bugtraq - Re: Bios Information Leakage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20051216101651.F21095@zarathustra.linux666.com>
Date: Fri, 16 Dec 2005 10:33:21 +0100 (CET)
From: Ron van Daal <ronvdaal@....nl>
To: bugtraq@...urityfocus.com
Cc: Jonathan Brossard <jbrossar@...sel.emse.fr>
Subject: Re: Bios Information Leakage

On Tue, 13 Dec 2005, Jonathan Brossard wrote:

> The two following techniques were pretty common under MS DOS several years
> ago (see the "Bios Companion" [4] for instance).
> It made use of debug to access physical ports. Under Linux, this
> requires special permissions that are given using ioperm.

> The main idea to reset CMOS is to make the checksum fail.

To make the CMOS checksum fail in the 'good old DOS days' I just typed a
file to CLOCK$ which caused the CMOS to be partly overwritten, disabling
the BIOS password checks.

I agree with you on the fact that plaintext password storage is outdated.

Kind regards,

Ron van Daal
The Netherlands