bugtraq - Re: Insufficient Authentication vulnerability in Asus notebook

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 14 May 2009 23:38:00 -0700
From: Susan Bradley <sbradcpa@...bell.net>
To: Bob Fiero <i.am@...talfloss.net>
Cc: bugtraq@...urityfocus.com
Subject: Re: Insufficient Authentication vulnerability in Asus notebook

And you probably run AD queries to track this down.

The point is, this is not new, this is now more of a management problem, 
you wouldn't have a XP Home on your network anyway, and a little 
googling would have showcased this.

Vulnerability no.  Deployment issue yes.

Bob Fiero wrote:
> Oh please, I work with corporations large and small. I even work as an adviser to entire countries on how to rebuild after we bomb them to oblivion. Even in the strictest of environments there are always laptops with out of the box configs to be found.
>  
>
>   _____  
> From: Susan Bradley [mailto:sbradcpa@...bell.net]
> To: Bob Fiero [mailto:i.am@...talfloss.net]
> Cc: bugtraq@...urityfocus.com
> Sent: Thu, 14 May 2009 15:35:33 -0400
> Subject: Re: Insufficient Authentication vulnerability in Asus notebook
>
> Oh please.  Corporations build images of machines that don't have this.
>
> If you have this issue in your corporation, go talk to your IT guys and 
> tell them to build better deployment images.
>
> If you have this problem, your IT guys are not doing their job.
>
> Bob Fiero wrote:
>   
>>> You get the idea.  This is non issue.
>>>     
>>>       
>> I disagree. You are involved in intense business negotiations. During lunch you leave your notebook unattended assuming it is safe with a password protected
>> userID. Your competitor goes in to the conference room and logs in with
>> Administrator and installs something like eBlaster to log everything
>> you do and email it to him.
>>
>> Far fetched, but not a non-issue.
>>
>>   _____  
>> From: Mike Vasquez [mailto:mike.vasquez@...il.com]
>> To: Jeremy Brown [mailto:0xjbrown41@...il.com]
>> Cc: MustLive [mailto:mustlive@...security.com.ua], bugtraq@...urityfocus.com [mailto:bugtraq@...urityfocus.com]
>> Sent: Thu, 14 May 2009 11:02:38 -0400
>> Subject: Re: Insufficient Authentication vulnerability in Asus notebook
>>
>> Once someone has physical access all bets are off, there's a lot the  
>> can do.
>>
>> 1) steal it
>> 2) boot off cd and reset/enable admin acct
>> 3) boot off cd and grab all hashes
>> 4) pour a perfectly good frappucino on the keyboard
>> 5) cover it with smiley face stickers
>>
>>
>> You get the idea.  This is non issue.
>>
>>   
>>     
>
>