Choosing your tools

My favorite tool to demonstrate the risks associated with unencrypted laptops running Windows is ElcomSoft System Recovery (www.elcomsoft.com/esr.html). You simply burn this tool to a CD and use it to boot the system you want to recover (or reset) the password from, as shown in Figure 11-1.

You have the option to reset the local administrator (or other) password or have it crack all passwords. It’s really that simple, and it’s highly successful, even on the latest operating systems, such as Windows 8.1 or Windows 10. The most difficult and time-consuming thing about ElcomSoft System Recovery is downloading and burning it to CD.

You can also use an older tool for Windows called NTAccess (www.mirider.com/ntaccess.html) for resetting local Windows accounts. This program isn’t pretty or fancy, but it does the job. There are others available as well. As with ophcrack (discussed a little later in this section), ElcomSoft and NTAccess provide an excellent way to demonstrate that you need to encrypt your laptop hard drives.

People will tell you they don’t have anything important or sensitive on their laptops. They do. Even seemingly benign laptops used for training or sales can have tons of sensitive information that can be used against your business. This includes spreadsheets that users have copied from the network to work on locally, VPN connections with stored login credentials, web browsers that have cached browsing history, and even worse, website passwords that users have chosen to save.

After you reset or crack the local administrator (or other) account, you can log in to Windows and have full access to the system. By simply poking around using WinHex (www.winhex.com/winhex) or similar or AccessEnum (https://technet.microsoft.com/en-us/library/bb897332.aspx), you can find sensitive information, remote network connections, and cached web connections to demonstrate the business risk. If you want to dig even deeper, you can use additional tools from ElcomSoft (www.elcomsoft.com/products.html), such as ElcomSoft Internet Password Breaker, Proactive System Password Recovery, and Advanced EFS Data Recovery for uncovering additional information from Windows systems. Passware (www.lostpassword.com) offers many similar commercial tools as well.

If you want to perform similar checks on a Linux-based laptop, you should be able to boot from a Knoppix (www.knoppix.net) or similar “live” Linux distribution and edit the local passwd file (often /etc/shadow) to reset or change it. Remove the encrypted code between the first and second colons for the “root” (or whatever user) entry or copy the password from the entry of another user and paste it into that area. Passware Kit Forensic can be used to decrypt Mac OS X systems encrypted with FileVault2.

If you’re budget-strapped and need a free option for cracking Windows passwords, you can use ophcrack as a standalone program in Windows by following these steps:

1. Download the source file from http://ophcrack.sourceforge.net.

2. Extract and install the program by entering the following command:

   ophcrack-vista-livecd-3.6.0.exe (or whatever the current filename is)

3. Load the program by starting the ophcrack icon from your Start menu.

4. Click the Load button and select the type of test you want to run.

   In this example, shown in Figure 11-2, I’m connecting to a remote server called server1. This way, ophcrack will authenticate to the remote server using my locally logged-in username and run pwdump code to extract the password hashes from the server’s SAM database. You can also load hashes from the local machine or from hashes extracted during a previous pwdump session.

   The extracted password hash usernames will look similar to those shown in Figure 11-3.

5. Click the Launch icon to begin the rainbow crack process.

   If you see that password hashes are only in the NT Hash column as shown in Figure 11-3, you’ll need to make sure you have downloaded the proper hash tables from http://ophcrack.sourceforge.net/tables.php or elsewhere. A good one to start with would be Vista special (8.0GB). In order to load new tables, you click the Tables icon at the top of the ophcrack window as shown in Figure 11-4.

If necessary, relaunch the rainbow crack process in Step 5. The process can take just a few seconds to several days (or more) depending on your computer’s speed and the complexity of the hashes being cracked.

There’s also a bootable Linux-based version of ophcrack (available at http://ophcrack.sourceforge.net/download.php?type=livecd) that allows you to boot a system and start cracking passwords without having to log in or install any software.

I highly recommend you use ophcrack’s LiveCD on a sample laptop computer or two to demonstrate just how simple it is to recover passwords and, subsequently, sensitive information from laptops that don’t have encrypted hard drives. It’s amazingly simple, yet people still refuse to invest money in full disk encryption software. ElcomSoft System Recovery is another great tool for this exercise.

Countermeasures

The best safeguard against a hacker using a password reset program against your systems is to encrypt your hard drives. You can use BitLocker in Windows, WinMagic SecureDoc (www.winmagic.com/products), or other preferred product for the platform your systems are running on.

Power-on passwords set in the BIOS can be helpful as well, but they’re often a mere bump in the road. All a criminal has to do is reset the BIOS password or, better yet, simply remove the hard drive from your lost system and access it from another machine. You also need to ensure that people can’t gain unauthorized physical access to your computers. When a hacker has physical access and your drives are not encrypted, all bets are off. That said, full disk encryption is not foolproof — see the nearby sidebar, “The fallacy of full disk encryption.”

