Password recovery with Elcomsoft System Recovery

(Part three of Three ways to recover from a forgotten Windows password)

You've forgotten your Windows password. What now?

Password reset accessibility hack

(Part two of Three ways to recover from a forgotten Windows password)

You've forgotten your Windows password. What now?

Password Reset Disk

(Part one of Three ways to recover from a forgotten Windows password)

You've forgotten your Windows password. What now?

Three ways to recover from a forgotten Windows password

You've forgotten your Windows password. What now?

I’ll show you three different ways to get back into your system:

1. The ‘right’ way
2. A free but dirty hack
3. An elegant but $50 hack

APT testing like it's 2004

Is it time to start testing anti-virus software using methods I last employed ten years ago?

While constructing a timeline for Dennis Technology Labs, the security testing venture I started in 2008, I realised that I've been involved in anti-malware testing for over a decade.

This is because, as a journalist, I used to test anti-malware software every year or so, probably from around 2000.

It seems that some of the rather 'edgy' testing techniques I used in the early days are coming into fashion now that 'Advanced Persistent Threats' (APTs) are perceived as being a significant threat.

Looking through my files I found one of the first anti-virus tests I ever published, in the now defunct Computer Shopper magazine.

The report (PDF), which appeared in 2004, contains this description of how I conducted the tests:

"Anti-virus programs should be able to detect the current, high-threat files being sent around the internet. Our test files included some of the most virulent and commonly found viruses, as well as well-known backdoor Trojans and harmful Visual Basic scripts that we generated using well-known virus-generation tools. None of these files should pose any problem to a decent scanner.We compressed copies of each into Zip files, too.

Finally, just to add a bit of a challenge, we also used a few tricks to disguise the backdoor files. These tricks rely on freely available executable packers and a wrapper program that can attach the backdoor to another, more innocent file – in our case, Windows’ Minesweeper game. Whoever runs the game can play it, but will also unwittingly hand over control of their PC to the attacker. All the tests were run in Windows XP Professional."

What the article doesn't mention there, but alludes to in the individual product reviews, is that I ran all files and monitored their behaviour to ensure that they were actually a threat to the system.

For example, I would try to connect to the BackOrifice Trojan used (but not named) in this test, and control the victim system remotely.

Here's an extract from the Norton Antivirus 2004 product review:

"Even when we increased the heuristic level to the Highest setting, our backdoor Trojans were able to enter and operate on the system unhindered."

Clearly such a small test provides the reviewer with time to play with configurations. This doesn't really scale when handling hundreds of malicious URLs and dozens of anti-malware programs.

I received a lot of angst from the anti-virus industry whenever one of these reviews was published. The people I spoke to at those companies really didn't like the idea of testers 'creating' threats, whether or not they used easily-available tools and well-known techniques.

Judging by some of the conversations I'm having with companies producing anti-APT solutions it might be time to start digging out the old BackOrifice, eLiTeWrap and UPX packer tools.

Retro: Windows 98 end-of-life

I wrote the following column for Computer Shopper magazine when Microsoft ceased providing security updates for Windows 98.

It seems appropriate to republish it now, as Windows XP is on the verge of the same fate.

October 2006

Computer Shopper magazine #224

Rants & Raves

WINDOWS 98 RIP

SIMON EDWARDS RANTS

So long, Windows 98. Rest in peace. When you were born you made getting online easier, you made using large hard disks possible and you were easier to install.

You had a new desktop system that not only allowed users to display web content live from slow and expensive dial-up connections, but regularly caused the system to crash.

You helped destroy Netscape’s business with your integrated web browser, simultaneously heralding the beginning of years of security problems for Windows users, and your integrated Media Player was judged anti-competitive, too.

So long, Windows 98. Rot In Pieces.

After eight years, Microsoft has pulled the plug on Windows 98. No longer will the company provide updates, even if (or rather, when) further security holes are found. The same goes for Windows Me. That’s OK, though, because no-one uses Windows 98/Me any more. No-one except the estimated remaining 70 million users.

