Win XP passwords rendered useless

[Ray Austin]

oh no Bill looks like your pants are down again.

http://www.extremetech.com/article2/0,3973,890171,00.asp

[Dr Mordrid]

Jesus, Mary & Joseph.....what the f*** are they doing over there?

Dr. Mordrid

[moreau]

WOW.

"If a bad guy has unrestricted physical access to your computer, it's not your computer anymore."




The epitome of a cop-out.

Kinda like saying: "Locks only keep out honest people", and then not bothering to lock your door.

You have to at least make it a little challenging to hackers. It is true that physical access make it almost impossible to stop hackers. Never the less...

[Elie]

Well I'll be sending a general broadcast tomorrow at work to warn them about this issue.

Thanks Ray,

[Hazmat2k]

Or you could just have tighter building security. If a malicious hacker has physical access to your system you've got a bit more to worry about than whether he has a 2000 setup disk.

[moreau]

Originally posted by Hazmat2k
Or you could just have tighter building security. If a malicious hacker has physical access to your system you've got a bit more to worry about than whether he has a 2000 setup disk.

Yes and no.

Someone already pointed out that there are academic computer labs, for instance, where only authorized users are allowed login privilages. So, someone from off- campus could come in and login in without priviliges and do there dirty work.

Now, another problem with this hol is that it allows saving to floppy from the Hard DIsk. So the above hacker could come in, save the encrypted password file to floppy, take it home, and use it in a potentially more malicious way from the comfort of his/her living room.

I could go on...

[Flying dutchman]

Nothing new there - NTFSDOS could do that years ago.

Two months ago, a colleague of mine started setting up a Windows 2000 server before going on vacation. Unfortunately, he had forgotten to check the "password never expires" checkbox for the administrator account. When he got back from his vacation, he couldn't get into the computer anymore to finish his work. The disk was formatted with NTFS of course. He asked me for help.

It took only a Linux bootable CD with a small hacker tool to remove the date restriction on the password, and we were in the system again in 5 minutes. So much for Windoze security.

[moreau]

I suppose one could make the argument that if any OS was truly secure (i.e. didn't allow someone with physical access to the comptuer to actually read or alter the contents of the HD), then sysadmins would be powerless to help a user who, say, forgot their password.