Windows Secrets Newsletter • Issue 2 • 2003-03-13 • Circulation: over 400,000

Glen Looby writes:

• “We use ‘offline’ files for our laptop users, typically comprising their personal and shared folders on the network. The problem we have is that when the user works from another office but on the same domain (we’re in New Zealand and the office is in Australia), Windows connects the drives to the original location rather than ‘work offline.’
  
  “When the user opens a file (Word, Excel, etc.), the response time is painful and frustrating as the system is trying to work from the original document location. This affects the laptop’s own performance, also, since the sites are only connected by a 512 frame-relay-to-Internet connection.
  
  “How can we ‘work offline’ with files while connected to the network? You can do this with Outlook (‘Connect’ or ‘Work Offline’), but there’s no obvious option for files. Our head office in Houston is experiencing the same issues and cannot offer a solution. I’ve entered this into a forum in WinNTMag and had a reply from another admin in the same position, but no answers, though. I’ve even lodged a call with Microsoft support and they haven’t even heard of the problem (in New Zealand, anyway) but are researching. Can you please help?”

I have an idea how we can solve Looby’s dilemma, but I’ll bet someone out there has an even better plan. How about it? To send me your answer, visit WindowsSecrets.com/contact

My top story last issue – that Windows XP allows anyone to log on to the Recovery Console without entering an administrator password if they use the Windows 2000 CD – was picked up by media around the world. It was the top story at the “news for nerds” site known as Slashdot, and was a feature story at Extreme Tech, WinInformant, Lockergnome, Wired News, Security Administrator, Langa List, Geek.com, IT World (Canada), The Register (U.K.), The Inquirer (U.K.), PC Welt (Germany), PC Tip (Switzerland), and many others. Here are some excerpts:

• “A slip-up like this just makes it all the more trivial to completely circumvent XP’s existing security mechanisms.” –Ken Pfeil, a security consultant at Avaya, quoted in Wired



• “While one does need physical access to the machine to exploit this flaw, this will be of little comfort to the administrators of academic computer laboratories and other facilities where users can easily pop a CD-ROM into a computer.” –Brett Glass, Extreme Tech



• “There are other boot CDs and techniques for circumventing Microsoft’s thin layer of file system protection, but using previous versions of Microsoft’s own software against XP took me by surprise. Physical access is always going to be a potential security threat, but this is just too darn easy.” –Lockergnome

I’d like to comment on a point made by several readers who said that there are much worse errors to be found in Windows XP. I never wrote that this was the worst security flaw ever – it’s simply interesting that Windows XP doesn’t even ask for an administrator password in a situation where Windows 2000 definitely does.

Second, some readers asked about my statement that Windows XP allows an intruder to copy files onto removable media – something that a user of the Recovery Console normally isn’t allowed to do under Windows XP or 2000. These readers weren’t able to duplicate that feat. That’s because it requires setting an environmental variable at a command line first. The command is documented, but I’m not going to describe it, because I don’t want to enable more people to use this technique.

Finally, here are some of the most interesting comments I received. The readers whose comments I printed will receive a gift certificate for a book, CD, or DVD of their choice.

• “Your recommendation should be that if people use ANY machine in an open space, and they are concerned with the data on those systems, that they physically secure them. What the bad guys know even better is how to simply boot up on a Linux disk and change the admin password. That is a far more significant threat – and one not limited to Win2K, XP, or any operating system from any manufacturer.” –Tim Mullen



• “The problem, as I see it, is that Microsoft Corp. marketing convinced a large portion of an entire generation of IT admins that Windows NT had suddenly made it feasible to leave the consoles of business-critical computers accessible to casual foot traffic, without security exposure. … We long-time Unix people immediately pegged that as laughable drivel. Even before the Linux kernel people wrote their NTFS driver and admin-password access utilities, it was simple, given console access, to open the system case, insert your own NT boot hard drive alongside the target system’s drive, boot your drive, and crack any contents of the target drive you wish.” –Rick Moen



• “The only protection is to lock down the computer, prevent booting from CD or floppy in the BIOS setup, password-protect the BIOS, make sure that all file systems are NTFS, and encourage users to encrypt sensitive files (which cannot be read using this ‘technique’). Windows is not alone in having this ‘vulnerability,’ Linux, FreeBSD, and in fact any operating system that does not encrypt its file system can be accessed in this way, provided users can boot off removable media.” –Daniel Franklin