98 TEARS

So who is using Windows 98 these days? My guess would be a mixture of people who are non-technical and those who can’t afford to buy a PC every few years. The original date for termination of Windows 98 support was 2003. It is thought that pleas from the developing world persuaded Microsoft to issue updates for a further three years. There will also be plenty of people who could afford a new computer but don’t see any reason to do so – if it still works, why worry?

If these people don’t use the internet, there is no real reason to upgrade. As long as they’re happy with their PC’s performance, don’t share files with anyone and don’t try anything clever with wireless networks then they should be reasonably safe to continue.

For now, you can still buy Windows 98-compatible firewalls and antivirus software, and the free Firefox web browser is also available from www.mozilla.org, so most internet risks can be reduced, even if you do want to browse the web and collect email safely using your old PC.

Radio 5 Live called me this month to find out if listeners should just buy a new Windows XP PC and have done with it. I wanted to say, “No, just keep your thirdparty security software up to date, install a different web browser and email client and it will be OK”. But buying a new PC is the easiest way forward. The fact that you can buy a reasonable Dell laptop for £399 makes the decision easier still.

HASTA LA VISTA

There is an argument that you should wait for Windows Vista to arrive before buying a new PC because, before you know it, Windows XP will be at the end of its life, too. But that means spending hours locking down your Windows 98 machine (and are you really sure you’ve done it right?) for just six months of operation before Vista supposedly arrives. Is it worth your time?

If you are very technically minded, you could install a Linux distribution on your old PC and breathe new life into it. You might even find it runs faster. You might also find you can’t get it working at all, but that’s all part of the fun.

The missus has a laptop that runs Windows 98. It’s a small, slim, silver machine that runs fast and performs the basic internet-based tasks for which it was bought. I am ashamed to admit that it doesn't even have a firewall or anti-virus software installed on it, although it does operate behind a hardware firewall.

It has never shown any symptom of viruses or spyware*, mainly because it is only used for about half an hour a week to check a Gmail account, which is scanned for viruses by Google. We discussed the options, including hardware upgrades and the Linux route.

This discussion was short, and I was made clearly aware that the way forward involved the minimum amount of time with the computer in pieces on the living room floor and the minimum number of late nights featuring me swearing at installation screens in the spare room.

We decided to buy a cheap £399 replacement laptop that will run Windows XP Home for the next few years. If you are one of the 70 million Windows 98 users out there, that is my advice to you, too.

* I am aware of how naive this sounds these days.

Future anti-virus support for Windows XP

Microsoft will no longer support Windows XP after April 2014. In an earlier article I outlined how XP users may secure their systems should they continue to use the obsolete operating system.

I mentioned that some anti-malware programs can help because they may prevent attackers from gaining entry through some of the security holes that are known to exist in Windows.

Many vendors support very old versions of their products. At the very least they provide signatures to customers running ancient scanners. If enough people continue to use Windows XP then those vendors will support them to some extent, even if they don't continue developing new detection and prevention technologies for Windows XP products.

Below is a list of anti-virus companies and the level of their stated commitment to Windows XP users. The following data is for consumer products only.

'Foreseeable future' means 2016 or later.

Vendor	July 2015	Mid-2015 or later	Foreseeable future
AVG			X
Avira			X
BitDefender		X
Bullguard			X
Checkpoint (ZoneAlarm)			X
ESET			X
F-Secure			X
G Data			X
Kaspersky Lab			X
Lavasoft (Ad-Aware)			X
McAfee			X*
Microsoft	X**
Panda Security			X
Symantec (Norton)			X
Trend Micro			X
Webroot	-	-	-

Last updated: 04/02/2014 1325 GMT

* Opinion, based on historical behaviour of this vendor when dealing with end-of-life operating systems.
** This support is available to users who install Microsoft Security Essentials up to April 2014, after which users will be unable to download the software.

Any vendors who are not represented above can contact me for inclusion in this chart. I will also be happy to update the above positions should they change.

The information above is based on publicly-available press material and discussions between myself and the vendors in question.

Secure Windows XP after updates end

Sticking with Windows XP? Here's how to secure your system to a reasonable standard.

We'll cover:

1. How attackers work.
2. The significance this has for Windows XP users who will no longer receive updates to their operating system.
3. Free solutions to help secure your PC.

