Syskey
The SAM Lock Tool, better known as Syskey (the name of its executable file), is a discontinued component of Windows NT that encrypts the Security Account Manager (SAM) database using a 128-bit RC4 encryption key.[1]
Introduced in the Q143475 hotfix for Windows NT 4.0 SP3, the tool was removed in Windows 10's Fall Creators Update in 2017 because its method of cryptography is considered unsecure by modern standards and the fact that the tool has been widely employed in scams as a form of ransomware. Microsoft officially recommended use of BitLocker disk encryption as an alternative.[2][3]
History
Introduced in the Q143475 hotfix included in Windows NT 4.0 SP3,[4] Syskey was intended to protect against offline password cracking attacks by preventing the possessor of an unauthorized copy of the SAM file from extracting useful information from it.[4]
Syskey can optionally be configured to require the user to enter the key during boot (as a startup password) or to load the key onto removable storage media (e.g., a floppy disk or USB flash drive).[5]
In mid-2017, Microsoft removed syskey.exe from future versions of Windows.[6] Microsoft recommends using "BitLocker or similar technologies instead of the syskey.exe utility."
Security issues
The "Syskey Bug"
In December 1999, a security team from BindView found a security hole in Syskey that indicated that a certain form of offline cryptanalytic attack is possible, making a brute force attack appear to be possible.[4] Microsoft later issued a fix for the problem (dubbed the "Syskey Bug").[7] The bug affected both Windows NT 4.0 and pre-RC3 versions of Windows 2000.[4]
Use as ransomware
Syskey is commonly abused by technical support scammers to lock victims out of their own computers in order to coerce them into paying a ransom.[8][9]
See also
References
- ^ "Enable Syskey To Protect Windows From Password Cracking". Technig. 2015-04-06. Retrieved 2018-02-04.
- ^ "Features that are removed or deprecated in Windows 10 Fall Creators Update". Support. Microsoft. 12 December 2017.
- ^ "Syskey.exe utility is no longer supported in Windows 10 version 1709 and Windows Server version 1709". Support. Microsoft. 20 October 2017.
- ^ a b c d Sabin, Todd (December 16, 1999). "bindview.syskey.txt". Packet Storm. Retrieved July 1, 2016.
- ^ "How to use the SysKey utility to secure the Windows Security Accounts Manager database". Support. Microsoft. 8 January 2018.
- ^ "Syskey.exe utility is no longer supported in Windows 10, Windows Server 2016 and Windows Server 2019". support.microsoft.com. Retrieved 2019-01-12.
- ^ Khanse, Anand (March 9, 2012). "Use SysKey Utility to lock Windows computer using USB stick". The Windows Club. Retrieved July 1, 2016.
- ^ "SOLUTION: "This is Microsoft Support" telephone scam – Computer ransom lockout". Case Studies. Triple-S Computers. 10 April 2013.
- ^ "Tech support company with workers in India claims its 'good name' being ruined by scammers". Sydney Morning Herald. 17 November 2014. Retrieved 23 February 2017.
- v
- t
- e
- APIs
- Architecture
- Booting process
- Games
tools
- App Installer
- Command Prompt
- Control Panel
- Device Manager
- Disk Cleanup
- Drive Optimizer
- Driver Verifier
- DirectX Diagnostic Tool
- Event Viewer
- IExpress
- Management Console
- Netsh
- Performance Monitor
- Recovery Console
- Resource Monitor
- Settings
- Sysprep
- System Configuration
- System File Checker
- System Information
- System Policy Editor
- System Restore
- Task Manager
- Windows Error Reporting
- Windows Ink
- Windows Installer
- PowerShell
- Windows Update
- WinRE
- WMI
- 3D Viewer
- Calculator
- Calendar
- Camera
- Character Map
- Clipchamp
- Clock
- Cortana
- Edge
- Fax and Scan
- Feedback Hub
- Get Help
- Magnifier
- Maps
- Messaging
- Media Player
- 2022
- Movies & TV
- Mobility Center
- Money
- Narrator
- Notepad
- OneDrive
- OneNote
- Paint
- Paint 3D
- People
- Phone Link
- Photos
- Quick Assist
- Remote Desktop Connection
- Snipping Tool
- Speech Recognition
- Skype
- Sports
- Start
- Sticky Notes
- Store
- Tips
- Voice Recorder
- Weather
- WordPad
- Xbox
- Active Directory
- Domains
- DNS
- Group Policy
- Roaming user profiles
- Folder redirection
- Distributed Transaction Coordinator
- MSMQ
- Windows Media Services
- Active DRM Services
- IIS
- WSUS
- SharePoint
- Network Access Protection
- PWS
- DFS Replication
- Print Services for UNIX
- Remote Desktop Services
- Remote Differential Compression
- Remote Installation Services
- Windows Deployment Services
- System Resource Manager
- Hyper-V
- Server Core
- Boot Manager
- Console
- CSRSS
- Desktop Window Manager
- Portable Executable
- Enhanced Write Filter
- Graphics Device Interface
- Hardware Abstraction Layer
- I/O request packet
- Imaging Format
- Kernel Transaction Manager
- Library files
- Logical Disk Manager
- LSASS
- MinWin
- NTLDR
- Ntoskrnl.exe
- Object Manager
- Open XML Paper Specification
- Registry
- Resource Protection
- Security Account Manager
- Server Message Block
- Shadow Copy
- SMSS
- System Idle Process
- USER
- WHEA
- Winlogon
- WinUSB
- Solitaire Collection
- Surf
Microsoft Store
- DVD Player
- File Manager
- Hover!
- Mahjong
- Minesweeper
- Category
- List