munna

does any body know the name of some software that can stop people on the network using Key loggers and other hacking tool's?
it is to be Used on NT Server 4.0

I run a network full of little kids(The eldest being 18 year old's!!..FEMALE and Male!!)...

Jeff Wiltshire

[Edited by Jeff Wiltshire - 3/7/2002 8:54:43 PM]

ChristianR

iTrader: (1)

we use a product called ranger.

stevem2k

This works

http://www.heavyhitter.com/osb/itemdetails.cfm/id/2



SteveM

Jeff Wiltshire

If only....

munna

Jeff...will e-mail you tomorrow.

i have something called LANfile check

i will see if it works

JackClark

Not much defence against a hardware key stroke logger. If I can access the keyboard port on your machine I can get you password.

David_Wallis

Use strong encryption on the sam for a start... run the utility mshfnetchk.exe and ensure that you are hotfixed properly... remove applications from the DC's that dont need to be there... IIS...
Dont bother securing floppy drives... remove them... Remove the com ports... or disable them in the bios as you can get in via them.. Run the Network Monitor agent only where absolutely necessary.

I had the following info on lophtcrack... (ensure you are on sp4&gt I would hope you are otherwise it's pointless anyway... Becareful if you use windows 95 / 98 Clients.

L0phtCrack has a built-in SMB session network sniffer. The sniffer allows an individual to collect LANMAN challenge/response pairs without needing administrator rights.

Windows NT supports two types of challenge/response authentications, LanManager (LM) challenge/response, and Windows NT challenge/response. LM is the weaker of the two challenge/response methods.

Apply a registry parameter to the following registry key which must be configured on both the Windows NT server and workstation:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\contro l\LSA
Value: LMCompatibilityLevel
Value Type: REG_DWORD
Valid Range: 0,1,2

Default: 0

The valid range parameters specify the type of authentication to be used as follows:

Level 0 Send LanManager and Windows NT authentication (default).

Level 1 Send Windows NT authentication and LM authentication only if the server requests it.

Level 2 Never send LM authentication.
If the range on Windows NT is level 2, the NT client cannot connect to servers that support only LanManager authentication, such as Windows 95 and Windows for Workgroups. NOTE: If the last password change came from a Windows for Workgroups or MS-DOS LanManager 2.x or earlier client, the data needed for Windows NT authentication will not be available on the domain controller. Therefore, a client selecting level 2 will not be able to connect to Windows NT-based servers.

also Pagefile.sys

Windows NT uses PAGEFILE.SYS when swapping pages of memory to disk. This file contains clear text data from applications and system processes. When Windows NT is operating, PAGEFILE.SYS is opened only by Windows NT. However, when Windows NT is powered off, the system can be booted by another operating system (in a dual-boot environment), by a bootable floppy diskette, or even from a multiple-boot hard disk partition. This is a concern as utilities such as NTFSDOS are available that allow an individual to read or download information found on a NTFS partition, including PAGEFILE.SYS. Also, in an environment running under Novell NetWare this problem is of even greater concern. NetWare writes user names and passwords to this file in plain text. Windows NT can be instructed to fill all inactive memory pages in the page file with zeros. No data will be left in the file when it is no longer in use by Windows NT. The memory pages that are active by Windows NT (may be used by the system) processes will not be overwritten. Note that this method will only work if the Windows NT system was shut down properly. Also, ensure your server is properly physically secure. The key is as follows:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SessionManager\MemoryManagement
Value: ClearPageFileAtShutdown
Type: REG_DWORD
Data: 1 (0 to disable)

And theres more...

David

David_Wallis

I meant to also say dont under estimate little kids.. I was a bast@rd at 15... and could hack into school networks and did...

David

Ga22ar

Simple,..

If they have physical access to the machine(s) your're f##cked..

No amount of auditing/monitoring/sniffers/IDS is going to safeguard any machine if it is within the public domain..

Your only hope is to somehow hide the system unit and practice good security rules - ie never log on interactively to these machines with a admin account, screw down the reg, prevent any caching of profiles or credentiails etc etc..

There used to be a good joke that the only way NT could be C2 classified is if it was not connected to a network and it was switched off.... funny how humour reflects reality sometimes..

cheerio

akshay67

First step is to harden these machines and set acl's on critical files (e.g. cmd.exe). Hardening scripts are available from all over the net - I put my own one together as you don't want to compromise too much functionality.

Secondly, give these kids accounts with restricted access rights - i.e. they shouldn't really need to install software etc.

And remember...security is a process, so you may need to create an awareness plan - e.g. get these students to follow policies and and breach will lead to the cane or whatever.

munna

wow...what a response...the last time security was breached was using a key logger!!..that was before my time
MR wallis I was supposed to mail you today..but got caught up in traffic!!(of the network kind!!)
will be in contact on monday..

cheers chaps

munna

the server's are going to be in a secure room during the easter hol's
at the moment they are sitting in a class room!!(The most secure environment ever!.

I will start doing what has been said...

akshay67

are they accessible over a network?

'cos someone may be able to access them remotely. If I were you, I'd take them off any link to external networks.

ChristianR

iTrader: (1)

as already mentioned, I would recommend a product called Ranger - Very good and highly recommended.

Ga22ar

Get hold of the NSA docs on System security, will indicate what is best practice and will also indicate what should be locked down by acl/reg/services etc etc..

Weighty reading but worth it..

cheerio

munna

ChristianR..where is this Ranger website?