Article View: comp.security.misc
Article #607Re: HELP! (Re: IBM password)
From: Doug Sewell
Date: Thu, 15 Oct 1992 15:36
Date: Thu, 15 Oct 1992 15:36
70 lines
3993 bytes
3993 bytes
S_TITZ@iravcl.ira.uka.de (Olaf Titz) writes: : In <1992Oct14.194137.26262@news.ysu.edu> doug@cc.ysu.edu writes: : : >... : > If you boot from a floppy disk, the machine hangs. If you boot from the : > hard-drive, the screen clears and the word 'Password:' is displayed. : > : > We suspect it's some form of commercial or shareware password protection : > that imbeds itself in the partition table or some other place where it : > will be activated during power-on self test. : > : > Do you have any suggestions (besides removing the hard drives - which : > we're considering ?) How do we get rid of it ? : : Try to remove the hard disk *logically*: go SETUP and mark the hard : disk as 'not installed' or the like. This will (should) prevent the : possibly tampered master boot record from being read. (Still, you can : try it with the disk taken out physically, this will guarantee that : the boot record gets not read ;-) If we do this, then the machine will boot completely from a floppy disk. But we can't access the hard drive to fix it. If the HD is configured in, then the machine will NOT complete a floppy-disk boot. : : If booting from a clean floppy (write-protected vanilla distribution : DOS disk, preferrably) still doesnt't work, you have probably either : an undocumented BIOS password feature (take the battery out for at : least two hours and try again...) or the person responsible (please This is why I suggested the possibility that the BIOS has an undocumented password feature. We can't find it, but perhaps someone else is aware of it, and hopefully they'd pass the info on to us. The idea that the password isn't invoked on a floppy boot, but that the boot hangs, makes me doubt this is the case - I'd figure that the machine would prompt for a password even on a floppy boot. : read below) has inserted other (perhaps selfmade) BIOS ROMS. (If you : have physical access to a machine, you just can do ANYTHING.) : Or the hardware is broken (have you taken this into consideration?) The machines have tamper-resistant screws, and is a high-traffic student lab, including student programming consultants, who would hopefully notice if a machine is being opened by someone that shouldn't be. : [...] : : Now: I'm trying hard not to flame, but this just makes me angry. I : think it WRONG WRONG WRONG to blame every intrusion/security : risk/breach to students in the first place. This attitude towards : students is responsible for a rather un-academic climate in many, if (1) This is a student lab. Few if any faculty have used the lab at all, and most faculty and staff have their own DOS or Unix workstations. (2) We have observed students installing other software on the HD's - mostly games that they didn't wish to carry around on floppy disk, but also other commercial programs. This makes a student the most likely candidate for having installed this program, as well. Perhaps it wasn't a student, and if it turns out to not be, then I will happily say so. But I feel very confident I won't have to. Right now I just want the machine back in working order, and to know what to do WHEN it happens again. -- Doug Sewell, Tech Support, Computer Center, Youngstown State University doug@cc.ysu.edu doug@ysub.bitnet <internet>!cc.ysu.edu!doug "Recession: your friend loses his job. Depression: you lose your job. Recovery: Bush loses his job" - Bill Davidsen
Technical Details
Message-ID:
<1992Oct15.153610.29280@news.ysu.edu>Path:
arc1-ca.pugleaf.net!sparky!uunet!stanford.edu!agate!usenet.ins.cwru.edu!news.ysu.edu!do-not-reply-to-pathReferences:
<1992Oct15.142406.152@rz.uni-karlsruhe.de>Show Full Headers
Complete Article Headers
Newsgroups: comp.security.misc Path: arc1-ca.pugleaf.net!sparky!uunet!stanford.edu!agate!usenet.ins.cwru.edu!news.ysu.edu!do-not-reply-to-path From: doug@cc.ysu.edu (Doug Sewell) Subject: Re: HELP! (Re: IBM password) Message-ID: <1992Oct15.153610.29280@news.ysu.edu> Sender: news@news.ysu.edu (Usenet News Admin) Nntp-Posting-Host: unix1.cc.ysu.edu Organization: Bush in 92 ? NOT! X-Newsreader: Tin 1.1 PL4 References: <1992Oct15.142406.152@rz.uni-karlsruhe.de> Date: Thu, 15 Oct 1992 15:36:10 GMT Lines: 70