Re: [VulnWatch] Blank Administrator password in DELL XP Professional install

A blank password on an local admin account cannot be connected to =

remotely.  Some folks argue that a blank admin password if you have =

physical security of a box is actually more secure.

"Microsoft" sets up a backdoor?  Oh please.  Physical access to a =

machine and with a linux boot disk and can reset a password.  This is =

law 3 of the laws of security.

Optiplex's prompt you to set an admin password,  Dimensions [the =

consumer ones] don't wizard you through setting a password.

Maybe you just need to buy the right version of Dell to give you the =

wizard experience you want.


James Bender wrote:

>This is not a vulnerability on just DELL machines.  This is a default ou=
t of the box configuration for any Windows XP Pro, or Windows 2003 Operat=
ing System, regardless of type (I.E - OEM, Open, or Retail Box).
> =

>The real vulnerability to be exposed in something like this is the fact =
that Microsoft sets up a "back door" support account on all instances of =
Windows XP.  Albeit disabled, this can lead to security risks if the admi=
nistrator disables the account.
> =

>Some Machines implement a local security policy that prevents the local =
administrator from logging on locally, and only allowing the "USERS" to l=
og in to the machine.
> =

>Like I said before, it's not a "DELL" issue.  Perhaps DELL is being targ=
eted since the OEM software defaults that way.  I have installed Windows =
XP fresh from Open, OEM, or Retail, and experience the same thing.  Null =
Password on Administrator account.  =

>
>-JB
>
>________________________________
>
>From: Michael Scheidell [mailto:[email protected]]
>Sent: Mon 6/27/2005 1:08 PM
>To: [email protected]
>Cc: [email protected]; [email protected]; [email protected]; security@=
dell.com
>Subject: [VulnWatch] Blank Administrator password in DELL XP Professiona=
l install
>
>
>
>Vulnerability in DELL Windows XP Professional - default hidden Administr=
ator account allows local Administrator access
>
>Systems: DELL(tm) Laptops with Windows(tm); Professional
>Vulnerable: DELL Laptops with pre installed Microsoft Windows XP Profess=
ional SP2
>Not Vulnerable: DELL Laptops with Retail Microsoft Windows XP profession=
al, RTM, SP1 and SP2
>Severity: High
>Category: Unauthorized Administrator Access
>Classification: Default Authentication
>BugTraq-ID: tbd
>CVE-Number: CAN-1999-0504
>Remote Exploit: Maybe
>Local Exploit: Yes
>Vendor URL: www.dell.com
>Author: Michael Scheidell, SECNAP Network Security
>Internal Release date: May 31, 2005
>Notifications: May 31, 2005, Emailed various security and cert addresses=
 at DELL
>Vendor Response: June 7, 2005: Dell Emailed and requested more informati=
on
>SECNAP response: June 7, 2005: Sent Dell serial number and service tag c=
ode on test system
>Additional Contact: Emailed Dell on June 14, 2005 to request status
>Additional Contact: Emailed Dell on June 21, 2005 to request status, cc'=
d original cert and security addresses
>FBI Infragard Release: June 24, 2005
>Public Release Date: June 27, 2005
>
>Problem:
>
>DELL OEM XP Processional has a default hidden administrator account.  Us=
e of this account will allow anyone with physical access to the computer =
to fully control the computer, add spyware, keystroke loggers, password s=
tealing software and read all files, including temp files, local files, d=
ocuments, and any email that has been stored locally.
>
>DELL does not inform the installer of this account, nor give them the op=
tion of putting a password on this account. If a savvy installer finds th=
e function to change the password for the Administrator account, they are=
 warned that they could lose data. Security best practices REQUIRE a pass=
word on all administrative (and root) accounts.
>
>See Dell web site on passwords:
>Do's: Do's Use passwords with 6 or more characters
>Do NOT's: Do not use passwords shorter then 6 characters[mss: I assume t=
his means blank Administrator passwords also]
>http://support.dell.com/support/topics/global.aspx/support/security/secu=
rity_2?c=3Dus&cs=3D19&l=3Den&s=3Ddhs&~tab=3D3
>There is also a link to Microsoft's Web site on Dell's site
>http://www.microsoft.com/smallbusiness/issues/technology/security/5_tips=
_for_top_notch_password_security.mspx
>
>Because DELL marketing directly targets large publicly traded businesses=
, government agencies, and research organizations, these systems are used=
 in regulated industries. Healthcare organizations must be HIPAA complian=
t; financial institutions must follow GLBA regulations; publicly traded f=
irms are required to adhere to the Sarbanes-Oxley Act; federally funded e=
ducational organizations are regulated by FERPA, and government agencies =
must comply with FISMA regulations. With such organizations comprising  a=
 major portion of DELL's market share, it would be advantageous to ensure=
 that products incorporated into DELL systems would help achieve complian=
ce with such regulations. =

