Syskey

 ( Cryptographic Software ) 

The SAM Lock Tool, better known as Syskey (the name of its executable file), is a discontinued component of Windows NT that encryption the Security Account Manager (SAM) database using a 128-bit RC4 encryption key.

Introduced in the Q143475 hotfix for Windows NT 4.0 SP3, the tool was removed in Windows 10's Fall Creators Update in 2017 because its method of cryptography is considered insecure by modern standards and the fact that the tool has been widely employed in scams as a form of ransomware. Microsoft officially recommended use of BitLocker disk encryption as an alternative.

---

History Introduced in the Q143475 hotfix included in Windows NT 4.0 SP3, Syskey was intended to protect against offline password cracking attacks by preventing the possessor of an unauthorized copy of the SAM file from extracting useful information from it.

Syskey can optionally be configured to require the user to enter the key during Booting (as a startup password) or to load the key onto removable storage media (e.g., a floppy disk or USB flash drive).

In mid-2017, Microsoft removed syskey.exe from future versions of Windows. Microsoft recommends using "BitLocker or similar technologies instead of the syskey.exe utility."

---

Security issues

---

The "Syskey Bug"

In December 1999, a security team from BindView found a security hole in Syskey that indicated that a certain form of offline cryptanalysis attack is possible, making a brute force attack appear to be possible. Microsoft later issued a fix for the problem (dubbed the "Syskey Bug"). The bug affected both Windows NT 4.0 and pre-RC3 versions of Windows 2000.

---

Use as ransomware

Syskey is commonly abused by technical support scammers to lock victims out of their own computers in order to coerce them into paying a ransom. It is also used against such scammers by Scam baiting as a way to disrupt their fraudulent operations.

---

See also

• LM hash
• pwdump

Categories: Cryptographic Software, Microsoft Windows Security Technology, Windows Administration

Post Comment