Protect Your Passwords

Other Password Risks
Notification packages are a double-edged sword. Rogue notification packages can collect password changes for intruders, and NT's default configuration makes such an attack a little easier. The multistring Notification Packages Registry value in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa key specifies which notification packages a system sends when its passwords change. The default permissions for this key limit set value access to administrators and the System Account. However, this limitation doesn't necessarily mean that intruders need access to the key and the file system to load a rogue notification package. By default, NT includes in the value a notification package that doesn't exist on many systems. NetWare's File and Print Services and Directory Service Manager rely on the Fpnwclnt notification package for password synchronization between NT and NetWare. NT includes fpnw.dll in the Notification Packages value regardless of whether you are running the NetWare services that require it. This hole in NT's security means that a hacker can install a password-collecting .dll by putting it in the server's .dll search path. To protect your network, remove fpnw.dll from the Notification Packages value if you don't use it and check permissions on the Lsa key and for the directories that your system path environment variable specifies. (For more information about this security problem, see Microsoft Support Online article Q99885, "Security Issues Occur Due to How WinNT Handles FPNW-CLNT.DLL," at http://support.microsoft.com/support/kb/articles/q99/8/85.asp.)

In addition, NT versions before SP3 support all dialects of SMB, including one that sends passwords in clear text. A hacker on a rogue server can request that NT send a clear-text password, and NT complies. SP3 adds the EnablePlainTextPassword value to the HKEY_ LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rdr\Parameters key. EnablePlainTextPassword's default value is 0, which tells SMB not to send passwords in clear text.

Fundamental Changes
NT passwords' fundamental weaknesses lie in the features that enable compatibility with other OSs. You can compensate for these weaknesses by using Syskey, disabling LM authentication over the network, and ensuring that your users select quality passwords. The second two options increase security but reduce a network's compatibility with non-NT clients and servers.

Hackers have many methods for attacking NT passwords, but you can protect your network against each method. Take steps that eliminate or reduce your network's risks, and carefully regulate local LAN segment presence, directory permissions, and physical access to your network.