OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Inaccurate Information from Microsoft Resources Regarding EFS Features.
From: Zaid Ahmed (zaidahmedJCCS.COM.SA)
Date: Wed Sep 20 2000 - 00:35:55 CDT

Win II K Twister security advisory #1, 2000

Inaccurate Information from Microsoft Resources Regarding EFS Features.

Systems affected:
MS Win2000 Professional/Server line products.

Risk: Medium
Date: 20 September 2000

Legal Notice:
This Advisory is Copyright (c) 2000 Win II K Twister. You may distribute
it unmodified. You may not modify it and distribute it or distribute
parts of it without the author's written permission.

Disclaimer:
The opinions expressed in this advisory and program are my own and not
of any company.
The usual standard disclaimer applies, especially the fact that Win II K
Twister
is not liable for any damages caused by direct or indirect use of the
information or functionality provided by this advisory or program.
Win II K Twister, bears no responsibility for content or misuse of this
advisory or program or any derivatives thereof.

Description:

According to http://www.microsoft.com/TechNet/win2000/efsguide.asp
which is a good intro to EFS,
"However, if you copy an unencrypted file into an encrypted folder, the file
remains in the state that it was in-in this case the file remains
unencrypted."
++
But I searched more EFS information from the help file in my Win2K OS and
found the following:
Moving or renaming encrypted files
If a user moves a file to another folder, the file retains its encryption
state, regardless of whether the destination folder is encrypted or
unencrypted. For example, when moving an encrypted file to an unencrypted
folder, the file remains encrypted. When moving an unencrypted file to an
encrypted folder, the file remains unencrypted. Similarly, renaming an
encrypted file does not alter its encrypted status.
Copying encrypted files
When copying encrypted files to an unencrypted folder, encryption always
takes priority. Thus, when copying an unencrypted file to an encrypted
folder, EFS automatically encrypts the file. When copying an encrypted file
to an unencrypted folder, the file remains encrypted.
++

Details:
The only problem I have with what it says in the help file is I tried moving
an unencrypted file into an encrypted folder and it became encrypted where
it should not be by reading this paragraph..... does anyone get the same
results?
Whenever I copy a file into an encrypted folder from my unencrypted desktop,
then look at its properties, the encryption box is checked. Is this telling
me that it WILL encrypt the file if I click OK, or is it already encrypted,
and the above material is inaccurate?

Here is a link to the help file page on the internet...
<http://windows.microsoft.com/windows2000/en/server/help/default.asp?url=/wi
ndows2000/en/server/help/sag_seconceptsimpencrypt.htm>
It still says "When moving an unencrypted file to an encrypted folder, the
file remains unencrypted. "

As you can see in both resources, there is a conflict in MS information
resources which it would be a complete reversal of how all other copy/move
operations work.

Yeah, I think that the move vs. copy differences are a bit annoying at some
points.
I wish that there was a registry key, or even better a group policy setting
that could configure these settings.
It would make more sense if both move and copy did exactly the same thing in
regards to the permissions and compression.
Is MS usually so confused about its own products? Or is this a leftover from
a beta version, when it really did work like they said, and they neglected
to update their documentation when the final build was released? (which is
just as bad).
Now, does anybody know how we go about telling M$ that their documentation
is wrong?

Regards,

Win II K Twister,

_____________________________________________________________________
** TO UNSUBSCRIBE, send the command "UNSUBSCRIBE win2ksecadvice"
** FOR A WEEKLY DIGEST, send the command "SET win2ksecadvice DIGEST"
SEND ALL COMMANDS TO: listservlistserv.ntsecurity.net