heres why:

In Windows NT and beyond, microsoft decided to be smarter than they were in the past, and not store decryptable passwords (this is actually how everybody else has been doing it for years). Basically, the passwords are stored as a hash, so when somebody enters a password, the OS can only tell if the password is correct or not, but even the OS itself can't know what the exact password is.

But, there is one pitfall to this: It's possible to erase the password hash and reset the checksums so that the OS basically assumes that there is no password, or the password is set to some kind of default, which of course anybody can know (or you can even simply change the hash to match a password that you know). There exist (http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html) bootable images for both floppy disks and cdroms that contain a set of utilities that do exactly this, and don't require any intelligence on the end users part other than to be able to make the bootable medium in the first place, and then follow some simple instructions.

Sure, you could try to set your bios to not boot to anything other than the hard disk, but there are two easy ways of getting around this. The easiest way is to just pop out the watch battery in the motherboard, and use a wire to short the anode and cathode ends, which will discharge your cmos and reset the bios settings, to include your bios password (some motherboards even include a nice labeled jumper to do this without removing the battery). Another way is to simply take the hard disk to another computer, and boot this utility set from there.

Currently I have only seen one type of PC that is actually immune to this: laptops. 99% of all laptops you buy actually store the bios password to a flashrom chip, so you can't simply reset the bios. Also, most of them (including mine :D ) have a feature that encrypts the hard disks entire Master Boot Record based on your password hash, rendering the data on it basically useless unless you have a few hundred bucks to spare to have a data recovery professional get it off of there for you.

I have not seen one desktop motherboard have any of these features, so, that leaves it up to you to ensure that nobody physically breaks into your PC. The reason that laptops have these features is because they get stolen much easier, and it makes it that much harder for the thief to make use of your laptop, or even worse, steal the data off of the hard disk, which often times is worth more to them than the actual laptop itself is.

So far as removing hard disks whenever your not using your computer: 1) pain in the ass 2) internal HDDs are easily damaged by repeated removal/reinsertion 3) external HDDs are slower and cost more. Best of luck in securing your computer :happy:

Actually, the MS loopholes are not major, compared to the Windows 95-based OSs. I'm a 1337 Windows 95 and Windows 98 system policy bypasser :D

With a Windows 95-based OS, (possibly also includes Windows ME)
I know how to get around registry editing access blocking and other system policy-based blocking:

You use your Windows CD and it will work *EVEN* with copies of Windows with a different product key. Run the Poledit.exe utility off of it and Windows still will let it save changes to the registry.

[AlphaWolf]

Well, with all 9X OSes (including ME,) all you have to do is move or rename the .pwl files, and the system is yours to rape as you please, then just move em back when your done :D

[Kaoss626]

Alphawolf has some great suggestions here.

I do have a suggestion or two to add to them. In making a list I'll probably include some suggestions made by him and others.

-most towers have a tab (optional and usually not installed but not hard to find and install yourself) that allows for locking the computer case inplace there by preventing physical access to the tower. This stops physical access to the cmos battery and the internal hard drive. Once the tab is there and your computer is good to go, install a paddalock on the tab.

-set BIOS to boot C before anything else.

-password protect changes to the BIOS.

-you may at this point use a boot password at the bios level and this should be fairly secure.

-using Win2000 or XP (definitly NOT Dos, 95, 98, 98SE or ME) Log on as Administrator.

-Change the Administrator password.

-for maximum security, create a new account with administrator privlages and set a password on that account. Log on to the new account, ensure that you have administrator privlages. Delete the account named administrator.

-Ensure the "guest" account is disabled or delete it.

-Ensure that users must press Ctrl+Alt+Del to log on.

-Ensure that the last users name will not be displayed at the logon screen. This will prevent a hacker from gaining even an account name.

-Do not run ANY software service that acts as a server unless absolutely necessary (IIS, Apache etc)

-Check out http://www.winguides.com/security/ and make sure you have covered as many back doors as you can

-Use a firewall (that runs as a service, so it will run even if the machine is not logged on) and block any potentially threatening IP.

-For added seureity, use this as a guide http://www.techspot.com/tweaks/win2k_services/index.shtml to disable as many server services as you can.

good luck, maybe, just maybe you might be able to secure your machine, but every day new holes are found to get in.

[KingTom]

take out all the innards of your computer, buy and empty towe, speakers, keboard & monitor, and set up a secret computer in your house somewheres
or even better, sell your computer and buy a laptop to go everwheres with ou

[Doomulation]

Nice suggestions there, but there are two errors.
One: The administrator account cannot be deleted whatsoever. It can be hidden, however, and usually is. You may also change the name of the default administrator account which can be of some help.
Two: Same as above, but for guest. Also remember that the guest account *CAN NOT* be password protected. The guest account may also be renamed.