Re: SAM Switch - Win2k/XP password-less login

[Cael Abal <lists () onryou com>]

> > I found that SAM file could be replaced just like PWL files 
> > in Win9x. I posted the following to Bugtraq, but in spite of 
> > posting twice it never appeared in the list... (possibly moderated)
> >
> > Folks, go ahead and change the boot options in your BIOS ASAP.
>
> I guess this fallacy will never go away.  Changing the boot options in
> your BIOS will actually exactly nothing.  Anyone with a modicum of
> computer knowledge and physical access to your box can change them back
> at will.  Trusting the BIOS to "protect" you against attack is
> foolhardy.  Its password protection is worthless.  Many BIOSes have
> backdoor passwords "in case of emergency", and all BIOSes can be easily
> reset to default passwordless configuration.

We've always known that once an attacker has physical access to a
machine it's vulnerable to a host of low-tech attacks...  That doesn't
mean that we collectively throw our hands up in the air and leave the
root password on a note next to the keyboard.

In reality, all our efforts to prevent local attacks are little more
than an inconvenience, placed into effect in order to repel casual
snoops and the least persistent attackers.

Don't want users to have admin-level privs?  Develop an appropriate
security policy and implement it.  Don't want them to circumvent your
policy?  Implement safeguards.  Don't want them to side-step your
safeguards?  Well, how many levels deep are you prepared to go?

In all but the most security-conscious orgs I think the consensus is
that if the attacker is prepared to crack open a case, they're going to
get root.  I know that my network's security just isn't worth epoxying
cases shut.  :)

Cheers,

Cael

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html