![]() | |||||||||||||
Messages in this thread |
On Wed, 10 Jun 1998, Rob Hagopian wrote: > > There is even a "general-purpose" password that will get you into > > the ROM-BIOS Setup of most computers. This is so you don't have > > to short out the battery if the password is lost. > > I have yet to hear of one, and usually they do get circulated; if you > follow Bugtraq, 3com just got bitten by this one. Most computers that I > know of have jumpers inside (ie. lock the case) that will reset the > password. Well, I just posted one: Award BIOS: AWARD_SW in all uppercase This has successfully has bypassed the password on every single machine I've ever been on that had a password, and an award BIOS. If you have an award BIOS, try it out yourself. You'll have to put in a password first though... Here are some other ones: Award BIOS: AWARD_SW, j262 , HLT, SER, SKY_FOX, BIOSTAR, ALFAROME, lkwpeter, j256, AWARD?SW, LKWPETER, Syxz, aLLy, 589589, 589721, awkward AMI BIOS: AMI, BIOS, PASSWORD, HEWITT RAND, AMI?SW, AMI_SW, LKWPETER, A.M.I. I've used "AMI, AMI_SW" successfully as well... If noneoftheabove works, blowing the CMOS ram in DOS debug with OUT's to port 70 and 71 usually does the job quite nicely. Not exactly what I'd call security, however when I was the System Admin at John Howard Society here in town, I had multiple occasions when staff had set their CMOS passwords and forgot them, or someone else had set them that no longer worked there. Also, we had client computers that got viruses dumped on them, and CMOS passwords changed, etc... anything you can imagine. Thanks to www.hotbot.com, and a few hours searching, I came up with countless PC security holes and bypasses. I now assume EVERYTHING has a back door. If anyone has backdoor passwords for Pheonix BIOS, and other BIOS's I'd sure appreciate them as well. I've had to open a few machines and pull the battery because they weren't AMI or AWARD. ;o( > > If you need security, you put the machine in a locked room and > > access it over the network or a serial link. That's what we do > > with all our servers including name-servers, etc. > > People can run packet sniffers on shared networks, so now we're back to > using serial links for secure systems? Wonderful. And don't forget, > physical security ain't all it's cracked up to be... Agreed. Security is a multilevel thing. Look at a reference on security designations for an idea of different security measures. I have a book called "Internet Firewalls and Network Security" which discusses this in detail. Security comes in many flavours, hardware, software, and of course security through obscurity. It doesn't come from the CMOS or from a particular mainstream graphical shell that is sold as "an operating system" though. ;o) Take care. TTYL Escape from the confines of Microsoft's operating systems and push your PC to it's limits with LINUX - a real OS. http://www.redhat.com - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu | ||||||||||||
| Last update: 2005-03-22 13:43 [from the cache] ©2003-2008 | |||||||||||||