Once someone has physical access all bets are off, there's a lot the
can do.
1) steal it
2) boot off cd and reset/enable admin acct
3) boot off cd and grab all hashes
4) pour a perfectly good frappucino on the keyboard
5) cover it with smiley face stickers
You get the idea. This is non issue.
On May 14, 2009, at 6:37 AM, Jeremy Brown <0xjbrown41@xxxxxxxxx> wrote:
If you explore further research, you will find that this is not a bug,
this is well known, and its not particular to Asus.
2009/5/14 MustLive <mustlive@xxxxxxxxxxxxxxxxxx>:
Hello SecurityFocus!
I want to warn you about Insufficient Authentication vulnerability
in Asus
notebook.
After publication of information about Insufficient Authentication
vulnerability in Acer notebooks
(http://www.securityfocus.com/archive/1/503398/30/0/), I decided to
investigate all notebooks of my friends. Particularly I checked two
Asus
notebooks: at one with Windows XP Professional there is no such
vulnerability, at another with Windows XP Home Edition there is such
vulnerability.
In Windows XP Home in default administrator's account
"Administrator" there
is empty password. And it does not set equal to password of first
admin,
when admin account is creating during first start of notebook (as
it happens
during installation of Windows XP). So with physical access to
notebook,
anybody can enter into the system with administrator's rights.
Vulnerable models of notebooks: Asus А6500R and potentially other
models.
I mentioned about these vulnerability at my site
(http://websecurity.com.ua/3139/).
Now I'm continue to investigate this situation. If you'll find such
case in
your notebook or in desktop PC, then inform me on email.
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua
