RE: SAM Switch - Win2k/XP password-less login

["Schmehl, Paul L" <pauls () utdallas edu>]

> -----Original Message-----
> From: Palan [mailto:Palan () myrealbox com] 
> Sent: Thursday, September 25, 2003 8:33 AM
> To: full-disclosure () lists netsys com
> Subject: [Full-disclosure] SAM Switch - Win2k/XP password-less login
>
> I found that SAM file could be replaced just like PWL files 
> in Win9x. I posted the following to Bugtraq, but in spite of 
> posting twice it never appeared in the list... (possibly moderated)
>
> Folks, go ahead and change the boot options in your BIOS ASAP.

I guess this fallacy will never go away.  Changing the boot options in
your BIOS will actually exactly nothing.  Anyone with a modicum of
computer knowledge and physical access to your box can change them back
at will.  Trusting the BIOS to "protect" you against attack is
foolhardy.  Its password protection is worthless.  Many BIOSes have
backdoor passwords "in case of emergency", and all BIOSes can be easily
reset to default passwordless configuration.

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/ 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html