Utilman.exe command prompt hack prevention?

Question

This trick to hack windows and reset passwords(or create new logins)has been around for ages and still works on windows 7 and windows 8. Is there any way to disable the key combination that brings up the 'Ease of access' dialogue box WindowsKey+U?

I've got other safeguards in place like full disk encryption and a locked down BIOS so people can't boot CD so easily, but those are possible to circumvent with relative ease, especially if I leave my computer turned on and running unattended for long periods of time.

If the BIOS is locked down, how would someone boot from a DVD/USB? — AdnanG, Sep 17 '13 at 04:37
@AdnanG reset the Bios with the convenient button on the back of my motherboard, or one of the additional 2 ways to do it from inside my case. — NULLZ, Sep 17 '13 at 06:59

score 9 · Accepted Answer · answered Sep 17 '13 at 06:55

You're very wrong in your last assumption; full disk encryption is not "possible to circumvent with relative ease". It is especially not "possible to circumvent with relative ease" to reach the goal of this workaround IF you're behaving securely.

As you've probably figured out by now, this is a physical-access problem. If somebody has physical access to your machine, they don't really need the utilman.exe trick. They can simply modify your SAM file. In this case, they went with a less technical method. Nevertheless, they're both possible through the same vulnerability - unauthorized physical access.

Assuming you're using full-disk encryption solutions like TrueCrypt, let's examine the two possible scenarios:

You left your computer turned off and unattended for ages: The attacker won't be able to do anything to modify the structure of your files (copy cmd.exe as utilman.exe) or modify your SAM file.
You left your computer locked: A determined adversary can eventually (although not easily) recover your encryption keys and access/modify your system, including but not limited to the trick you mentioned and modifying the SAM file.

As you can see, any unauthorized full access will lead to the, expected, compromise of your system. The utilman.exe is not your problem. You're looking into the wrong corner.

score -1 · Answer 2 · edited Sep 17 '13 at 07:15

-1

Application specific group policies or local policies might be your answer.

See this link for details.

edited Sep 17 '13 at 07:15

NULLZ

11,426
17
77
111

answered Sep 17 '13 at 01:41

Justin

9
2

Actually, this is wrong. This prevents that specific exe from running, but if you replace it with another .exe it will not apply those permissions. – NULLZ Sep 17 '13 at 07:15

Utilman.exe command prompt hack prevention?

2 Answers2