Local Security Authority Subsystem Service

Local Security Authority Subsystem Service (LSASS), is a process in Microsoft Windows operating systems that is responsible for enforcing the security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens. It also writes to the Windows Security Log.

The Sasser worm exploited a vulnerability in LSASS [http://www.ppedia.com/p30_lsass-lsass.exe.htm] to spread via a remote buffer overflow in computers running Microsoft Windows XP and Windows 2000. The worm is particularly potent in that it can spread without any interaction with humans, nor does it 'travel by email' like many other worms.

Should the lsass.exe program end, for example, by the Sasser worm's effects, then a countdown timer will appear on the screen, advising the user to save their work and close all programs before Windows shuts down. This timer, however, can be thwarted by changing the computer's date and time settings or by executing the shutdown -a command.

Forcible termination of lsass.exe will result in the Welcome screen losing its accounts, prompting a restart of the machine, therefore lsass.exe should not be considered the Sasser worm.

External links

* [http://www.microsoft.com/technet/security/topics/identitymanagement/idmanage/p2pass_1.mspx MS identity management]
* [http://www.processlibrary.com/directory/files/lsass/ ProcessLibrary.com lsass.exe info]