4 ms·

The security issue is rebooting the machine and logging in with the default admin password? Thats really not a 'vulnerability'

by a2tech 9y ago

tinus_hn 9y ago
Even if you have a BIOS password and everything locked down and the attacker can actually lock you out or quickly give themselves a backdoor. The problem is that there are a million ways in, they're open by default and it is really hard to keep track of everything you have to lock down, and the manufacturers keep adding new ones while you're not looking. The right way for the manufacturers to set this up is * Everything locked down by default * One master password for complete control * Using the master password you can delegate control for users, technicians, applications etc. * If you forget the master password you can reset it using a switch or something you cannot access without opening up the machine which you cannot do while it is physically locked But in reality there's all these management 'solutions' that have to be on by default and then there are the anti theft solutions, the secure boot restrictions, the 'trusted' platform, the list goes on. And then for the master password there's of course a backdoor password the helpdesk people can get if you can convince them the laptop is yours and you just forgot the password.
- ComodoHacker 9y ago
  >The right way for the manufacturers to set this up is Is't this the case here? You have master password and you can change it provided physical access.
  - tinus_hn 9y ago
    It's more like an override, provided by a feature many people don't use. If they were using it they'd probably change the password from 'admin'. You can't add a backdoor with a password and then claim that's the new master password.
Bartweiss 9y ago
I suppose "update AMT password defaults" is good, non-obvious advice to spread. But it does feel a bit rich to describe physical access and a default password as the stuff of a security professional's "worst nightmares". "Physical access means control" has been a standard assumption for years, and this really just constitutes a failure to secure all login channels. It's a particularly silly description when Spectre and Meltdown are busy being actual "worst nightmares" threats.
- cjcampbell 9y ago
  It is, however, an incredibly predictable failure. As far as nightmares are concerned, I suppose it depends on the anxiety's of the particular security professional. ;)

The security issue is rebooting the machine and logging in with the default admin password? Thats really not a 'vulnerability'

by a2tech 9y ago

The security issue is rebooting the machine and logging in with the default admin password? Thats really not a 'vulnerability'

tinus_hn 9y ago

Even if you have a BIOS password and everything locked down and the attacker can actually lock you out or quickly give themselves a backdoor. The problem is that there are a million ways in, they're open by default and it is really hard to keep track of everything you have to lock down, and the manufacturers keep adding new ones while you're not looking. The right way for the manufacturers to set this up is * Everything locked down by default * One master password for complete control * Using the master password you can delegate control for users, technicians, applications etc. * If you forget the master password you can reset it using a switch or something you cannot access without opening up the machine which you cannot do while it is physically locked But in reality there's all these management 'solutions' that have to be on by default and then there are the anti theft solutions, the secure boot restrictions, the 'trusted' platform, the list goes on. And then for the master password there's of course a backdoor password the helpdesk people can get if you can convince them the laptop is yours and you just forgot the password.

ComodoHacker 9y ago
>The right way for the manufacturers to set this up is Is't this the case here? You have master password and you can change it provided physical access.
- tinus_hn 9y ago
  It's more like an override, provided by a feature many people don't use. If they were using it they'd probably change the password from 'admin'. You can't add a backdoor with a password and then claim that's the new master password.

Bartweiss 9y ago

I suppose "update AMT password defaults" is good, non-obvious advice to spread. But it does feel a bit rich to describe physical access and a default password as the stuff of a security professional's "worst nightmares". "Physical access means control" has been a standard assumption for years, and this really just constitutes a failure to secure all login channels. It's a particularly silly description when Spectre and Meltdown are busy being actual "worst nightmares" threats.

cjcampbell 9y ago
It is, however, an incredibly predictable failure. As far as nightmares are concerned, I suppose it depends on the anxiety's of the particular security professional. ;)