About anyadmin

csdkakawppas78963
Aug 11

Top 10 Security Issues Revealed in 2014 Blackhat Conference(1)

Hackers always present their amazing skills to the public, from invading aircraft code to monitoring surveillance cameras, and then to using any USB device as attacking tool.

Even though some of the security issues are sensational in theory, but they are pioneers that uncover security risks in Internet world.

1. Quietly deadly BadUSB

A researcher in Berlin “Security Research Laboratory” claimed that they had developed conceptual tools to attack USB device firmware. When the infected USB device is plugged into the computer, it will disguise as keyboard to download malicious software.

Since most USB device manufacturers haven’t taken any measures to protect the firmware, and anti-malicious software won’t scan firmware malicious behaviors. So theoretically this vulnerability can spread malicious software owing to hard to find and difficult to prevent, and imagine how many USB devices are interacting with computers over the world, we know how terrible this vulnerability is. Fortunately, in reality we have not found attacks based on this vulnerability.

2. Invade aircraft

The consequence of another conceptual attack is more terrible. A researcher in the field of human-computer interaction, Ruben Santamarta claimed that hackers can invade aircraft satellite communication system via Wi-Fi and entertainment systems, thereby allowing the attacker to affect aircraft navigation and safety systems.

The satellite communication system manufacturer said in an interview with Reuters, the possibility of such attack and harm caused by the attack are very small, but they also said they had begun to fix loopholes.

3. Being monitored surveillance cameras

Are your surveillance cameras monitored by other people?

Two security researchers opened a $ 200 Dropcam camera, wanting to see how it works internally. It turned out that there are many vulnerabilities that hackers can make use of them to not only browse the video camera in the store but also upload to third-party video and forge to be taken by other machine. In short, hackers can hijack and take over the camera’s video stream.

Fortunately, there’s a significant adverse condition to implement this terrible security vulnerability: an attacker need physically access to your Dropcam camera. In other words, if an attacker can strut into your room and access to your camera, the security issue on your company or your room is more serious than that of surveillance camera.

4. Tor crisis

Tor provides anonymous access between the source node to the destination node for the user. However, a researcher Alexander Volynkin at Carnegie Mellon University said that with minimal cost to break the anonymity of Tor network is very possible. However, the specific implementation details hadn’t been announced yet.

However, urged on by Carnegie Mellon University, Volynkin abruptly canceled his speech at the hackers conference. Meanwhile, recently Tor’s operators also discovered a set of unidentified malicious relay node, Tor tries to decrypt the user’s identity. (Reference: peeled onion skin, deep Inside the Tor network)

5. Symantec Endpoint Protection loophole

Renowned security expert Mati Aharoni discovered three vulnerabilities in Symantec Endpoint Protection tool. These vulnerabilities could allow an attacker to launch high-level access to the victim’s computer. In other words, hackers can invade your computer through security software. Would not it be a very ironic thing?

Of course, Symantec has started repairing the vulnerabilities!

The last five vulnerabilities will be revealed in next blog post, please stay tuned!

If you want to know information about personal or enterprise file protection solutions, please visit: http://www.kakasoft.com.

Jul 28

Use Heartbeat as Password – a New Encryption Method Appears

Since now many people don’t trust the traditional passwords, some technology companies began to explore other ways to ensure people’s online account safety. Some companies invented to use brain waves or fingerprints as passwords. Now there’s a new encryption method in the world.

A wristband called Nymi can detect user’s heart rate through ECG sensor, and allows user to use own heartbeat to decrypt device. This product can be used with iPad or even cars. This product manufacturer is Bionym from Toronto, the company’s developers said using human heartbeat to unlock the device is safer than using fingerprints, facial recognition and other external means to do that.

When first time getting the device, users simply need to use finger to press on the sensor of the wristband, the sensor will automatically monitor and store the user’s heart rate. The whole process takes about two minutes, after saving the user’s heartbeat, the device will only recognize the user’s heartbeat. Ordinarily, the sizes of people’s hearts are completely different, so produced electrocardiogram is unique.

