full-disclosure - SAM Switch - Win2k/XP password-less login

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: pauls at utdallas.edu (Schmehl, Paul L)
Subject: SAM Switch - Win2k/XP password-less login

> -----Original Message-----
> From: Palan [mailto:Palan@...ealbox.com] 
> Sent: Thursday, September 25, 2003 8:33 AM
> To: full-disclosure@...ts.netsys.com
> Subject: [Full-Disclosure] SAM Switch - Win2k/XP password-less login
> 
> I found that SAM file could be replaced just like PWL files 
> in Win9x. I posted the following to Bugtraq, but in spite of 
> posting twice it never appeared in the list... (possibly moderated)
> 
> Folks, go ahead and change the boot options in your BIOS ASAP.

I guess this fallacy will never go away.  Changing the boot options in
your BIOS will actually exactly nothing.  Anyone with a modicum of
computer knowledge and physical access to your box can change them back
at will.  Trusting the BIOS to "protect" you against attack is
foolhardy.  Its password protection is worthless.  Many BIOSes have
backdoor passwords "in case of emergency", and all BIOSes can be easily
reset to default passwordless configuration.

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/