bugtraq - Re: Insufficient Authentication vulnerability in Asus notebook

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c83481820905140637y408d688ap63ac1f7ef80c5994@mail.gmail.com>
Date: Thu, 14 May 2009 09:37:32 -0400
From: Jeremy Brown <0xjbrown41@...il.com>
To: MustLive <mustlive@...security.com.ua>, bugtraq@...urityfocus.com
Subject: Re: Insufficient Authentication vulnerability in Asus notebook

If you explore further research, you will find that this is not a bug,
this is well known, and its not particular to Asus.

2009/5/14 MustLive <mustlive@...security.com.ua>:
> Hello SecurityFocus!
>
> I want to warn you about Insufficient Authentication vulnerability in Asus
> notebook.
>
> After publication of information about Insufficient Authentication
> vulnerability in Acer notebooks
> (http://www.securityfocus.com/archive/1/503398/30/0/), I decided to
> investigate all notebooks of my friends. Particularly I checked two Asus
> notebooks: at one with Windows XP Professional there is no such
> vulnerability, at another with Windows XP Home Edition there is such
> vulnerability.
>
> In Windows XP Home in default administrator's account "Administrator" there
> is empty password. And it does not set equal to password of first admin,
> when admin account is creating during first start of notebook (as it happens
> during installation of Windows XP). So with physical access to notebook,
> anybody can enter into the system with administrator's rights.
>
> Vulnerable models of notebooks: Asus А6500R and potentially other models.
>
> I mentioned about these vulnerability at my site
> (http://websecurity.com.ua/3139/).
>
> Now I'm continue to investigate this situation. If you'll find such case in
> your notebook or in desktop PC, then inform me on email.
>
> Best wishes & regards,
> MustLive
> Administrator of Websecurity web site
> http://websecurity.com.ua
>