Daily use of the device is also very simple, you need to press and hold the sensor with your finger, after a few seconds, the sensor will be able to identify the user’s heart rate, and use Bluetooth technology to connected with the device that need to be controlled to unlock the device. When wristband leaves outside of the scope of Bluetooth, the device automatically locks.

Nymi even works with the gesture control feature, for example, when a user is in the car, waving can open the drive side door or rotating the wrist to open the front passenger side door. In addition, the product also has a secure payment feature, at highway toll stations users can use it to scan the device charges, and the fees will be automatically deducted from the user’s account. The wristbands can also remind users of receiving a mail or social network message by vibration, while the device vibrates, the screen will also display.

This encryption method is limited used to protect devices. We now still use traditional password most. For example, we use traditional password to protect files/folders on computer or external hard drive.

Jul 14

Five Errors in Personal Network Protection

Owing to the frequently happened network security incidents and personal privacy and data leak issues, most of readers have already begun to pay attention to strengthening personal information protection and enhancing secure awareness. But unfortunately, currently there’s still some false information about data protection spreading among the public. These erroneous views spread between the network community and users, but seldom experts correct these errors. The following includes five representative security errors:

Error 1: I don’t have valuable information, nobody would hack my computer

Many people hold the similar argument. When you tell them to strengthen security measures (for example, improve the account password strength), they always say we don’t have valuable information and there’s no need to hack my computer.

In fact, today’s hackers often use phishing attacks. Once your cell phone information , email and social network information and other network information have been mastered by hackers, they would carry out further social engineering attacks (of course, the targets may be your friends in Contacts), and even cooperate with offline fraud, causing serious consequences.

Moreover, hackers or cyber criminals can not only make use of privacy information to start social engineering attacks, they can also invade your home router, laptop. NAS and even smart phone, they can change your device into zombie clients, even worse, they can use your device to initiate a variety of criminal activities, so you will not only be a victim but also an accomplice. Therefore, it’s a responsibility for us to enhance security awareness, improve security knowledge level.

Error 2: VPN or Tor can realize completely anonymous.

After Snowden event happened, Tor has stepped into the vision of people who are seeking asylum privacy. Many people may forget, Tor is also a paradise of botnet network and network black market. And more importantly, after Snowden event, some experts pointed out that Tor couldn’t help escape tracking of US intelligence agencies.

The most typical example is that by the end of 2013 a student of Harvard University – Eldo Kim used Tor to release bomb threat information and then arrested. Perhaps influenced by Snowden, Kim overestimated Tor’s “stealth” capability, and published false information of bomb attack by Tor, attempting to delay the date of the final exam, but unfortunately FBI officers soon found Kim’s classmate.

Similarly, VPN also do not have the stealth capability, for the design purpose of VPN is strengthening security, rather than being stealth.

Error 3: Mac address filtering plus turned off SSID broadcast can ensure WiFi network security

Many users think setting the MAC address filtering plus turned off SSID broadcast can ensure family WiFi hotspots security, which is actually a big misunderstanding. It may be useful for computer novice, but useless for computer geeks or hackers.

Remember that only WPA2 encryption standard level can effectively protect your WiFi network, and you must use strong password.

Error 4: Seamless browse can ensure security

Today, many browsers have launched a so-called “incognito browsing” security option, but in reality this so-called incognito can only prevent other users of your computer check and see your privacy information, but for network service providers such as providers of cloud disk, mailbox, social network, your activities are still under surveillance.

Error 5: I have never visited dangerous sites, so I don’t need to install anti-virus software.

Many people think that computer hacker is caused by browsing “dirty” sites, in fact. Nowadays many hackers use pub-style attacks”, which means that first of all attacking regular sites you frequently visit, and then sit back and wait to control your computer. In addition, browser plug-ins, malicious app will stealthily steal your important private information and data.

Hackers have been all pervasive and even your computer that’s never connected to the Internet may be infected with virus. Therefore, you need to keep good online habits including installing anti-virus software, enhancing anti-phishing awareness and password protecting personal files.

Jun 30

Best Defense is Equal to Attack

Speaking of BYOD, the best defense is attack, namely, making strategies in advance to achieve your desired results and to avoid potential risks.

BYOD (Bring Your Own Device) has stirred all walks of business processes. Some companies are fully enjoying the convenience brought by BYOD, yet some companies shy away from them. On the bright side, BYOD can potentially help companies save operating costs, help employees maintain a happy mood and improve office efficiency. But on the other hand, BYOD may also bring a series of problems and pitfalls in the various aspects of security, compatibility and so on. But through some planning and education, most of these problems and pitfalls can be avoided. We can have a look at the troubles brought by BYOD and corresponding resolutions to these problems.

Data leakage: Companies sensitive data leakage is always one of most concerned problems for companies. Employees bringing their own devices to company makes enterprise more worried. Employees may lose their smart phone or tablet; for these devices can easily be eyeing by thief. When the devices containing companies’ sensitive data get lost, the data may fall into wrong hands. One way to avoid this situation is to use file password protection program to lock sensitive data with password, and the other way is to use a remote deletion policy, namely when the employee’s mobile device is stolen, company can remotely delete the sensitive data on the remote device.

Password Leak: just like we usually carry several keys, employees’ mobile devices will store various passwords that are used to log in company’s network and applications. These passwords may exist in mobile applications, or may also be stored directly in the mobile device’s memory. Enterprises must establish a strategy to ensure that companies’ passwords won’t be stored in cache or any application in mobile device. An alternative strategy is that if employees want to save the password on the mobile device business (even login information), they need to use information/password saving application to properly encrypt them.

Productivity decline: When employees start BYOD, they will spend a lot of time on social network, chatting with friends or do other things unrelated to work. How to solve this problem? Since many devices are connected to operator’s mobile communication network, in which case the employees feel that their equipment is not bound by corporate policy. In order to avoid this situation, you should require employees’ mobile devices switch into WiFi network provided by the enterprise when entering company. 

Insufficient bandwidth: Many companies have been concerned about this problem. Most companies believe that the enterprise network bandwidth demands will be dropped after the use of BYOD, which is a big mistake. One of the advantages of BYOD is that employees also can use the mobile operator’s network networking to work when going out, but when they returned to the office, they are likely to connect desktop and their mobile devices to the corporate network, thereby increasing the burden on the enterprise network access bandwidth. Therefore, companies need to ensure that their network access bandwidth has sufficient load-bearing capacity.

Device Management: Many companies are asking how to manage a large number of mobile devices. Because of the many types of equipment, as well as different operators, companies is difficult to centrally manage all mobile devices. But what companies can do is to establish a set of network access control mechanism (NAC), and to control these devices via MAC address for each mobile device.

Over Autonomy: Once a company implemented a BYOD strategy, which’s equivalent to tell employees and users that businesses gives them a very high autonomy. Of course, this autonomy is likely to be abused by employees or network users. Therefore, even if the enterprises implement BYOD, they should let employees know that it doesn’t mean that they can use their own equipment in any activity. If necessary, you can also require employees to sign BYOD agreement confirming that they understand their mobile devices use behaviors in the enterprise are limited.

Jun 16

It’s time for you to abandon TrueCrypt

A series of aftermath of WindowXP end of support is gradually revealing. Currently open source TrueCrypt warn users of the tool’s security vulnerability on SourceForge official site; meanwhile, TrueCrypt also announced the termination of TrueCrypt development.

TrueCrypt warned on the official page with striking red font:

“WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues

This page exists only to help migrate existing data encrypted by TrueCrypt.

The development of TrueCrypt was ended in 5/2014 after Microsoft terminated support of Windows XP. Windows 8/7/Vista and later offer integrated support for encrypted disks and virtual disk images. Such integrated support is also available on other platforms (click here for more information). You should migrate any data encrypted by TrueCrypt to encrypted disks or virtual disk images supported on your platform.”

TrueCrypt’s warning and development suspension caused uproar on social media, since in the past decade, TrueCrypt had always been a very popular cross-platform open-source encryption program, so it’d been first choice for users who had needs of data encryption.

