Windows NT Security Cunsheng Ding HKUST, Hong Kong, CHINA C. Ding - PowerPoint PPT Presentation

Windows NT Security Cunsheng Ding HKUST, Hong Kong, CHINA C. Ding - COMP4631 - L20 1

Agenda • Brief information about Windows NT • Security architecture • Identification and authentication • Access control • Administration C. Ding - COMP4631 - L20 2

Security Architecture C. Ding - COMP4631 - L20 4

Security Architecture • The core operating system service is the Windows NT executive . • User programs make application program interface (API) calls to invoke operating system services. • Two modes: user and kernel modes – User programs (user mode) – Operating system services (kernel mode) C. Ding - COMP4631 - L20 5

Windows NT : kernel vs user mode System Processes Services Applicatio ns Subsystems OS/2 User WinLogon Alerter Application User Win32 Subsystem DLLs Mode System NTDLL.DLL ( NT Layer DLL that control NT system functions ) Threads Executive API Kernel Mode I/O Manager Processes Virtual Cache PnP/Power Security Manager & Threads Memory Manager File systems Object management / Executive RTL Device drivers Kernel Hardware Abstraction Layer (HAL) Hardware interfaces (read/write port, timers, C. Ding - COMP4631 - L20 clocks, cache control, etc.) 6

Security Subsystems • Security Reference Monitor (SRM): – in charge of access control, – an executive component running in “kernel mode”. • Local Security Authority (LSA): – a user mode component involved at login when it checks the user account and creates a system access token (SAT). – the LSA is also responsible for auditing functions. C. Ding - COMP4631 - L20 7

Security Subsystems ctd. • Security Account Manager (SAM): – A user mode component that maintains the user account database used by the LSA – It provides user authentication for the LSA. Winlogon LSA SAM account data base C. Ding - COMP4631 - L20 8

The Registry • It is the central database for Windows NT configuration data. • Entries in the registry are called keys (not be confused with cryptographic keys). • It is a hierarchical database. At the top level, the registry is structured into four sections called hives (or root keys) . Hives contains keys (directories) which in turn contain subkeys (subdirectories) or data items C. Ding - COMP4631 - L20 9

Protection of the Registry • The registry is stored in a proprietary format. • Only the operating system tool Registry Editor can modify the registry. • Protection: remove the Registry Editor from all machines NOT used for system management. C. Ding - COMP4631 - L20 10

Registry File Permissions • Defining access permissions: – use access control lists for hives and keys. • Possible access permissions: – read only: not allowed to make any changes. – full control: edit, create, delete, take away ownership of a key. – special access: users can be granted permissions according to a specified list, i.e., discretionary ACLs . C. Ding - COMP4631 - L20 11

A List of Special Access (1) • Create subkey : create a new subkey within an exiting key • Enumerate keys : identify all subkeys within a key • Notify : receive audit notification generated by the key C. Ding - COMP4631 - L20 12

A List of Special Access (2) • Delete : delete a key • Wr Write DAC : modify the access control list for the key • Write owner : take ownership • Read control : read security information from within the key C. Ding - COMP4631 - L20 13

The Registry in Summary • Hardware configuration • Account data • Software, servers, services • Network configuration, host name, IP address • Description of user’s desktop • Critical to security – Repository for local security data – Access control built in C. Ding - COMP4631 - L20 14

Identification and Authentication C. Ding - COMP4631 - L20 15

Identification and Authentication • Authentication: user name + password – Windows NT 5.0 uses Kerberos for authentication • Implementation: towards networks of servers and workstations C. Ding - COMP4631 - L20 16

Logging on to Windows NT 4.0 • Security Attention Sequence (SAS) - CTRL+ALT+DEL – Eliminates the possibility of Trojan Horses – Handled by WinLogon, which loads GINA to authenticate user – Authentication against local SAM or domain controller’s SAM • GINA: a remotely controllable Logon Graphical User Interface C. Ding - COMP4631 - L20 17