2014/01/14: This article has been updated, correcting NetMarketShare figures regarding how many people use different versions of Windows. In practical terms there is little difference.

Microsoft will soon stop issuing security updates for Windows XP.

At the same time it will cease issuing updates for its anti-malware product (Microsoft Security Essentials) for Windows XP.

This is significant because a very large minority of PC users still have Windows XP installed. Should they buy a new Windows 8 PC or can they maintain a decent level of security once they are abandoned by Microsoft?

In April 2014 Microsoft will end support for Windows XP and its free anti-malware protection. However, in December 2013 29 per cent of Windows users were still running Windows XP.

To put things into perspective 44.5 per cent were running Windows 7 and only 11 per cent were running Windows 8 and Windows 8.1 combined. These figures are provided by NetMarketShare.

Clearly such a large number of people are not going to switch to Windows 7 or 8 in the next three months.

The following article explains what the threats are for Windows XP users, how they work and ways in which users can secure their old computers without having to upgrade the operating system.

How hackers do it

There are two common ways for hackers to attempt to gain access to desktop computers.

Social engineering

The first is so-called social-engineering, in which they trick victims into running a malicious program. This program may be designed to steal information, such as passwords, from the system. Let’s call this type of software ‘spyware’.

Alternatively the software might try to further trick or blackmail the victim, perhaps by claiming (ironically) that it has detected a malware infection or by locking the PC and demanding payment for releasing the system back into the user’s control. These types of threats are called ‘rogue anti-virus’ and ‘ransomware’ respectively.

For social engineering to work the user usually has to be convinced to run a program. If they are sufficiently convinced that they need to download and run a certain program (or insert a strange USB storage device) then they will probably carry on regardless of what their anti-virus program tells them.

Some may check themselves if they see a warning like, “This file is a Trojan. We recommend you should delete it.” but clearly enough users are fooled for the criminals to continue with this tactic.

No amount of patching Windows will change this situation so, for Windows XP users, this type of threat remains as significant (but probably no worse) as before.

Software exploitation

The second method is to gain access to the system using automatic attacks. These usually involve the victim visiting a website that contains some malicious code. This code, known as an exploit, runs on the target computer and gains a temporary level of control. It uses its new-found position of power to download and install malicious software, such as the aforementioned spyware, rogue security software and ransomware.

Automatic exploits only work because there are security holes, aka ‘vulnerabilities’, in the software on the victim’s computer. Vulnerabilities can exist in the applications that come included with Windows, such as Internet Explorer; in third-party applications such as Java, Flash and Adobe Reader; and even in hardware drivers (last month researchers published an exploit for Nvidia’s display driver).

If vulnerable software is updated to make it less vulnerable then exploits are less likely to work. For example, if you are still using Java version 6.x then your system is very open to attack because there are lots of known vulnerabilities for that software. Upgrading to the latest version 7.x will help, because there are fewer known vulnerabilities in the latest version of Java.

It is neither safe nor accurate to assume that any program has no vulnerabilities at all. Usually it’s just a matter of time before someone finds a new one. If a program is popular then there is more motivation for researchers to look for security holes because they affect the most number of potential victims.

Most popular exploits

It is hard to say whether attackers prefer to exploit vulnerabilities in Windows’ own files or those belonging to third-party software but, according to an update by the security blog Contagio, the exploit kits used by criminals in recent months seem very focussed on Adobe Reader, Adobe Flash and Oracle’s Java.

There are some exploits aimed at Internet Explorer 10 and earlier, many of which could affect Windows XP users. Switching from Internet Explorer to a browser that has continued Windows XP support (such as Google Chrome, Mozilla Firefox and Opera Software’s Opera browsers), and updating all other third-party applications would be a sensible move if you want to stick with Windows XP.

Updating automatically

Microsoft makes updating Windows reasonably convenient thanks to the Windows Update service. However, this does not usually provide updates for third-party software (although it does sometimes). Fortunately there is a free application that behaves in much the same way as Windows Update but for non-Microsoft programs.

