bugtraq - RE: Re: Vulnerability in IBM Windows XP: default hidden Administrator account allows local Administrator access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 17 Sep 2004 18:22:28 -0400
From: "pingywon MCSE" <pingywon@...mail.com>
To: "'Chris Norton'" <kicktd_list@...mail.com>,
   "'Michael Scheidell'" <scheidell@...nap.net>, <bugtraq@...urityfocus.com>,
   <vulnwatch@...nwatch.org>, <full-disclosure@...ts.netsys.com>
Cc: <vuln@...urity-corporation.com>, <security-alert@...tin.ibm.com>,
   <cert@...ibm.com>
Subject: RE: Re: Vulnerability in IBM Windows XP: default hidden Administrator account allows local Administrator access


I integrate tons of these PC and personally have always looked to it as a
back door in. My client aren't smart enough to figure this out. I realize
that is no excuse.

Looks like I am just going to have to image one of these before IBM patches
it :)

~pingywon MCSE
 
http://www.pingywon.com

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Chris Norton
Sent: Friday, September 17, 2004 11:59
To: Michael Scheidell; bugtraq@...urityfocus.com; vulnwatch@...nwatch.org;
full-disclosure@...ts.netsys.com
Cc: vuln@...urity-corporation.com; security-alert@...tin.ibm.com;
cert@...ibm.com
Subject: [Full-Disclosure] Re: Vulnerability in IBM Windows XP: default
hidden Administrator account allows local Administrator access

This "hidden" Administrator account is part of Windows XP and NOT IBM's
porblem.
Every Windows XP system ships and installs with the Administrator and blank
password.
This "hidden" account has been known about for some time, just like Windows
2000
Administrator account is the same way. There are ways to disable or change
the
Administrator name and password or to disable the account completely.
--
Chris Norton
UAT Student Software Engineering Network Defense

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.754 / Virus Database: 504 - Release Date: 9/6/2004
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.754 / Virus Database: 504 - Release Date: 9/6/2004
 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html