Re: Speaking of SysRQ...

Mike A. Harris (mharris@ican.net)
Fri, 12 Jun 1998 06:21:26 -0400 (EDT)


On Wed, 10 Jun 1998, Rob Hagopian wrote:

> > There is even a "general-purpose" password that will get you into
> > the ROM-BIOS Setup of most computers. This is so you don't have
> > to short out the battery if the password is lost.
>
> I have yet to hear of one, and usually they do get circulated; if you
> follow Bugtraq, 3com just got bitten by this one. Most computers that I
> know of have jumpers inside (ie. lock the case) that will reset the
> password.

Well, I just posted one:

Award BIOS: AWARD_SW in all uppercase

This has successfully has bypassed the password on every single
machine I've ever been on that had a password, and an award BIOS.
If you have an award BIOS, try it out yourself. You'll have to
put in a password first though...

Here are some other ones:

Award BIOS:

AWARD_SW, j262 , HLT, SER, SKY_FOX, BIOSTAR, ALFAROME,
lkwpeter, j256, AWARD?SW, LKWPETER, Syxz, aLLy, 589589,
589721, awkward

AMI BIOS:
AMI, BIOS, PASSWORD, HEWITT RAND, AMI?SW, AMI_SW, LKWPETER,
A.M.I.

I've used "AMI, AMI_SW" successfully as well...

If noneoftheabove works, blowing the CMOS ram in DOS debug with
OUT's to port 70 and 71 usually does the job quite nicely. Not
exactly what I'd call security, however when I was the System
Admin at John Howard Society here in town, I had multiple
occasions when staff had set their CMOS passwords and forgot
them, or someone else had set them that no longer worked there.
Also, we had client computers that got viruses dumped on them,
and CMOS passwords changed, etc... anything you can imagine.
Thanks to www.hotbot.com, and a few hours searching, I came up
with countless PC security holes and bypasses. I now assume
EVERYTHING has a back door.

If anyone has backdoor passwords for Pheonix BIOS, and other
BIOS's I'd sure appreciate them as well. I've had to open a few
machines and pull the battery because they weren't AMI or AWARD.
;o(


> > If you need security, you put the machine in a locked room and
> > access it over the network or a serial link. That's what we do
> > with all our servers including name-servers, etc.
>
> People can run packet sniffers on shared networks, so now we're back to
> using serial links for secure systems? Wonderful. And don't forget,
> physical security ain't all it's cracked up to be...

Agreed. Security is a multilevel thing. Look at a reference on
security designations for an idea of different security measures.
I have a book called "Internet Firewalls and Network Security"
which discusses this in detail.

Security comes in many flavours, hardware, software, and of
course security through obscurity. It doesn't come from the CMOS
or from a particular mainstream graphical shell that is sold as
"an operating system" though. ;o)

Take care.
TTYL

Escape from the confines of Microsoft's operating systems and push your
PC to it's limits with LINUX - a real OS. http://www.redhat.com

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu