Contents Up << >>
What data is gathered under NT 3.51/4.0 ?
This section lists what data is collected from a Windows NT system during a slow poll.
- Performance data delivered by the system through the HKEY_PERFORMANCE_DATA registry key.
This includes detailed system statistics like for instance: Number of page faults per second,
the average number of bytes read/written to disk per second, cash statistics like the number
of pages flushed/read per second and heaps of other system statistics. The performace data
seems to cover all interesting areas ranging from processor timings, to network
and memory statistics. The performance monitor application that comes with NT uses this registry
key to gain access to the performance data. The performance monitor application also gives
explanations on what data can be collected from the system, in other words if you are curious have
a look at it. In principle it is possible to read the performance data of another machine
this may limit the usefulness of the performance data in some attack scenarios, i.e. if the attacker
is on your LAN and has the necessary access rights. On my system about 30K of performance data
is delivered through the registry key.
- All of the most recent entries of the application and system log files which do fit into 4 kilobytes.
This information seems not really to be very valuable as is does not change too often, at least
on my NT Workstation. On the other hand it does no damage. As it is also possible to read the
log files of another computer, even without any special access rights, the usefulness of this
information approaches zero if the attacker is on your LAN.
- Certain network statistics for the Server and the Workstation service, like the number of bytes
read/written. This information seems to be contained in the
performance data anyway. I decided to query for both the Server and the Workstation service
statistics independent of whether we have an NT server or a workstation. This could lead
to problems if some sites disable the workstation service on their servers and vice versa, i.e.
disable the Server service on the workstations. And: If the attacker is on your LAN network
statistics are also not very useful.
It seems that the information which is provided by NT via the performance data registry key contains
most of the data which is obtained through the other two sources. I.e. we probably could do without
the other sources and not lose any significant amount of entropy.