Interactive logon to the machine Winlogon in Windows NT 4.0 1. CTRL + ALT + DEL Winlogon Win32 5. 4. Access token GINA LSA 6. 3. 2. SAM Shell Account DB C. Ding - COMP4631 - L20 18

Windows NT Password Scheme • Passwords are stored in encrypted form. • Two encrypted passwords are computed, one for the Microsoft LAN Manager, the other one for Windows NT. • To prevent users adopting weak passwords, a password filtering dynamically linked library (DLL) can be installed. • The password filter forces the password to have at least six characters. C. Ding - COMP4631 - L20 19

Windows NT Password Scheme • Passwords must contain at least three of the following four data types: upper case letter, lower case letter, Arabic numerical, and non-alphanumeric character. • Passwords cannot contain parts of the username. • The encrypted passwords are stored in the user accounts which are held in the SAM database. The SAM database is part of the registry. C. Ding - COMP4631 - L20 20

The LAN Manager Password • It is encrypted and can be retrieved from the ciphertext stored in the SAM database. – Detailed encryption algorithm is not given here. • Passwords can be up to 14 characters long. C. Ding - COMP4631 - L20 21

The Windows NT Password • It is hashed using a one-way function (MD4). • It cannot be retrieved from the hash value stored in the SAM database. C. Ding - COMP4631 - L20 22

Access Control to Objects C. Ding - COMP4631 - L20 23

Domain • Domain: a collection of machines sharing a common user accounts database, and security policy. • Advantage : you do not need an account in every workstation. • Windows NT uses domains to facilitate single sign-on and coordinated security administration. C. Ding - COMP4631 - L20 24

Domain Controller • A domain controller (DC) is a server computer that responds to security authentication requests within a computer domain. • It is a server on a network that is responsible for allowing host access to domain resources. • It authenticates users, stores user account information and enforces security policy for a domain. C. Ding - COMP4631 - L20 25

User Accounts • Each user needs a user account in a domain. – The master copy of the user accounts database for the domain is held on a server called the primary domain controller (PDC). – Copies of it are held on a backup domain controller (BDC). • Access to any network resource is solely based on the user account. C. Ding - COMP4631 - L20 26

Fields in a User Account • user name (login) • full name • password : – up to 14 characters long. – You can force users to change their password at the next login. – You can prevent them from changing their passwords. – You can set an expiry date on passwords. C. Ding - COMP4631 - L20 27

Fields in a User Account ctd. • User profile path: – the profile defines the user’s desktop environment, i.e., program group, network connections, screen colors, etc. • Home directory : – you can specify whether the home directory is on the local machine or on a network server. • Expiration date : – by default, accounts do not have an expiration date. C. Ding - COMP4631 - L20 28

Security Identifiers • Every user, group, and machine account has a unique security identification number (SID), which is used for discretionary access control . • The SID is constructed when the account is created, and is fixed for life time. • When a workstation or server joins a domain, it receives a SID that including the domain’s SID. Machines need their SID to check whether they are in the same domain. C. Ding - COMP4631 - L20 29

NT Executive – object oriented • Object is anything that needs naming, sharing, protecting w.r.t. user-mode processes. Object Types (Example) Object Types (Example) • Process • Devices • File • Network shares • Access token • NT services • (Registry) Key • Printers • Memory section • timers • Events C. Ding - COMP4631 - L20 30

Security Descriptor of Each Object It contains: • the security ID of the owner of the object • a group security ID • a discretionary access control list , its entry may be: – AccessDenied, AccessAllowed, SystemAudit • a system access control list , what to write to security audit trial C. Ding - COMP4631 - L20 31

Access to Windows NT Objects Access Token Security ID:S-1-5-21-146... User Name: MichaelW Group IDs: Employees Scientists EVERYONE LOCAL Read INTERACTIVE Other Information: . . File Object Access Control List . . Allow Deny Allow Security Scientists MichaelW Employees Descriptor . Execute All Read, Write . C. Ding - COMP4631 - L20 32

Administration (Security Management) C. Ding - COMP4631 - L20 33