RE: Protect folder data.

SANS has an excellent white paper on the mechanisms and flaws in Win2K EFS:

http://rr.sans.org/win2000/EFS_sec.php

Steve Velazquez
CISSP, LPIC1, MCSE, CCNA -----Original Message-----
From: Nero, Nick [mailto:Nick.Nero@disney.com] Sent: Tuesday, November 26, 2002 1:59 PM To: dennis; security-basics@securityfocus.net Subject: RE: Protect folder data.

Yep, you are correct. It is RC4-40bit, I believe. Problem is, it is NOT just password protected. It uses a mini-PKI (unless you have a real PKI) and only that user's cert or the admin's can recover it. If both certs are lost, so is your data.

As a side, the laptop recovered last fall by a reporter from CNN that was formally a computer used by Al-Qaeda had the hard drives encrypted with Win2k EFS. The FBI was able to brute force the 40bit keyspace in a week and discover the data!

Nick Nero
CISSP, MCSE, CCNA -----Original Message-----
From: dennis [mailto:dennis@unixqi.com] Sent: Tuesday, November 26, 2002 4:23 AM To: security-basics@securityfocus.net
Subject: Re: Protect folder data.

Doesn't Win2K's encrypted file system support this? Sorry if I'm wrong, not a Windows kinda guy.

• Original Message ----- From: "Shane Lahey" <s.lahey@roadrunner.nf.net> To: <tony572000@hotmail.com>; <security-basics@securityfocus.net> Sent: Friday, November 22, 2002 10:29 AM Subject: RE: Protect folder data.

> Why not try Blowfish Advanced CS , available at http://come.to/hahn

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

> no one but
admin
> or
> desk top support person can not figure out a way to get to the data.
Received on Thu Nov 28 15:20:44 2002