>
>Note: this is similar to the problem found on IBM workstations in August=
, 2004 and fixed by IBM with SP2 release:
>
>See: http://www.secnap.com/alerts.php?pg=3D5
>
>This may not be the first report of this behavior. If others have report=
ed on this issue before, please let us know: however, we searched the CVE=
 database and only  found a distantly related problem dating back to 1999=
 where there is a warning against default, missing or weak administrator =
passwords.
>
>The Common Vulnerabilities and Exposures (CVE) project has assigned the =
name CAN-1999-0504 to this issue. This is a candidate for inclusion in th=
e CVE list (<http://cve.mitre.org>), which standardizes names for securit=
y problems.
>
>A retail setup implementation of Microsoft Windows XP Professional Editi=
on, "Out-of-Box Experience" (OOBE), requires that the installer be given =
the option to add an Administrator account. During the installation, the =
XP Installer states : "You must provide a name and an Administrator passw=
ord for your computer. Setup creates a user account called Administrator.=
 You use this account when you need full access to your computer." While =
setup will not require that a password actually be entered, it does stres=
s that one SHOULD be entered. Additionally, the user is prompted to creat=
e a regular user account for general use.
>
>In contrast, the DELL setup implementation of Microsoft Windows XP Profe=
ssional Edition does not include such steps. The existence of an administ=
rator account is never mentioned. Instead, the setup asks: "Who will use =
this computer? Type the name of each person who will use this computer. W=
indows will create a separate user account for each person so you can per=
sonalize the way you want Windows to organize and display information, pr=
otect your files and computer settings, and customize the desktop. These =
names will appear on the Welcome screen in alphabetical order. When you s=
tart Windows, simply click your name on the Welcome screen to begin. If y=
ou want to set passwords and limit permissions for each user, or add more=
 user accounts after you finish setting up Windows, just click CONTROL PA=
NEL in the START menu, and then click USER ACCOUNTS." By default, none of=
 the accounts added in this step have passwords. Nor is their an option t=
o set passwords during the install. While this is not unique to the IBM i=
nstall, it is a known weakness in the Windows XP OOBE, including retail a=
nd OEM versions. Because the Administrator account was never requested, t=
his leaves the system in a very vulnerable state.
>
>Local Exploit :
>If Windows XP Professional is installed as part of a Windows Domain, the=
 user selection menu is absent . If there is a user menu, hit <ctl><alt><=
del><ctl><alt><del> to pull the menu up
>
>Type 'Administrator' in the Username Box.
>Leave the Password Box Empty.
>If there is a domain in the Domain Box, change it to the local computer
>Hit Enter
>You now have full control over this system and can install keystroke log=
gers, capture passwords, install network sniffers, browse (and change) co=
okies of the users, read and copy any local documents or files
>
>Remote Exploit:
>Remote exploit is not possible unless someone changed the security featu=
re that disabled network access for accounts with blank passwords
>If remote access is possible, use MACHINENAME/Administrator as the user =
authentication when connecting to the $SYSTEM or $C share.
>If you gain access, you can remotely load, install, read, take over the =
computer.
>
>Work Around
>By using the Computer Management application and looking under 'System T=
ools->Local Users and Groups->Users', we see that the Administrator accou=
nt has been added and enabled. This account IS NOT password-protected. If=
 the installer sets a password for EVERY user shown under the User Accoun=
ts tool in the Control Panel, THE DEFAULT ADMINISTRATOR ACCOUNT STILL EXI=
STS WITH NO PASSWORD.
>
>The Installation Setup never informed the user that the account existed.=
 If a user attempts to manually set a password for the Administrator acco=
unt, they are greeted with the following warning: "Password for Administr=
ator: Resetting this password might cause irreversible loss of informatio=
n for this user account. For security reasons, Windows protects certain i=
nformation by making it impossible to access if the user's password is re=
set. This data loss will occur the next time the user logs off. You shoul=
d use this command only if a user has forgotten his or her password and d=
oes not have a password reset disk. If this user has created a password r=
eset disk, then he or she should use that disk to set the password. If th=
e user knows the password and wants to change it, he or she should log in=
, then press CTRL+ALT+DELETE and click Change Password. For additional in=
formation, click Help. [Proceed] [Cancel] [Help]." This warning exists in=
 all versions of Windows XP, but it is not presented from the Control Pan=
el Users Accounts tool. If a password is changed from the Control Panel's=
 User Accounts section, no such warning is issue; but, again, the Adminis=
trator account is hidden from User Accounts.
>
>In summary, Due to the lack of an Administrative Setup screen for the DE=
LL Windows XP OOBE flow, it is more difficult for a security-conscious or=
ganization to manage a Windows XP-based DELL environment. In order to pro=
tect a system, several unintuitive additional steps must be taken on each=
 systems in the environment, despite warnings against taking such steps.
>
>SECNAP has tested this situation against DELL Windows XP Pro SP2. SECNAP=
 also recommends that DELL notify all existing registered clients using t=
he vulnerable systems to upgrade, possibly to a DELL-released patch, or m=
odified version of SP2, that would additionally address the issues.
>
>Vendor Response
>On Jun 7th, 2005, Vendor requested and received serial number, service t=
ag and OOBEINFO.INI from the test computer
>We attempted to contact them again on June 14th, and June 21st. No respo=
nse
>
>Credit:
>Original alert on IBM Workstation by Jason Lash, SECNAP Network Security=
, www.secnap.com, research on DELL Laptops by Michael Scheidell, SECNAP N=
etwork Security.
>An original copy of this alert can be found here release: http://www.sec=
nap.com/alerts.php?pg=3D8
>
>Copyright:
>Above Copyright=A9 2005, SECNAP Network Security Corporation. World righ=
ts reserved.
>
>This security report can be copied and redistributed electronically prov=
ided it is not edited and is quoted in its entirety without written conse=
nt of SECNAP Network Security Corporation. Additional information or perm=
ission may be obtained by contacting SECNAP Network Security at 561-999-5=
000
>
>
>
>  =

>

=