The SAM Lock Tool, better known as Syskey (the name of its executable file) was a discontinued component of Microsoft Windows that encrypted the Security Account Manager (SAM) database using a 128-bit RC4 encryption key.
First introduced with Windows NT 4.0 SP3, Syskey was intended to protect against offline password cracking attacks by preventing the possessor of an unauthorized copy of the SAM file from extracting useful information from it.
Syskey could optionally be configured to require the user to enter the key during boot (as a startup password) or load the key onto removable storage media (e.g., a floppy disk or USB flash drive).
The "Syskey Bug"
In December 1999, a security team from BindView found a security hole in Syskey that indicated that a certain form of offline cryptanalytic attack is possible, making a brute force attack appear to be possible.
Use as ransomware
Deprecation and removal
As of the Windows 10 Fall Creators Update and Windows Server "RS3" (due to its weak cryptography and ransomware risks), Syskey was removed from all Microsoft operating systems, with Microsoft terming it a "non-secure security feature". Microsoft recommends BitLocker as replacement.
- "Enable Syskey To Protect Windows From Password Cracking". Technig. 2015-04-06. Retrieved 2018-02-04.
- Sabin, Todd (December 16, 1999). "bindview.syskey.txt". Packet Storm. Retrieved July 1, 2016.
- "How to use the SysKey utility to secure the Windows Security Accounts Manager database". Support. Microsoft. 8 January 2018.
- Khanse, Anand (March 9, 2012). "Use SysKey Utility to lock Windows computer using USB stick". The Windows Club. Retrieved July 1, 2016.
- "SOLUTION: "This is Microsoft Support" telephone scam – Computer ransom lockout". Case Studies. Triple-S Computers. 10 April 2013.
- "Tech support company with workers in India claims its 'good name' being ruined by scammers". Sydney Morning Herald. Retrieved 23 February 2017.
- "Kitboga - Twitch".
- "Features that are removed or deprecated in Windows 10 Fall Creators Update". Support. Microsoft. 12 December 2017.
- "Syskey.exe utility is no longer supported in Windows 10 version 1709 and Windows Server version 1709". Support. Microsoft. 20 October 2017.