[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: Insufficient Authentication vulnerability in Asus notebook

Is there something like su/sudo in the Windows world ? How do windows administrators handle this (ie accountability) ?

On Thu, 14 May 2009, Mike Wilson wrote:

A better option is to set a strong password and set a local policy that the local admin account cannot be accessed over the network.  I'm a big advocate of that in all environments and prevents the need for renaming the account to prevent automated attacks.

Mike Wilson

-----Original Message-----
From: Susan Bradley [mailto:sbradcpa@xxxxxxxxxxx]
Sent: Thursday, May 14, 2009 2:39 PM
To: my.security.lists@xxxxxxxxx
Cc: MustLive; bugtraq@xxxxxxxxxxxxxxxxx
Subject: Re: Insufficient Authentication vulnerability in Asus notebook

We're talking XP Home here, right?  A admin account without a password
cannot be access remotely over the internet, so if you have physical
access at all times of that Asus netbook it's arguably more secure in
some circumstances.

nameless wrote:
Susan Bradley wrote:

3.  For XPs it's kinda handy to have a blank admin password when you
sometimes come in on a network and need to get to that particular
machine and you didn't set it up, otherwise you have to use the Admin
password boot disk trick and reset the password to blank.

You should only do the above recommendation, if you like to have your
boxes owned.

You should not have any administrative accounts named "Administrator"
and _all_ administrative accounts should have a _STRONG_ password
associated with them.

No exceptions.

Password safes are available at no charge.  If you somehow forget your
password, you can always reset it via AD or resetting the SAM.

*** NOTICE--The attached communication contains privileged and confidential information. If you are not the intended recipient, DO NOT read, copy, or disseminate this communication. Non-intended recipients are hereby placed on notice that any unauthorized disclosure, duplication, distribution, or taking of any action in reliance on the contents of these materials is expressly prohibited. If you have received this communication in error, please delete this information in its entirety and contact the Amedisys Privacy Hotline at 1-866-518-6684. Also, please immediately notify the sender via e-mail that you have received this communication in error. ***