For a long time, TrueCrypt are famous for excellent encryption performance and good safety record, TrueCrypt could create a virtual disk on your hard drive without needing to generate any file, the user can access in accordance with the drive, all files on virtual disk are automatically encrypted, which need password to be accessed. TrueCrypt offers a variety of encryption algorithms, including: AES-256, Blowfish (448-bit key), CAST5, Serpent, Triple DES, and Twofish, other features support FAT32 and NTFS partitions, hide labels, hot start and so on.

In 2009, the Brazilian Federal Police confiscated five hard drives in banker Daniel Dantas’s Rio de Janeiro apartment in the Satyagraha action launched in July 2008. These drives used two types of encryption programs, one of which is TrueCrypt, the other is unknown 256 AES encryption software. After the expert failed to crack the password, the Brazilian government asked the U.S. for help in the beginning of 2009, however, the United States federal police also failed to crack the encryption after one-year attempt, and returned the hard drive. This incident makes TrueCrypt famous.

In 2013, Snowden exposure NSA can decrypt most Internet encryption technology; TrueCrypt supporters raised a lot of money to audit TrueCrypt security. From the first phase of audit results, there has not been found security backdoors.

Johns Hopkins University professor Matthew Green participated in the TrueCrypt security audit, he said TrueCrypt official warning looks really, unlike the hacker’s prank, and he also contacted the TrueCrypt secret private developers, trying to get more details.

Whatever the truth, TrueCrypt users should enhance viligance, TrueCrypt is no longer the indestructible who should begin vigilant, TrueCrypt encryption is no longer the indestructible encryption software. And it’s time for you to consider using other file encryption software as an alternative. There’re many file encryption solutions on Google, you can try and choose most suitable one. If you need file/folder encryption solution for Windows computer, you can try Folder Protector.

Jun 03

TrueCrypt’s “Sudden Death” Results in Chaos

Recently, open source encryption software TrueCrypt warn users in the official page of the SourceForge that there’s a security risk on this tool, meanwhile, it also announced the termination of TrueCrypt development.

As the most popular free and open source cross-platform encryption software over the past decade, TrueCrypt’s “sudden death” makes information security industry that has been tortured by NSA and OpenSSL fall into chaos again. On Twitter and Facebook and other social media, “conspiracy theory” begins circulating among the security professionals. Many people believe that TrueCrypt’s “sudden death” is similar to Lavabit, which is likely to be forced to close by government departments. Some people also think that the reason is the conflict among core staffs of TrueCrypt.

Since TrueCrypt is widely used, there is a lot of individuals and businesses around the world adopt this software to encrypt sensitive data, so the “sudden death” caused by security problems also led to the close attention of the user. TrueCrypt’s supporters raised $ 70,000 for the TrueCrypt security audits.

TrueCrypt has announced to stop product development, and its official website to jump to the SourceForge page and persuade the users to select other encryption software.

To choose what kind of products to replace TrueCrypt has become a sharp topic among security experts. In addition to BitLocker recommended by TrueCrypt, the master of cryptography – Burce Schneier recently revealed on blog that he personally has switched to use Symantec’s PGPDisk encryption software.

Schneier points out, there are two reasons why he chose full-disk encryption tool PGPDisk: one of which is easy to use, the other is that he trusts Symantec Developer (Schneier himself is a member of the Technical Advisory Committee PGP Corporation). Schneier believes the advantages of full disk encryption are that you don’t need to worry about various hibernation files, swap files, temporary files, browser Cookies and deleted files in disk. If you lose the hard drive or laptop, you just need to tell the boss: “Don’t worry, the entire disk has been locked.”

Now you have many choices about file encryption, now you have very few choices about file encryption. Since nowadays the data theft and data leak accidents frequently happen, individuals and groups including commercial companies all focus on data security. If you want to protect important and sensitive files, you’d better adopt encryption technology to encrypt these files with password. It’s important for you to choose an effective and easy-to-use file encryption program, for which is directly related to your file security.

May 19

Nine mistakes enterprise often commits after data leakage

In the recent International Association of Privacy Professional (IAPP), a data and privacy protection expert from Data Breach Resolution – Michael Bruemmer lists top nine common mistakes that enterprises commit after data leakage.

When the enterprise leak their data owing to being attacked , if the enterprise fails to handle the problem, the situation will become deteriorate, which may result in secondary attack on enterprise brand and performance and even involve the enterprise into legal troubles.

1. There is no external safety management services company to assist

When the severity of data leakage exceeds the company’s processing ability, it’s better for the enterprise to have the assistance of external security services team, which is called the incident response team, such as Verizon Business, Trustwave or IBM all can provide similar service. This kind of service should be considered when making out business continuity / incident response plan.

2. There’s no external legal counsel

Currently laws and regulations are unable to effectively cover all types of sensitive personal information, hence when serious data leak incidents happen, it’s necessary to commission an external data leak related experienced lawyer unless your company’s legal department well knows all data and privacy related laws.

3. There’s no sole decision maker

Data leakage often involves multiple departments in company, and every department has its head, which always leads to low efficiency in execution. Enterprise must assign a similar CISO position, which can play a planning and coordination role in promoting the overall issue response.

4. A lack of transparent communication mechanism

A lack of transparent communication mechanism will lead to troubles, and wrong communication message will cause wrong actions, which will delay the processing speed of the entire incident and make new confusion.

After the incident response team was established, every staff in this team should be definite and provide a complete contact list for external consultants.

5. There is no communication plan

Another problem in enterprise is a lack of communication plan to communicate with the p[ublick or the media.

Enterprise should prepare a detailed and feasible media communication plan for a data leak incident. Rapid and effective media communication can avoid spreading false reports.

6. Think and plan before things happen

Data leakage incident often needs you to make decision when holding incomplete information or information is changing fast, which is somewhat similar to a hospital emergency room. Enterprise must launch contingency processing flow while data leak incident happens. Waiting to grasp the full information and then taking action will miss the best opportunity.

7. A lack of rehabilitation and correction plan after the event happens

After handling the data leakage incident, enterprise should make out a rehabilitation and correction pan to maintain good communication with consumers and stakeholders, while avoiding this kind of events from happening again. It’s helpful for rebuilding the brand and retrieve trust of customers by sharing your investment in information security technology and services with your customers and investors.

8. Provide customers with no remedy

Consumers should always be the core of intrusion response, which means that companies should notify consumers through channels such as call center to take proper measures to protect personal privacy data after the data leakage incidents happen.

9. There’s no plan to execute

Incident response plan must be constantly updated and corrected, and its implementation needs a complete team to continue to advance.

For more information about data security, you can visit: www.kakasoft.com

May 05

The troubles from BYOD and corresponding solutions

When talking about BYOD, the best defense is attack, that is, through setting stratagem in advance to achieve the expected results and to avoid the potential risks. BYOD (Bring Your Own Device) has stirred all walks of business processes. Some enterprises are fully enjoying the convenience brought about by BYOD, while some enterprises are staying away from it. On the bright side, BYOD can potentially help companies save operating cost, help employees maintain happy moods and improve office efficiency. But on the other side, BYOD may also result in a series of problems and pitfalls in security and compatibility and other aspects. However, through education and planning, most of these problems and pitfalls will be avoided. Now let me show you the troubles result from BYOD and the corresponding solutions to the problems.

Data leakage: company’s sensitive data leakage is always one of the most concerned problems for companies. Employees bring their own devices into the company, which makes the concern of data leakage more serious. Employees may lose their smart phones or tablets, what’s more, these devices easily become targets of thieves. Once the mobile devices with company sensitive data get lost, the data may well fall into wrong hands. To avoid this situation, admin of the business should urge employees to encrypt all files relate to company with password, so the files are still under protection even if the device are stolen or missing.

Password leakage: just like we usually carry several keys, there will be several passwords that can be used to logon enterprise network or service applications on employees mobile devices. These passwords may be stored on mobile applications or directly on the memory of the mobile devices. Enterprise must establish a strategy to ensure the password won’t be stored on cache or applications on the mobile devices. An alternative strategy is to use special password storing application to properly store passwords if employees hope to save enterprise passwords on mobile devices.

Productivity decline: when employees begin bringing their own devices, they will spend much working time on the social networks, chatting with friends or behaving other things unrelated to work. How to solve this problem? In order to avoid this situation, all employees’ mobile devices should be connected to WiFi network provided by the enterprise. If employees are aware of the network they are connected now is within the enterprise, they will more beware of the online behaviors and don’t spend too much time on things unrelated to work.