Secunia’s Personal Software Inspector (SPI) will scan your PC for vulnerable applications and can automatically download and update those for which updates exist. You can also opt to have it download the updates but wait until you instruct it to install them, and you can even have it simply scan and inform you about available updates, rather than downloading anything.

How this affects users of Windows XP beyond April 2014

If Microsoft sticks to its plans then Windows XP will no longer receive security updates after April 2014. This means that any future vulnerabilities detected in Windows XP system files and the applications that come with it will remain unfixed. This appears to be great news for the attackers, who can locate security holes and use them without fear that their activities will be hindered by an impending fix.

The solution(s)

However, this is just one facet of the situation. Third-party applications and hardware drivers will still be updateable as long as their developers continue to provide support. Additionally, certain anti-malware software, including Kaspersky Internet Security and Symantec Norton Internet Security, are capable of detecting many types of exploits and can prevent them from taking control of the system.

I put together a list of anti-malware products that will continue to protect Windows XP after Microsoft withdraws support. Most, at the time of writing, were committed to the foreseeable future.

While Java is notoriously popular with hackers, you don’t need to remove it completely in order to secure your PC. You can keep Minecraft running happily on your system but simply disallow Java in the web browser.

There are at least five free and easy ways to protect against viruses and spyware. Windows XP users won’t be able to follow point #4 (i.e. update Windows) from that linked article but the rest are relevant for those sticking with XP.

Microsoft has a tool that helps to prevent the exploitation of vulnerabilities in its own software and those created by third parties. The Enhanced Mitigation Experience Toolkit is probably a little too tricky to use for everyday users but experts and the inquisitive can download it for free.

So while it is always best to fix the problem, by patching the security hole (or uninstalling the vulnerable application if you don’t need it!), there are ways to prevent the bad guys from gaining access even though the holes continue to exist.

Anti-virus testing conspiracy theories

Every time an anti-virus tester publishes a report the WildersSecurity internet forum buzzes with a mixture of responses ranging from conspiracy theory to logical reasoning (via understandable suspicion, disappointment and useful questioning).

A recent line of discussion following the latest Dennis Technology Labs report is no exception and includes some pretty direct accusations of corruption, as well as an increasing number of sensible replies.

I have posted my response on the forum, but here is a copy of my statement:

Hello everyone.

As usual I have enjoyed the discussion and would like to provide some feedback.

I appreciate that some people reading this thread have preconceived ideas, or even conspiracy theories, that will never be changed by anything that I write here. However, for the record, I would like to answer some of the questions, concerns and both direct and implied accusations that appear above.

Prior associations with Symantec, “money talks”. Dennis is a Symantec affiliate. Mock surprise that Norton comes top.

We have associations with most vendors through our involvement in AMTSO. We have provided services to companies including, but not limited to, McAfee, Trend Micro, Kaspersky Lab, ESET, AVG and Symantec.

We pride ourselves on our transparency and the ethical way in which we conduct our business. We have no secret affiliations with any customer.

One of the reasons the vendors like working with us is because our testing can provide a number of benefits. For example, if a product performs very well then the vendor’s marketing team are happy. However, if we discover a problem then the engineers are able to use the very detailed information that we log to fix that problem.

It would be of very limited use to everyone if we fixed the results to favour one vendor. Such cheating would be fairly obvious to the other vendors, and the favoured vendors would be unaware of problems with their products.

Assumption that most tests used internet malware

Absolutely, and this fact was made clear throughout the report, starting with the introduction. We expose the products to live (internet) web-based threats. Products that block malicious URLs thoroughly will do well, whereas those that rely solely on signatures and heuristics face a greater chance of being compromised.

DTL tests are not on a par with the major test labs

All test labs have different methodologies. It would be fairly pointless if we all worked in exactly the same way as we would be duplicating each other’s work.

Some testers concentrate on running vast number of samples through AV engines. We focus on investigating cases in forensic detail. This means that our sample numbers are much smaller than those found in on-demand tests. The workload is heavy and manual. It takes us six weeks to run a 100-sample test with 20 or less products.

Having said that, when other testers perform ‘real-world’ testing such as we specialise in, they also use small sample sizes that are comparable with ours.

