bugtraq - Re: Insufficient Authentication vulnerability in Asus notebook

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 14 May 2009 08:02:38 -0700
From: Mike Vasquez <mike.vasquez@...il.com>
To: Jeremy Brown <0xjbrown41@...il.com>
Cc: MustLive <mustlive@...security.com.ua>,
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: Re: Insufficient Authentication vulnerability in Asus notebook

Once someone has physical access all bets are off, there's a lot the  
can do.

1) steal it
2) boot off cd and reset/enable admin acct
3) boot off cd and grab all hashes
4) pour a perfectly good frappucino on the keyboard
5) cover it with smiley face stickers


You get the idea.  This is non issue.





On May 14, 2009, at 6:37 AM, Jeremy Brown <0xjbrown41@...il.com> wrote:

> If you explore further research, you will find that this is not a bug,
> this is well known, and its not particular to Asus.
>
> 2009/5/14 MustLive <mustlive@...security.com.ua>:
>> Hello SecurityFocus!
>>
>> I want to warn you about Insufficient Authentication vulnerability  
>> in Asus
>> notebook.
>>
>> After publication of information about Insufficient Authentication
>> vulnerability in Acer notebooks
>> (http://www.securityfocus.com/archive/1/503398/30/0/), I decided to
>> investigate all notebooks of my friends. Particularly I checked two  
>> Asus
>> notebooks: at one with Windows XP Professional there is no such
>> vulnerability, at another with Windows XP Home Edition there is such
>> vulnerability.
>>
>> In Windows XP Home in default administrator's account  
>> "Administrator" there
>> is empty password. And it does not set equal to password of first  
>> admin,
>> when admin account is creating during first start of notebook (as  
>> it happens
>> during installation of Windows XP). So with physical access to  
>> notebook,
>> anybody can enter into the system with administrator's rights.
>>
>> Vulnerable models of notebooks: Asus А6500R and potentially other  
>> models.
>>
>> I mentioned about these vulnerability at my site
>> (http://websecurity.com.ua/3139/).
>>
>> Now I'm continue to investigate this situation. If you'll find such  
>> case in
>> your notebook or in desktop PC, then inform me on email.
>>
>> Best wishes & regards,
>> MustLive
>> Administrator of Websecurity web site
>> http://websecurity.com.ua
>>
>