RE: Identifying Win2K/XP Encrypted Files

From: Nathan Yocom <nate(at)yocom.org>
Date: Thu Jan 30 2003 - 10:55:57 EST

I believe that is correct, however, it may be possible to effect such a change with a replacement GINA. Simply boot from something with NTFS drivers and replace %SYSTEM32%\MSGINA.DLL with a custom one.

The GINA interface runs with system privledges, and as such, can change passwords without knowledge of the old. If anyone would like a sample GINA, let me know and I can look into throwing one together.

Nate Yocom
Portland, ME

On Thu, 2003-01-30 at 09:44, Burnette, Michael wrote:
> This method no longer works on the XP implementation of EFS, right? In order for an original account or recovery agent to retain the ability to decrypt previously encrypted files, the password change must be made from within the host OS. Someone correct me if I'm wrong.

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Thu Jan 30 14:05:26 2003