Take the 2-minute tour ×

My previous question is here - A question about storing passwords This question is somewhat related to my previous one but with some new doubts.

Take for example Windows. I've heard that Windows stores passwords in NTLM hashes somewhere inside the registry (if I'm not wrong). There are programs that crack the NTLM hashes to recover the passwords (brute-force method) in-case you've forgotten them or just want to hack someone's PC. Why don't they just replace the NTLM hashes in the registry with something common like - NTLM hash of 'password'?

This was just an example for your understanding. I'm trying to learn, how large programs store, change or verify passwords without any hacker/attacker being able to read them?

share|improve this question

closed as unclear what you're asking by Michael Kohne, Dan Pichelman, gnat, Kilian Foth, TZHX Sep 17 '13 at 13:12


So are you asking what the Windows registry does, or why it does it, or whether your attack will work against it, or some other general question about passwords? –  Useless Sep 16 '13 at 18:16
Nope. @Useless, I think you didn't understand my question. –  Ranbir Kaif Sep 16 '13 at 18:25
I know, that's why I asked you to clarify it. –  Useless Sep 16 '13 at 18:27
You'll want to read this exhaustive answer for all your password security answers. The only thing it doesn't cover is the storage location, but that's relatively irrelevant. –  Bobson Sep 16 '13 at 18:49
@RanbirKaif - your question would be stronger if you edited to make it more clear based upon some of the comments asking for clarification. The comment is direct evidence that what you wrote wasn't clear to begin with. Try breaking paragraphs apart and use a little more formatting to make it more clear what you're trying to understand. Don't just point back to an existing sentence and pretend that's good enough. As the Asker, it's your responsibility to make sure we understand your question. –  GlenH7 Sep 16 '13 at 19:30
show 1 more comment

2 Answers

Replacing the hash as you suggest is sometimes done. But only when the attacker doesn't care about leaving a really obvious indicator that something has gone wrong with the account.

There used to be an attack against Oracle databases where the password hash was exposed. An astute attacker with sufficient privileges could

  1. copy the old hash off
  2. substitute a hash of their choice from a known password
  3. take whatever privileged actions as necessary
  4. replace the old hash

This allowed for an escalation of privileges with a reasonably small window of being detected. In theory, something similar could be done with the Windows registry / hive where passwords are stored.

It's worth noting that an account with sufficient privilege to write to the registry like that would also likely have the ability to reset password. Far faster to just use the built-in mechanisms and reset the password to one of the attacker's choosing. The risk is getting caught sooner because the password changed when the legitimate account owner attempts to log in.

share|improve this answer
add comment

On a standalone NT setup, yes the passwords are stored as hashes in the SAM database which does reside in the registry. Although you can only access that by directly accessing the disk or tricking the system into running an app under the 'system account'. It is well hidden from users normally.

'How do large programs store/change/verify without any hacker/attacker being able to read them?'

Now there's the $1million question. What you're asking is for us to explain the entire field of IT security. The field is practically a dedicated branch of computer science and maths all to itself. In fact we have Security.SE specifically for security questions.

For example if you take a simple password form on a website.

First, you have to establish a secure channel for the password to be sent from the user to the server. In order to secure that channel you require a key but... how do you secure that key. Well, some clever mathematicians designed a system on the basis that it takes a long time to factor relative prime numbers and we have 'public key cryptography.'

Once the password is sent over the secure channel it has to be stored and obviously you'd want to protect that just in case someone broke in and got your list of passwords so we have 'hashes' which are a distilled fingerprint of a larger value. But hashes are repeatable and aren't in themselves intended to be secure so over time we got to a situation where you could work all the possible answers in advance. So now we add 'salt' (extra data) into the value that we're hashing, this means that if someone replaces or steals the hash they have to work out what is hash and what is salt... When we want to check the password, we recreate the hash from the password the user provided over the secure link and our salt see if the hashes match.

It's way more complicated than that though should you decide to try to go down that rabbit hole.

share|improve this answer
add comment
