From: Bob Fiero (i.ammentalfloss.net)
Date: Thu May 14 2009 - 10:11:51 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

> You get the idea. This is non issue.

I disagree. You are involved in intense business negotiations. During lunch you leave your notebook unattended assuming it is safe with a password protected
userID. Your competitor goes in to the conference room and logs in with
Administrator and installs something like eBlaster to log everything
you do and email it to him.

Far fetched, but not a non-issue.

  _____
From: Mike Vasquez [mailto:mike.vasquezgmail.com]
To: Jeremy Brown [mailto:0xjbrown41gmail.com]
Cc: MustLive [mailto:mustlivewebsecurity.com.ua], bugtraqsecurityfocus.com [mailto:bugtraqsecurityfocus.com]
Sent: Thu, 14 May 2009 11:02:38 -0400
Subject: Re: Insufficient Authentication vulnerability in Asus notebook

Once someone has physical access all bets are off, there's a lot the
can do.

1) steal it
2) boot off cd and reset/enable admin acct
3) boot off cd and grab all hashes
4) pour a perfectly good frappucino on the keyboard
5) cover it with smiley face stickers

You get the idea. This is non issue.

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]