Compatibility issues: BYOD will bring a lot of problems about devices and platforms. You hope company’s IT system and business process will support Android, IOS, OS X, Blackberry, Linux, Windows 8 and other mobile systems; while companies wish to support only one or two kinds of platforms, for the limited platform make the support from company to mobile devices easier.

Device Management: many companies are wondering how to manage a large number of mobile devices. Because of various types of devices and different operators, enterprise can hardly centrally manage all mobile devices. But companies can at least establish a set of network access control mechanism (NAC), such as PacketFence, and to control these devices via MAC address for each mobile device. Of course, this requires that employees agreed the enterprise to record the MAC address of their mobile device. But companies need to realize that it takes much time to manage all devices and activities of these devices.

Virus infection: compared with desktop, the risk of virus infection of mobile phone platforms is relatively less. Therefore, users of mobile devices must install anti-virus software for their devices. The enterprise should designate antivirus products for employees, and regularly remind staffs to upgrade software and virus database.

Compare all devices to human beings, the mobile device is like people in adolescence, and there always be many problems. Enterprise makes use of mobile devices to assist the business; it must face various potential problems. The best solution is to prepare in advance and then resolve the problems quickly and timely when they arise.

Apr 21

Computer Password Cracking Methods Conclusion (2)

Thirdly, crack some commonly used software

Currently, more users understand to use computer software to encrypt some information stored on computer, which makes unauthorized people unable to open the files. Now let’s see some commonly used software password cracking methods:

1. Crack Word document password

Microsoft Office is so famous that the password cracking software against it is much. You only need to download software that aims at cracking Microsoft Office password, and then run it on your computer. This kind of software mostly uses “dictionary” brute-force solution to crack password.

2. Crack Excel documents 

You can find a tool called AdvancedExcel197PasswordRecovery online, which is only 614K and is able to quickly crack password of excel documents. AdvancedExcel197PasswordRecovery needs installation after download. Open the main interface after installation, and open the excel documents that need to decrypt via browse button, choose password length, set password type and click on blue start button. After a while, the program will pop up the prompt menu of document password was cracked. 

3. Crack OICQ password

We use a tool called OICQ Terminator”. The using steps are as below: first set the installation directory of OICQ password Terminator; choose the character set used to search, for example choose the lowercase characters shown on the image, or check all the boxes below the basic settings; and then set password length, but you’re not advised to choose too long; finally, click the “Start ” button to crack OICQ password, now what you need is patience. According to people who used it, the exhaustive speed of OICQPASSOVCR can reach thousands of times per second. If you want to crack 4-5 digits password, it can finish within several minutes.

Fourthly, crack network password

Network is quietly and quickly stepping into our daily life. And as an ordinary network user, people all have a similar concern, namely the network security risks. Therefore, we have to take effective protective measures on personal network activities, such as add passwords. But once we forget the password, our works will be obstructed. Now there’re some network passwords cracking skills:

1. Crack IE Content Advisor password

IE browser provides content advisor feature, which can browse the site. If you forget the password of Content Advisor feature, you can not only access the limited sites but also change the existing restriction level, re-installation of IE is useless. In this situation, you can start the Registry Editor, locate the “HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ policies \ Ratings ” to find a key value named ” KEY “, it is the IE content advisor password the user set (encrypted data), the user only need to delete the key value, the content advisor will be canceled, and then reset the IE content advisor password. 

2. Crack OE password

There are three types of passwords in OE program: email password, newsgroups password and user identification code. Here we take the “password interception” program as an example. This software can be used to crack Web email password, POP3 reception password, FTP login password, and display, save or send the password to specified mailbox. Password interception process: password interception software can save the password (such as dial-up connection, OICQ, IE the password) in password input box into user-defined file in form of clear text; if it fails to intercept passwords, the password file will not exist. 

3. Crack Foxmail password

There are quite a number of users using a simple but powerful tool Foxmail to receive mail. However, due to Foxmail’s own security risks, some people simply create a new account, enter the Foxmail default installation directory, copy the “account.stg” under the new account directory and cover your account file and then the password of the original account will be removed.

