2KKUU7ita

Chapter 10: Mobile Devices
You have the option to reset the local administrator (or other) password or
have it crack all passwords. It’s really that simple, and it’s highly successful,
even on the latest operating systems, such as Windows 8. The most difficult
and time-consuming thing about Elcomsoft System Recovery is downloading
and burning it to CD.
You can also use another proven tool for Windows called NTAccess (www.
mirider.com/ntaccess.html) for resetting local Windows accounts.
This program isn’t pretty or fancy, but it does the job. As with ophcrack
(discussed a little later in this section), Elcomsoft and NTAccess provide
an excellent way to demonstrate that you need to encrypt your laptop hard
drives.
People will tell you they don’t have anything important or sensitive on their
laptops. They do. Even seemingly benign laptops used for training or sales
can have tons of sensitive information that can be used against your business.
This includes spreadsheets that users have copied from the network to work
on locally, VPN connections with stored login credentials, web browsers that
cache browsing history, and, even worse, website passwords that users have
chosen to save.
After you reset or crack the local administrator (or other) account, you
can log in to Windows and have full access to the system. By simply poking
around, you can find sensitive information, remote network connections,
and cached web connections to demonstrate the business risk. If you
want dig even deeper, you can use additional tools from Elcomsoft (www.
elcomsoft.com/products.html), such as Elcomsoft Internet Password
Breaker, Proactive System Password Recovery, and Advanced EFS Data
Recovery for uncovering additional information from Windows systems.
Passware (www.lostpassword.com) offers similar commercial tools as well.
If you want to perform similar checks on a UNIX or Linux-based laptop, you
should be able to boot from a Knoppix (www.knoppix.net) or similar “live”
Linux distribution and edit the local passwd file (/etc/shadow) to reset or
change it. Remove the encrypted code between the first and second colons
for the “root” (or whatever user) entry or copy the password from the entry of
another user and paste it into that area.
If you’re budget-strapped and need a free option for cracking Windows passwords,
you can use ophcrack as a standalone program in Windows by following
these steps:
1. Download the source file from http://ophcrack.sourceforge.net.
2. Extract and install the program by entering the following command:
ophcrack-win32-installer-3.4.0.exe (or whatever the current
filename is)
187