Re: Insufficient Authentication vulnerability in Asus notebook

[Jeremy Brown <0xjbrown41 () gmail com>]

If you explore further research, you will find that this is not a bug,
this is well known, and its not particular to Asus.

2009/5/14 MustLive <mustlive () websecurity com ua>:
> Hello SecurityFocus!
>
> I want to warn you about Insufficient Authentication vulnerability in Asus
> notebook.
>
> After publication of information about Insufficient Authentication
> vulnerability in Acer notebooks
> (http://www.securityfocus.com/archive/1/503398/30/0/), I decided to
> investigate all notebooks of my friends. Particularly I checked two Asus
> notebooks: at one with Windows XP Professional there is no such
> vulnerability, at another with Windows XP Home Edition there is such
> vulnerability.
>
> In Windows XP Home in default administrator's account "Administrator" there
> is empty password. And it does not set equal to password of first admin,
> when admin account is creating during first start of notebook (as it happens
> during installation of Windows XP). So with physical access to notebook,
> anybody can enter into the system with administrator's rights.
>
> Vulnerable models of notebooks: Asus А6500R and potentially other models.
>
> I mentioned about these vulnerability at my site
> (http://websecurity.com.ua/3139/).
>
> Now I'm continue to investigate this situation. If you'll find such case in
> your notebook or in desktop PC, then inform me on email.
>
> Best wishes & regards,
> MustLive
> Administrator of Websecurity web site
> http://websecurity.com.ua