bugtraq - RE: Insufficient Authentication vulnerability in Asus notebook

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 14 May 2009 11:17:48 -0500
From: Mike Wilson <mwilson@...disys.com>
To: "'Bob Fiero'" <i.am@...talfloss.net>,
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: RE: Insufficient Authentication vulnerability in Asus notebook

Agreed, it is an oversimplification (or a surrender) to say that good security practice is useless on a laptop or tablet because it is not a case of if you will not have complete control, but rather when and for how long.  Indeed, a comprehensive security plan becomes that much more important.  Look at every laptop as if you will never see it again and ensure that your data remains yours, to the best of your ability.

Of course, having XP home may be considered a vulnerability in and of itself, but that is another matter.

What we as a community have to realize is that we have new blood coming in all the time and issues like this being brought back up are good to ensure that something as simple as this is not missed because it is assumed that we all know it.

Thanks,
_________________________
Mike Wilson

-----Original Message-----
From: Bob Fiero [mailto:i.am@...talfloss.net]
Sent: Thursday, May 14, 2009 10:12 AM
To: bugtraq@...urityfocus.com
Subject: Re: Insufficient Authentication vulnerability in Asus notebook

> You get the idea.  This is non issue.

I disagree. You are involved in intense business negotiations. During lunch you leave your notebook unattended assuming it is safe with a password protected
userID. Your competitor goes in to the conference room and logs in with
Administrator and installs something like eBlaster to log everything
you do and email it to him.

Far fetched, but not a non-issue.

  _____
From: Mike Vasquez [mailto:mike.vasquez@...il.com]
To: Jeremy Brown [mailto:0xjbrown41@...il.com]
Cc: MustLive [mailto:mustlive@...security.com.ua], bugtraq@...urityfocus.com [mailto:bugtraq@...urityfocus.com]
Sent: Thu, 14 May 2009 11:02:38 -0400
Subject: Re: Insufficient Authentication vulnerability in Asus notebook

Once someone has physical access all bets are off, there's a lot the
can do.

1) steal it
2) boot off cd and reset/enable admin acct
3) boot off cd and grab all hashes
4) pour a perfectly good frappucino on the keyboard
5) cover it with smiley face stickers

You get the idea.  This is non issue.

*** NOTICE--The attached communication contains privileged and confidential information. If you are not the intended recipient, DO NOT read, copy, or disseminate this communication. Non-intended recipients are hereby placed on notice that any unauthorized disclosure, duplication, distribution, or taking of any action in reliance on the contents of these materials is expressly prohibited. If you have received this communication in error, please delete this information in its entirety and contact the Amedisys Privacy Hotline at 1-866-518-6684. Also, please immediately notify the sender via e-mail that you have received this communication in error. ***