|
Foolproof is a desktop security software used on Windows 9x
platforms. Many school districts across the world are taking
it on as their only form of internal security.
Unfortunately, the name has falsely made them believe that
they are secure.
I was originally given the task of checking how secure this
software was for my school district while I was in my final
year of high school. Upon sitting down at the machine you
will notice that it loads a boot lock (won’t allow any "F"
keys to be pressed unless a password is entered and once you
get to a Dos prompt you will notice that there isn’t
anything on the drives. If you break out a copy of Fdisk you
will see that the boot lock program has changed the
partitions into non-Dos partitions so they cannot be messed
with). Once you boot the computer into Windows the first
thing this software does is load itself into every part of
memory that your computer will allow. This allows the
software to prevent the use of certain programs that are
specified in the settings by hogging all the memory which
will stop the it from loading because there is no memory
left to bring the program up.
Another thing noticed is the wonderful little lock program
down in your taskbar telling you the machine is locked
(Doesn’t this just beg to be messed with?).
Now that I’ve given some background on the program, here
comes the fun part. How to get around it.
1.
32-bit Software protection
oolproof is a 32-bit application. For some reason or
another they didn’t program any 16-bit protection. If
Foolproof has been setup to block the visibility of some
network drives all you have to do is go into the root of
your windows folder and run ‘fileman.exe’ (I realize this is
stupid, but you wouldn’t believe how many school districts
leave this one open). Once File Manager is open you should
be able to see and access all drives that you were locked
out of in My Computer.
2.
Password in plaintext?
This is another one I was never able to understand. If you
are going to have such a secure program, why can you take a
memory dump of the machine and find the password in plain
text? I’m not sure if this one works on newer versions, but
on older versions you just had to do a search in the memory
and find ‘Foolpr’ (that was another thing, I don’t know if
they thought it would be more secure if they didn’t put the
whole name or what, but that is how you find it). Usually
there are two passwords you want to find. The one to get in
and change settings, and a password to a higher access level
then what the machine boots up to.
3.
Remove it
The best way to get rid of a program is to remove it. So
this is how. When you are first booting and the background
to Windows first comes up hit ctrl-alt-del (Must be before
anything loads. Ex. Boot logo just disappeared, background
shows up, hit ctrl-alt-del). This will bring up the Close
Program dialog window. Now double click outside of the
window a couple of times really quickly until Task Manager
comes up (you will learn that Task Manager can be your best
friend in many situations. It may take you a couple of times
to get Task Manager up, but it will work eventually). From
this point click on File and then Run Application. Type in
"deltree /y C:SSS" (this is the default directory to
Foolproof. You might want to do some looking around before
you decide this is the directory you want to completely
delete). At this point, some computers will freeze. It’s
okay. Just hit ctrl-alt-del again and close down Task
Manager or whatever non-responding applications are open.
Once they are closed the deltree operation should continue
and delete the Foolproof directory before the registry goes
to load it. Once Windows finishes it’s loading process
(whether you have to login to the network first or not, load
the desktop and startup applications, etc.) will be when the
.dll errors will start happening. Write them down and remove
them out of the registry. Now Foolproof is removed far
enough to allow you full access of the local machine and
whatever kind of network access your user possesses on the
network.
4.
Bootlock
Remember earlier where I mentioned that it turns all
partitions into Non-Dos partitions? Well, lets have some fun
with this. There are two ways that I know of to remove
Bootlock. First, if you have a copy of Foolproof laying out
on a shared network drive go grab it (it doesn’t matter if
it has custom settings in it or not. If it doesn’t have
custom settings in it, then why are you reading this?). Run
the installer for Foolproof. When it asks you if you wish to
make an emergency repair disk, say yes. Use this disk to get
to a command prompt and then type ‘FPMOD -R’. This should
remove Bootlock for you so you can now have access to the
Dos layer of your computer if you boot with a boot disk. The
second way I know of getting around Bootlock is also with a
bootdisk. Make a bootdisk and put a copy of fdisk.exe and
ndd.exe (found in older version of Norton Utilities. Make
sure it is the Dos version) on it. Boot the computer with
the disk and Fdisk all the Non-Dos partitions. Exit out of
Fdisk and reboot with the disk still in the drive. Once you
are back at the prompt again run ndd.exe. It will scan all
hard drives and then come up asking you if you used to have
a hard drive but you aren’t able to access it now. Tell it
yes and it should restore the partitions without Bootlock.
5.
Novell Client
If you are on a network where the Novell Netware Client is
used, here is a good one for you. When at the Novell login
screen hit F1. This brings up the wonderful help system for
the Novell client. Like most people that program help files,
they are too lazy to take out the features that aren’t
needed. First go to File à Open. From this point find the
Foolproof directory (usually C:SSS) and rename it to
whatever you want. Exit out of the help system and login to
the network. Once you are at the desktop of your computer
restart your machine. When the computer boots back help
you’ll get a couple of errors that have to do with
Foolproof, but Foolproof will be gone. Do whatever you wish
to do with Foolproof turned off and when you are done just
rename the directory back to its original name. Wasn’t that
simple?
I’m sure there are many more ways to get around this sorry
excuse for security software, but I haven’t had the time to
try any new methods. I figure if you got something that
works, keep on using it till it doesn’t. I might write
another article in the future, but this will be it for now.
Greetz out to CyberArmy, Packetstorm, Sensimilla, Monkee,
and all my friends on Efnet.
Credits
written by QVCxQM
version 1.0 |