bugtraq - Re: Wireless networks/Default Admin username security problem in Croatia

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4204800C.6040203@syneticon.de>
Date: Sat, 05 Feb 2005 09:13:00 +0100
From: Denis Jedig <seclists@...eticon.de>
To: Radoslav Dejanović <radoslav.dejanovic@...us.hr>
Cc: "bugtraq-securityfocus.com" <bugtraq@...urityfocus.com>
Subject: Re: Wireless networks/Default Admin username security problem in
 Croatia

Radoslav Dejanović wrote:

> - since there's just a dozen of default administrator usernames and none of 
> them has a password associated with it, it is a child's play to hook on 
> the wireless network and connect to user's computer

Please consider that at least in the default config of Windows XP 
professional, the system does not allow remote connections which are 
authenticated by an account with a blank password. This especially 
includes the entire SMB stuff (RPC, file shares, named pipes) and remote 
desktop connections (Blank Password Restrictions).

References:
http://www.microsoft.com/resources/documentation/windows/xp/all/reskit/en-us/prdp_log_tyry.asp
http://www.microsoft.com/technet/prodtechnol/winxppro/evaluate/xpsec.mspx

Regards,

Denis Jedig
syneticon GbR