Abstract:
To prevent attackers from logging-in with modified passwords, backup copies of passwords are created and stored. At boot time, the stored passwords are compared to the corresponding backup copies to ensure that they have not been modified. This is done during the boot cycle before the attacker is able to login to the computer. If any passwords have been modified, they are replaced with backup copies, thereby preventing the attacker from logging-in with a modified password.

Description:
TECHNICAL FIELD 
     This invention pertains generally to computer security, and more specifically to detecting and preventing the external modification of passwords. 
     BACKGROUND ART 
     If a malicious party gains physical access to a computer, he can boot an alternate operating system from a compact disk and overwrite the portion of the hard drive at which passwords are stored. By overwriting a legitimate password with a non-legitimate one, the attacker can gain unauthorized access to the system. For example, in the case of Microsoft Windows®, a hacker can overwrite a specific registry entry at which a hash of the administrator&#39;s password is stored with the hash for a known password. After rebooting the original system, the hacker can use this known password to login as the administrator. Once logged-in as the administrator, the hacker has full access to the computer. 
     This vulnerability can be overcome by hardware encrypting the entire hard drive. However, this requires the appropriate hardware and software support, and incurs a significant performance penalty to all hard drive access. 
     It would be desirable to be able to prevent unauthorized access to a computer system through password overwrites without requiring encryption of the hard drive. 
     SUMMARY 
     If an attacker has physical access to a computer system, the attacker is able to replace the legitimate password. This allows the attacker to login and take control of the system. To prevent this, backup copies of passwords are created and stored. At boot time, the stored passwords are compared to the corresponding backup copies to ensure that they have not been modified. This is done during the boot cycle before the attacker is able to login to the computer. If any passwords have been modified, a specific policy can be implemented. This could include replacing the password hash with backup copies, thereby preventing the attacker from logging-in with a modified password. It might also include notification of a system administrator that such an action has taken place. 
     The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram illustrating a system in which a password manager detects and prevents the external modification of passwords, according to some embodiments of the present invention. 
     
    
    
     The Figures depict embodiments of the present invention for purposes of illustration only. One skilled in the art will readily recognize from the following discussion that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles of the invention described herein. 
     DETAILED DESCRIPTION 
       FIG. 1  illustrates a system  100  in which password manager  101  detects and prevents the external modification of passwords  103 , according to some embodiments of the present invention. It is to be understood that although various components are illustrated in  FIG. 1  as separate entities, each illustrated component represents a collection of functionalities which can be implemented as software, hardware, firmware or any combination of these. Where a component is implemented as software, it can be implemented as a standalone program, but can also be implemented in other ways, for example as part of a larger program, as a plurality of separate programs, as a kernel loadable module, as one or more device drivers or as one or more statically or dynamically linked libraries. 
     As illustrated in  FIG. 1 , the password manager  101  stores, at least one backup copy  105  of each password  103  to protect. In one embodiment the backups  105  are stored in the format in which the passwords  103  are stored by the operating system (e.g., hashes in the case of Windows). Of course, the backups  105  can be stored in any format as desired. For example, the backups  105  can be hidden, encrypted, compressed, or otherwise further protected from unauthorized access. In the embodiments illustrated in  FIG. 1 , multiple backup copies  105  of each password  103  to protect are stored in various locations on the computer system  107 . In another embodiment, only a single backup  105  of each password  103  is stored. In other embodiments, some or all backup copies  105  can be stored on external media and/or remote computer systems as desired (not illustrated). 
     During the boot process, the password manager  101  compares the real passwords  103  (e.g., in the case of Windows the hashes stored in the registry) to at least one backup copy  105  thereof. If the password manager  101  finds any modified passwords  103 , the password manager  101  enforces the preset security policy. This policy can include the prevention of the login by replacing any modified passwords  103  with the appropriate backups  105 . The password manager  101  does this processing early in the boot cycle, before the attacker has a chance to login. The implementation mechanics of executing such processing at the appropriate point in the boot cycle is known to those of ordinary skill in the relevant art, and the use of these techniques within the context of the present invention will be readily apparent to those of such a skill level in light of this specification. 
     In addition to the security policy discussed above, the password manager  101  can also execute any other desired security policy in response to detecting an overwritten password  103 . For example, the password manager  101  could restrict access to the computer  107 , lock the computer  107 , encrypt or even (in an extreme case) destroy critical data on the drive, send an alert to a third party, etc. 
     As will be understood by those familiar with the art, the invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. Likewise, the particular naming and division of the portions, modules, agents, managers, components, functions, procedures, actions, layers, features, attributes, methodologies and other aspects are not mandatory or significant, and the mechanisms that implement the invention or its features may have different names, divisions and/or formats. Furthermore, as will be apparent to one of ordinary skill in the relevant art, the portions, modules, agents, managers, components, functions, procedures, actions, layers, features, attributes, methodologies and other aspects of the invention can be implemented as software, hardware, firmware or any combination of the three. Of course, wherever a component of the present invention is implemented as software, the component can be implemented as a script, as a standalone program, as part of a larger program, as a plurality of separate scripts and/or programs, as a statically or dynamically linked library, as a kernel loadable module, as a device driver, and/or in every and any other way known now or in the future to those of skill in the art of computer programming. Additionally, the present invention is in no way limited to implementation in any specific programming language, or for any specific operating system or environment. Furthermore, it will be readily apparent to those of ordinary skill in the relevant art that where the present invention is implemented in whole or in part in software, the software components thereof can be stored on computer readable media as computer program products. Any form of computer readable medium can be used in this context, such as magnetic or optical storage media. Additionally, software portions of the present invention can be instantiated (for example as object code or executable images) within the memory of any programmable computing device. Accordingly, the disclosure of the present invention is intended to be illustrative, but not limiting, of the scope of the invention, which is set forth in the following claims.