The note that the test is unsponsored was an attempt to knock Wilder’s argument up front. Also, unsponsored is a matter of definition.

Important though your opinions are to us, we don't word our reports to pre-empt predictable controversies on Wilders. And as you can see, it would not work anyway . We include such details to ensure that everyone knows when a test is and is not sponsored. We try to be as transparent as possible.

Sometimes a customer will ask us to perform a test. This often happens at certain times of the year, such as in the summer when new products are launched. If we agree that the products in the list are fairly comparable we will consider running such tests. These, which are commissioned by the customer, are what we call ‘sponsored’ tests.

The regular quarterly testing is financed by subscribers, which we refer to as partner vendors. These companies support the test by paying a quarterly subscription fee. In return they are allowed certain privileges.

For example, if their product performs well then they are able to use our logos to promote their success. They also have an opportunity to review our logs to discover where problems may lie with their products.

Finally they have an opportunity to challenge our findings (for their own products). This means that, should they wish to argue with our findings, they can do so before we publish the report. This is why you sometimes see comments from a vendor in the report itself – perhaps explaining why they believe the product suffered some issues.

Neutralisation definition is vague: “What constitutes a running threat ? A malicious script that is terminated/blocked as soon as it starts, or some malware that is already active on the computer (e.g. running trojan)?”

A neutralisation occurs when a threat runs on the system but is unable to effect a significant change. As we log every process that runs on the test systems we know if a malicious process ran or not.

A script or Trojan that executes, but which is terminated soon after it starts, sounds like a classic example of a neutralisation in our test.

There is also a further granularity to this type of result. We have the possibility of partial or full remediation.

So if a script ran, was terminated and no changes were made to the system then that would be a neutralisation with full remediation. This means extra points.

However, imagine that a Trojan runs and sets itself up to survive a reboot using a Registry Run entry. The AV product detects the Trojan and removes it, but leaves the Registry entry in place. Or removes the Registry entry but leaves the Trojan file on the disk. That would be a neutralisation without full remediation.

The testing platform is outdated (Win XP) and runs vulnerable software. Hopes that Dennis will switch to Windows 7.

As we noted in the report, there are a lot of people still running Windows XP. According to the research that we’ve seen, just less than half of all Windows users are using XP.

As XP’s life is coming to an end, and Windows 7 has recently become dominant, we will switch to Windows 7 before the end of this year. You can expect one more XP-based report (2013 Q2) before we upgrade.

Regarding the use of vulnerable software, we pre-install it to give the security software a chance to protect the system.

To use an analogy: if we were testing car tyre safety we would not do so in optimum conditions. We'd have windy, wet roads. Similarly we use systems that are vulnerable to attack so we can judge how well the security software protects them.

Who are the partner vendors?

As I mention above, we work with all of the main AV vendors but I am not going to name the specific companies that form the partner vendor line-up.

In some cases you can easily tell, because you’ll see our logos on their marketing material. But in other cases either they may choose not to show the logos or, more likely, they may not achieve an award at all.

Desire for paid AVG.

We have tested the paid version of AVG in two earlier tests. There was a strong desire from readers to see free products and, as the paid-for and free versions of AVG *should* receive similar results it seemed sensible to test the free version only.

Why do I think that the free and paid-for versions should receive similar results? Because we are not currently testing email threats or sending malware and exploits over IM. Ours is a web-based test.

Default settings used?

With consumer products default settings are used. However, we disable each product’s ability to report its statistics and other telemetry home to the vendor. Also, we may increase the logging level if that helps us discover issues with the product.

In some cases we may extend the number of TCP ports that the product is allowed to scan for HTTP-based threats. This is because we use a range of ports when replaying the threat sessions.

More programs should have been tested

This consumer test includes nine very well-known products. At the same time we ran a small business and enterprise test, bringing the total number of products to 19.

This involves a vast amount of work and, while we could possibly squeeze a few more products in, it’s not a trivial matter. We hope that as more vendors support the test we'll be able to extend the number of products tested.

