Re: How is the ASPNET password managed?

From: Scott Allen (bitmask_at_[nospam)
Date: 08/30/04 

Date: Mon, 30 Aug 2004 14:26:56 -0400

User account passwords are kept as a hash, but I don't believe local
service account credentials are stored with a one way algorithm. A
service needs to remember it's password to authenticate against an
authority just like a user does. In NT 4 this was a vulnerability for
a time as the passwords were stored in plaintext (encoded, essentially
plaintext), and it was easy to find tools to dump the service account
passwords even though the registry keys were restricted to the system
account. Since NT4 the SAM et al is encrypted. 

--
Scott
http://www.OdeToCode.com
On Mon, 30 Aug 2004 10:29:53 -0500, "Cowboy \(Gregory A. Beamer\)
[MVP]" <NoSpamMgbworld@comcast.netNoSpamM> wrote:
>It is system created and uses a one-way algorythm. You can set the password
>yourself, if you wish (machine.config file). There is also an
>IUSR_ComputerName account for IIS, which you can control, if you so desire.
>In most instances, it is better to let the machine control both. If the
>pwd(s) are compromised, the machine is already owned by someone else.

Relevant Pages

  • Re: Account lockouts
    ... for reusable passwords and the AAA infrastructures that rely upon them? ... In that context, account lockout policy -- duration, threshold, lockout ... > cracking attacks. ...
    (microsoft.public.security)
  • Re: Deleting Admin Account
    ... administrative level account to change the Type of the Admin account ... created to a limited account (or create yourself a third account - non-admin ... The built-in administrator cannot be changed from the administrative level, ... You should password protect (with different passwords would be best) each ...
    (microsoft.public.windowsxp.setup_deployment)
  • Re: Blank Passwords, Complex Requeirements and Problems...
    ... The account would then have: 544 = normal account with "Password Not Required" bit = on ... wellKnownObjects: B:32:6227F0AF1FC2410D8E3BB10615BB5B0F:CN=NTDS ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... As far as i know, the Win2003 AD never had a "free" Default Domain Policy to allow that, the DDP is the Default since the initial build of th AD. Ok, let's say that an Admin disabled temporarily th DDP for a few moments and allowed certain accouns to be created with blank passwords. ...
    (microsoft.public.win2000.active_directory)
  • Re: OT: dealing with keystroke loggers
    ... what's the practical solution to deal with s/w keystroke loggers ... Researcher refutes Microsoft's account of hijacked Hotmail passwords ... passwords were obtained in a massive phishing attack. ... "Everyone who suspects that their account has been compromised should ...
    (alt.sys.pc-clone.dell)
  • RE: Threat vector of running a service using a domain account
    ... Cachedumps are for local logon password dumps. ... Lsadumps retrieve the passwords in plaintext (each char. ... Cachedump, which again, doesn't work so well against the latest versions ... Threat vector of running a service using a domain account ...
    (Security-Basics)
Loading