bugtraq - RE: Insufficient Authentication vulnerability in Asus notebook

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <097B1E4792366344925A4B6B99C00A82932CDCA267@zaphod.home.jalojash.org>
Date: Sun, 17 May 2009 09:10:15 -0700
From: Jim Harrison <Jim@...tools.org>
To: Mike Wilson <mwilson@...disys.com>,
	"'Susan Bradley'" <sbradcpa@...bell.net>,
	"my.security.lists@...il.com" <my.security.lists@...il.com>
Cc: MustLive <mustlive@...security.com.ua>,
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: RE: Insufficient Authentication vulnerability in Asus notebook

The difference here is that renaming the admin also offers a some mitigation against local (e.g., non-networked) attacks for when the same person that can't be bothered to lock their session is rewarded with the latest d1psh1t virus when they download their porn-mule update. Installing the OS on something other than C: and renaming the admin account (regardless of the password) thwarts (sound of water dripping) most common local-attack methods. Simple and effective.

IOW:
1. no, this is not a "vulnerability in software", but build process failure by the OEM. As others have pointed out, this is frequently done to allow "ease of recovery" for the user.
2. there is no expectation (sadly) that OEM will perform any sort of security configuration on their products; typically, this is what "Bob's Security Suite" is intended to accomplish (I know...)
3. anyone leaving their session unlocked when they're removed from it for any length of time is a fuul (IMHO). It takes barely more than 0 seconds to hit <WIN>-L as you move away from the keyboard. ..of course, this habit may be offset by a 4-character password policy...

-----Original Message-----
From: Mike Wilson [mailto:mwilson@...disys.com] 
Sent: Thursday, May 14, 2009 1:14 PM
To: 'Susan Bradley'; my.security.lists@...il.com
Cc: MustLive; bugtraq@...urityfocus.com
Subject: RE: Insufficient Authentication vulnerability in Asus notebook

A better option is to set a strong password and set a local policy that the local admin account cannot be accessed over the network.  I'm a big advocate of that in all environments and prevents the need for renaming the account to prevent automated attacks.

Thanks,
_________________________
Mike Wilson

-----Original Message-----
From: Susan Bradley [mailto:sbradcpa@...bell.net]
Sent: Thursday, May 14, 2009 2:39 PM
To: my.security.lists@...il.com
Cc: MustLive; bugtraq@...urityfocus.com
Subject: Re: Insufficient Authentication vulnerability in Asus notebook

We're talking XP Home here, right?  A admin account without a password
cannot be access remotely over the internet, so if you have physical
access at all times of that Asus netbook it's arguably more secure in
some circumstances.

nameless wrote:
> Susan Bradley wrote:
>
>> 3.  For XPs it's kinda handy to have a blank admin password when you
>> sometimes come in on a network and need to get to that particular
>> machine and you didn't set it up, otherwise you have to use the Admin
>> password boot disk trick and reset the password to blank.
>>
>
> You should only do the above recommendation, if you like to have your
> boxes owned.
>
> You should not have any administrative accounts named "Administrator"
> and _all_ administrative accounts should have a _STRONG_ password
> associated with them.
>
> No exceptions.
>
> Password safes are available at no charge.  If you somehow forget your
> password, you can always reset it via AD or resetting the SAM.
>
>
>

*** NOTICE--The attached communication contains privileged and confidential information. If you are not the intended recipient, DO NOT read, copy, or disseminate this communication. Non-intended recipients are hereby placed on notice that any unauthorized disclosure, duplication, distribution, or taking of any action in reliance on the contents of these materials is expressly prohibited. If you have received this communication in error, please delete this information in its entirety and contact the Amedisys Privacy Hotline at 1-866-518-6684. Also, please immediately notify the sender via e-mail that you have received this communication in error. ***