full-disclosure - SAM Switch - Win2k/XP password-less login

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: lists at onryou.com (Cael Abal)
Subject: SAM Switch - Win2k/XP password-less login

>>I found that SAM file could be replaced just like PWL files 
>>in Win9x. I posted the following to Bugtraq, but in spite of 
>>posting twice it never appeared in the list... (possibly moderated)
>>
>>Folks, go ahead and change the boot options in your BIOS ASAP.
> 
> I guess this fallacy will never go away.  Changing the boot options in
> your BIOS will actually exactly nothing.  Anyone with a modicum of
> computer knowledge and physical access to your box can change them back
> at will.  Trusting the BIOS to "protect" you against attack is
> foolhardy.  Its password protection is worthless.  Many BIOSes have
> backdoor passwords "in case of emergency", and all BIOSes can be easily
> reset to default passwordless configuration.

We've always known that once an attacker has physical access to a
machine it's vulnerable to a host of low-tech attacks...  That doesn't
mean that we collectively throw our hands up in the air and leave the
root password on a note next to the keyboard.

In reality, all our efforts to prevent local attacks are little more
than an inconvenience, placed into effect in order to repel casual
snoops and the least persistent attackers.

Don't want users to have admin-level privs?  Develop an appropriate
security policy and implement it.  Don't want them to circumvent your
policy?  Implement safeguards.  Don't want them to side-step your
safeguards?  Well, how many levels deep are you prepared to go?

In all but the most security-conscious orgs I think the consensus is
that if the attacker is prepared to crack open a case, they're going to
get root.  I know that my network's security just isn't worth epoxying
cases shut.  :)

Cheers,

Cael