A Déjà Vu Nightmare

What a relief to find that someone else has come to the realization that Windows NT security is not secure. "Déjà Vu All Over Again" (November 1997) was fantastic! It was really nice to see someone else also note that the NT security bugs were discovered and patched in Unix long ago.

But one thing was missing from the article. A very large number of holes exist that obviate the need for password-cracking programs, ActiveX, and other tricks: Anyone who logs onto an NT machine with the default configuration has potentially hundreds of ways of gaining access as an administrator.

F irst, the SYSTEMROOT directory is full control for the group Everyone. This allows the replacement of Notepad.exe and other programs with a trojan horse. You don't even need a compiler, since you can rename it Notepad1.exe and create a batch script that adds your user to the Domain Admins group when an administrator starts Notepad from the Start menu. In addition, there are dozens of DLLs and other executables that are at least changeable by Everyone, again allowing easy creation of a trojan horse.

File associations can be changed by a user and are then effective for the administrator. Thus, the next time an administrator double-clicks on a .txt, .doc, or other file on this system, the user becomes a member of the Domain Admins group.

The worst is that this is the default state, and you need no special programming skills or tools. The holes are just there.

Jim Mohr
Author, Linux User's Resource
jimmo@blitz.de