Adjusted testing procedures to give benefit to skew the test in favour of one or more products/vendors
We do not adjust our methodology in favour of any vendor or product. We will make small configuration changes if a vendor notes that its product is behaving differently in our environment than it would in the real world.

Our test setup is very close to being the same as many home and business users, but there are always compromises we have to take in order to expose the products to the same threats in the same way. Malicious sites don’t like being tested!

So when we encounter issues we address them to remain fair to all.

DTL tests are on a par with basic magazine tests and are not comparable with AV test labs’ work

Dennis Technology Labs is a testing business that resides within the media company called Dennis Publishing Ltd. We provide test data to magazines within Dennis and to magazines published by other companies.

We test anti-malware products constantly, using state of the art techniques and equipment. I don’t know of any magazine that would be able to summon resources even vaguely resembling the way we work.

As I mentioned above, we are focussed on realistic testing and ensuring that all results are accurately verified and recorded. We don’t run on-demand scans on millions of files like some testers do. We simply take a different approach.

That said, our results are not that different in terms of rankings, to those produced by the other major testers. This is pretty interesting considering our different testing approaches.

No regulation of testing groups

There is no regulation of anti-malware testing, just as there is no regulation of many industries. There is the Anti-Malware Testing Standards Organization, though. AMTSO brings together vendors and testers into a forum for (usually very robust!) discussion.

Dennis Technology Labs is proud to be a member of AMTSO, alongside almost all of the other major testing groups.

From my own, personal point of view, one of AMTSO’s great strengths is that it enables discussion between vendors, testers and anyone else interested enough to engage. It’s not a regulator but it is very influential.

Kaspersky anti-virus update breaks internet

An update to Kaspersky's anti-virus software broke internet connections for Windows XP users.

The issue came to light on Monday and affected both consumer and business versions of the security software running on Windows XP.

Kaspersky recommended that users disable the "Web AV" component of the software, clear previously-downloaded updates and then update afresh.

The company was quoted in its support forum as adding:

"After the update has been pushed to your workstations, please re-enable your Web AV component in your protection policy. This should resolve the issue."

Security advice can expire

Mark Russinovich has drawn my attention to some security advice just published on USA Today. It seems a little dated and is probably more appropriate for someone operating a PC in 1999, not 2013.

There are five sections, the third (security-related) one being related to, "3. The zombie spyware plague".

This makes reference to fake anti-virus malware, which is certainly a current threat, although less so than a couple of years ago.

The solution?

"... running a real antivirus program probably won't help. To stop the pop-ups, you must run an anti-spyware program. There are a number of good ones — I'd start with Ad-Aware."

I'd be interested to see why author Kim Komando thinks that "real antivirus" software can't remove malware, while Ad-Aware can. Especially as Ad-Aware is a real anti-virus product.

It didn't used to be, though. Back in the late 1990s Ad-Aware was labelled as an anti-spyware tool. It was much more limited than fully-featured anti-malware suites. That said, it was often better than regular anti-virus software when handling certain types of threats, such as information-stealing malware like modem diallers.

It is now described by its developer Lavasoft as, "super fast anti-virus combined with our legendary anti-spyware".

The distinction between anti-virus and anti-spyware no longer exists, and has not done so for years.

Anti-malware vendors cannot afford to ignore certain specific types of internet threat, such as Trojans, diallers and so on. They use the umbrella term "anti-virus" just to keep things simple for normal users.

Ad-Aware looks like an effective anti-malware (anti-virus) tool. It's certainly scored well in AV-Test and Virus Bulletin tests in the past.

Registry backups

The initial section, which includes advice on using a tool to clean the Registry, contains the advice of:

"Just make sure you allow it to backup the registry before making changes."

It's a small point but I'd probably want to back up the Registry manually, rather than rely on the tool that could cause the corruption in the first place.

How do you do that on a PC running any version of Windows later than Windows 98?

The author does not tell you how, but the answer is usually to use System Restore. The Windows Backup tool does not make a copy of the Registry, so don't rely on that.

For more information on backing up the entire Registry for your version of Windows, use the following links:
Windows XP
Windows 7
Windows 8 (it appears to be the same as for Windows 7, above)

This Wikipedia entry examines some further Registry backup options.