Q. How do I stop tools like Kon-Boot?

A. A client of mine recently had concerns about a new tool, Kon-Boot, and the fact that it could bypass the requirement to enter a password at the logon screen. I downloaded the tool and tried it. It works by booting from a CD or USB stick (meaning you need physical access and the ability to boot from alternate media) that has a small boot environment that loads itself into memory. The environment hooks into the BIOS then boots the main Windows OS, where it modifies the Windows kernel that's loaded into memory to not require the entry of a password at the logon screen. Below you can see a virtual machine that I booted via Kon-Boot at the initial Kon-Boot loading stage.

Note that Kon-Boot works with local accounts and domain accounts that have the credentials locally cached. I can't log on without a password for a domain account whose password isn't cached locally. Also, once I'm logged on with a domain account, no contact with the domain has taken place, so I have no token. So I can't talk to network resources as the domain account, I can just access local content on the box with that user's permissions.

This isn't really much different from many system recovery tools out there that enable access to NTFS volumes outside of Windows for recovery or password reset solutions. In fact, Microsoft provides its own set of solutions as part of the Desktop Optimization Pack in the form of Desktop and Recovery Toolset (DART), which has a local account password reset and NTFS access tool.

Like most other security bypass products and recovery solutions, Kon-Boot requires physical access to the box. If you give someone unprotected physical access to the box there, are many products and methods to gain access to information. There are key steps you can perform to provide protection from these attacks:

These basic steps will provide protection from most types of physical attack, including Kon-Boot.