> -----Original Message----- > From: Palan [mailto:[EMAIL PROTECTED] > Sent: Thursday, September 25, 2003 8:33 AM > To: [EMAIL PROTECTED] > Subject: [Full-Disclosure] SAM Switch - Win2k/XP password-less login > > I found that SAM file could be replaced just like PWL files > in Win9x. I posted the following to Bugtraq, but in spite of > posting twice it never appeared in the list... (possibly moderated) > > Folks, go ahead and change the boot options in your BIOS ASAP.
I guess this fallacy will never go away. Changing the boot options in your BIOS will actually exactly nothing. Anyone with a modicum of computer knowledge and physical access to your box can change them back at will. Trusting the BIOS to "protect" you against attack is foolhardy. Its password protection is worthless. Many BIOSes have backdoor passwords "in case of emergency", and all BIOSes can be easily reset to default passwordless configuration. Paul Schmehl ([EMAIL PROTECTED]) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu/~pauls/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
