bugtraq - Re: Insufficient Authentication vulnerability in Asus notebook

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 14 May 2009 14:09:20 -0700
From: nameless <my.security.lists@...il.com>
To: Steve Quan <sq01@...ku.ca>
Cc: Mike Wilson <mwilson@...disys.com>,
	"'Susan Bradley'" <sbradcpa@...bell.net>,
	MustLive <mustlive@...security.com.ua>,
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: Re: Insufficient Authentication vulnerability in Asus notebook

Steve Quan wrote:
> Is there something like su/sudo in the Windows world ? How do windows
> administrators handle this (ie accountability) ?

There is "runas".

There is no accountability with the local admin account.  You can
disable the account and use domain credentials, but when the domain
isn't available, you're screwed, so it is a poor decision.

This will be a big pissing contest as we all have our own opinions though...

---

In regards to changing the Admin account name, why make it easy for the
kiddiots?  It is trivial for any of us to bypass this, right?  But not
everyone is like us...  Sometimes those kiddiots get lucky, when we make
mistakes.

Changing the Administrator name is just another layer in the onion of
your defensive strategy.  It is done in conjunction with all of the
other changes that have been mentioned.  Which IMO are all equally
important.  Some are definitely more severe in regards to their
consequences, but they all carry a piece of the burden.

And I'm not trying to be a smart ass, but does anyone really use
LM-hashes anymore?

> 
> /Steve
> ---
> On Thu, 14 May 2009, Mike Wilson wrote:
> 
>> A better option is to set a strong password and set a local policy
>> that the local admin account cannot be accessed over the network.  I'm
>> a big advocate of that in all environments and prevents the need for
>> renaming the account to prevent automated attacks.
>>
>> Thanks,
>> _________________________
>> Mike Wilson
>>
>>
>>
>>
>> -----Original Message-----
>> From: Susan Bradley [mailto:sbradcpa@...bell.net]
>> Sent: Thursday, May 14, 2009 2:39 PM
>> To: my.security.lists@...il.com
>> Cc: MustLive; bugtraq@...urityfocus.com
>> Subject: Re: Insufficient Authentication vulnerability in Asus notebook
>>
>> We're talking XP Home here, right?  A admin account without a password
>> cannot be access remotely over the internet, so if you have physical
>> access at all times of that Asus netbook it's arguably more secure in
>> some circumstances.
>>
>> nameless wrote:
>>> Susan Bradley wrote:
>>>
>>>> 3.  For XPs it's kinda handy to have a blank admin password when you
>>>> sometimes come in on a network and need to get to that particular
>>>> machine and you didn't set it up, otherwise you have to use the Admin
>>>> password boot disk trick and reset the password to blank.
>>>>
>>>
>>> You should only do the above recommendation, if you like to have your
>>> boxes owned.
>>>
>>> You should not have any administrative accounts named "Administrator"
>>> and _all_ administrative accounts should have a _STRONG_ password
>>> associated with them.
>>>
>>> No exceptions.
>>>
>>> Password safes are available at no charge.  If you somehow forget your
>>> password, you can always reset it via AD or resetting the SAM.
>>>
>>>
>>>
>>
>> *** NOTICE--The attached communication contains privileged and
>> confidential information. If you are not the intended recipient, DO
>> NOT read, copy, or disseminate this communication. Non-intended
>> recipients are hereby placed on notice that any unauthorized
>> disclosure, duplication, distribution, or taking of any action in
>> reliance on the contents of these materials is expressly prohibited.
>> If you have received this communication in error, please delete this
>> information in its entirety and contact the Amedisys Privacy Hotline
>> at 1-866-518-6684. Also, please immediately notify the sender via
>> e-mail that you have received this communication in error. ***
>>


-- 
Rob

+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+
|                         _   |
|  ASCII ribbon campaign ( )  |
|   - against HTML email  X   |
|                        / \  |
|                             |
+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+