Cracking iOS passwords

I’d venture to guess that many phone and tablet passwords (really, they’re just 4-digit PINs, or passcodes) can be guessed outright. A mobile device gets lost or stolen and all the person recovering it has to do is try some basic number combinations such as 1234, 1212, or 0000. Soon, voilà! — the system is unlocked.

Many phones and tablets running iOS and Android are configured to wipe the device if the incorrect password is entered X number of times (often 10 failed attempts). A reasonable security control indeed. But what else can be done? Some commercial tools can be used to crack simple passwords/PINs and recover information from lost or stolen devices or devices undergoing a forensics investigation.

ElcomSoft’s iOS Forensic Toolkit (http://ios.elcomsoft.com) provides a means for demonstrating just how easily passwords/PINs on iOS-based phones and tablets can be cracked up through iOS version 7. Here’s how:

1. Plug your iPhone/iPod/iPad into your test computer and place it into Device Firmware Upgrade (DFU) mode.

   To enter DFU mode, simply power the device off, hold down the Home button (bottom center) and sleep button (often the upper right corner) at the same time for 10 seconds, and continue holding down the Home button for another 10 seconds. The mobile device screen goes blank.

2. Load the iOS Forensic Toolkit by inserting your USB license dongle into your test computer and running Tookit.cmd.

   You see the screen shown in Figure 11-5.

3. Load the iOS Forensic Toolkit Ramdisk onto the mobile device by selecting option 2 LOAD RAMDISK.

   Loading the RAMDISK code allows your test computer to communicate with the mobile device and run the tools needed for cracking the password (among other things).

4. Select the iOS device that’s connected, as shown in Figure 11-6.

   I selected option 14 because I have an iPhone 4 with GSM.

   You now see the toolkit connect to the device and confirm a successful load, as shown in Figure 11-7. You should see the ElcomSoft logo in the middle of your mobile device’s screen as well.

5. To crack the devices password/PIN, simply select option 6 GET PASSCODE on the main menu.

   iOS Forensic Toolkit will prompt you to save the passcode to a file. You can press Enter to accept the default of passcode.txt. The cracking process will commence and, with any luck, the passcode will be found and displayed as shown in Figure 11-8.

   So, having no password for phones and tablets is bad, and a 4-digit PIN such as this is not much better. User beware!

   You can also use iOS Forensic Toolkit to copy files and even crack the keychains to uncover the password that protects the device’s backups in iTunes (option 5 GET KEYS).

   Using ElcomSoft’s iOS Forensic Toolkit to crack iOS versions 8 and up won’t be quite as fruitful for now as Apple has finally started to really lock down the operating system. Apple iOS is still not without its flaws. As recently as iOS 9, there was an exploit that allowed attackers to bypass the login screen altogether.

   If anything, you need to be thinking about how your business information, which is most certainly present on phones and tablets, is going to be handled in the event one of your employee’s devices is seized by law enforcement personnel. Sure, they’ll follow their chain-of-custody procedures, but overall, they’ll have very little incentive to ensure the information stays protected in the long term.

Be careful with how you sync your mobile devices and, especially, where the file backups are stored. They may be off in the wild blue yonder (the cloud), which means you have no real way to gauge how secure the personal and business information truly is. On the other hand, when synched files and backups are stored without a password, with a weak password, or on an unencrypted laptop, everything is still at risk given the tools available to crack the encryption used to protect this information. For instance, ElcomSoft’s Phone Breaker (www.elcomsoft.com/eppb.html) can be used to unlock backups from BlackBerry and Apple devices as well as recover online backups made to iCloud and Windows Live!.

Oxygen Forensic Suite (www.oxygen-forensic.com) is an alternative commercial tool that can be used for cracking iOS-based passwords as well as additional recovery functionality for Android-based systems. Figure 11-9 shows the Oxygen Forensic Suite interface and types of information that can be extracted from an Android-based device. The Oxygen Forensic Suite Extractor tool can connect and extract this information relatively quickly — something that can, of course, be used against your organization when mobile devices are lost or stolen.

Oxygen Forensic Suite is also great for performing security assessments of mobile apps, which I cover in Chapter 15.

Countermeasures against password cracking

The most realistic way to prevent such password cracking is to require — and continually enforce — strong passwords such as multi-digit PINs consisting of 5 or more numbers or, better yet, complex passphrases that are very easy to remember yet practically impossible to crack such as Progressive_r0ck_rules!. MDM controls can help you enforce such a policy. You’ll likely get pushback from employees and management, but it’s the only sure bet to help prevent this attack. I cover getting buy-in for your security initiatives in Chapter 20. Good luck!