Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
[Full-Disclosure] Re: Vulnerability in IBM Windows XP: default hidden Administrator account allows local Administrator access
From: Larry Mitchell (listse-lsd.com)
Date: Mon Sep 20 2004 - 08:53:03 CDT
Windows XP home edition hides the administrator account and disables access
to it entirely even from a manual login unless you are in safe mode. This
seems to be the most likely explaination of this "hidden" admin account.
----- Original Message -----
From: "Michael Wilson, Contractor" <mwwilsonnavo.hpc.mil>
To: "Chris Norton" <kicktd_listhotmail.com>; "Michael Scheidell"
Cc: <vulnsecurity-corporation.com>; <security-alertaustin.ibm.com>;
Sent: Friday, September 17, 2004 3:08 PM
Subject: RE: Vulnerability in IBM Windows XP: default hidden Administrator
account allows local Administrator access
> In previous versions of Windows (NT core), the install would allow you to
> simply strike <enter> at the appropriate time, when being queried for an
> administrator password, and voila -> the administrative password would be
> Windows XP manual install will ask if you are sure, while warning of the
> implications, and if you insist it disallows network access to the
> administrator account to limit WAN or LAN hacking. I was working IA at a
> major university when this, administrator account logins checking for
> or the password "password", became quite a problem. The response would
> often be, "I forgot to reset after the install!" I pushed a domain policy
> denying access to the local administrator password from the network,
> regardless of what the password was.
> Windows has instituted the same by default, thereby limiting this exploit
> a console login, if the password hash = blank hash.
> It is most likely the Vendor Install Customization that has caused this
> issue, as true enough, most vendor installs force you to pick an
> administrator password before using the system. If the account is hidden,
> then it is definitely IBM's doing as I have never seen a Windows install
> where the administrator account could not be seen under the accounts tab.
> Thank you,
> Michael Wilson CISSP (Contractor)
> Lockheed Martin Space Operations
> Computer Security Specialist
> -----Original Message-----
> From: Chris Norton [mailto:kicktd_listhotmail.com]
> Sent: Friday, September 17, 2004 10:59 AM
> To: Michael Scheidell; bugtraqsecurityfocus.com;
> vulnwatchvulnwatch.org; full-disclosurelists.netsys.com
> Cc: vulnsecurity-corporation.com; security-alertaustin.ibm.com;
> Subject: Re: Vulnerability in IBM Windows XP: default hidden
> Administrator account allows local Administrator access
> This "hidden" Administrator account is part of Windows XP and NOT IBM's
> Every Windows XP system ships and installs with the Administrator and
> This "hidden" account has been known about for some time, just like
> Administrator account is the same way. There are ways to disable or change
> Administrator name and password or to disable the account completely.
> Chris Norton
> UAT Student Software Engineering Network Defense
Full-Disclosure - We believe in it.