Some solutions above may not work with you, as the vulnerabilities of the software and network are repaired when the time goes by. But anyway, the methods of password cracking can only be used to solve administrators’ urgent problems but not to breach other people’s account.

For more information about data security, please visit: www.kakasoft.com

Apr 08

Computer Password Cracking Methods Conclusion (1)

The administrator always confront with problems about password forget or password missing, the followings are the collection of some methods of password cracking. Power-on password is the first one we’ll meet, so let’s star from CMOS password cracking.  

1.       CMOS cracking

Even though the types of CMOS are various, their encryption methods are basically the same. The general cracking methods start from “hard” and “soft” aspects.

1) “Hard” remove method

The principle of this method is to process the CMOSRAM on the motherboard with electro discharge treatment, which makes the contents lost owing to lack of normal power supply parameters stored in CMOSRAM lacks normal power supply, and thus to remove CMOS password. Some newspaper or sites make much introduction about how to crack CMOS password, and the operation is very easy. But we will introduce an alternative technique, which is the method that a number of computer users like to use. This method is also simple: open the case, and pull off the hard drive or CD-ROM, floppy drive data cable from the motherboard, and then start the computer, BIOS will report an error during self-test and then automatically enter CMOS, at this time you can reset the BIOS content.

2) “Soft” remove method

Strictly speaking, the “soft” remove method is not as thorough as hard remove method, but it’s also very effective. CMOS password according to need can be divided into common user password and super user level password. The former simply restrict the changes to the BIOS, but it allows to normal start computer and run other software; but the latter completely ban access to a computer and BIOS.

1> crack common user password

First of all, boost a computer with DOS, input debug and then press enter in dos command line, and then use the data of listed methods to remove the CMOS password, restart the computer, the system will tell you the CMOS parameter is missing and require you to reset CMOS parameters. After testing, this is a very effective method.

2> crack the super user password

Here we need to resort to external tools. We choose the most classic BiosPwds, a freeware, which is suitable for computer users who are not familiar with dos.

2.       Crack system password

System password is the password you use to log on the operating system, it provides protection for your computer and protect your computer from unauthorized users’ accesses, so as to ensure computer and confidential data security.

1. Windows98/ME system login password

1> cancel

The easiest way is to enter nothing when logging on the password, directly click on “cancel” to enter the operating system. But this way makes you can only access resources in local computer but can’t access the network resources if your computer is a part of LAN.

2> add users

When you are blocked from the system owing to the password, you may as well add a user for the system, and then log in. Click “Start”->”Settings”->”Control Panel”, and then double click on “user”, open the “User Properties” dialog box. Then, input user name, password and customized settings following the prompts, and then click on “Finish”.

3> delete “PWL” file

Delete the .PWL file under the Windows installation directory and all personal information files under Profiles subdirectory, and then re-boost Windows, the system will pop up a password setting box without user name. You don’t need to input any content, just click on “Ok” and tehn Windows password will be deleted.

4> modify the registry

Run the Registry Editor, open the registry database “HKEY_LOCAL_MACHINE \ Network \ Logon” and change “username” to “0″, then restart the system, which also allows you to remove the password.

2. Crack WindowsNT password

If you have normal user account, there’s a simple way to get NTAdministrator account: first rename the logon.scr under c: \ logon.scr winntsystem32 as logon.old for backup, and tehn rename usrm gr.exe as logon.scr and restart. logon.scr is a loaded program when starting system, after restarting, the computer won’t appear logon password interface, but the user manager, at this time you can add yourself into admin group.

3. Windows2000 password

Use boot disk to boot computer or enter another operating system (eg Windows98), find the folder “X:\DocumentsandSettings\Administrator” (X is the disk where Windows2000 is placed), delete “Cookies” folder under this folder and then restart the computer, so you can quickly logon Windows2000 without password.

The above methods are used by admin to cope with problems of forgetting password or missing password, they shouldn’t be used to break other people’s computer. And the computer users who are afraid other people will invade computers without authority and steal personal information should take extra protection for the confidential and sensitive files and documents, such as using file encryption solution to protect files and folders.