full-disclosure - RE: NetWare Screensaver Authentication Bypass From The Local Console

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: steve at myself.gen.nz (Steve Wray)
Subject: RE: NetWare Screensaver Authentication Bypass
	From The Local Console

James Tucker wrote:
> Frankly the ability to bypass any authentication procedure by a series
> of button presses is plain bad software design, period.
> 
> If you don't believe me, go watch any "hacker film" and see how
> Hollywood shows most hackers gaining entry to systems. Sure, sounds
> stupid if its not a reality, and just plain scary if it is. Well this
> is exactly that, walk up to the console, tappedy tap and your in.
> Anyone for tea and biscuits?
> 
> I hope some Novell executives felt sick when they heard about this
> one, because they really should; I know I wouldn't have maintained my
> breakfast after such an announcement.


I know a few people who are *deeply* committed to Novell and love to 
boast about its uptime and security so I brought this to their attention.

The response?

"Yeah I've used that a few times to save my ass"

Its well known in the Netware community and has been for some time.

The perception is, that once someone has physical access its all over 
anyway; my response to that is "just cos they have an opportunity to tap 
away on a keyboard doesn't mean they have an opportunity to mess with 
the hardware."