Dell BIOS DoS

[Ross Draper]

I agree with your points Jon, but lets be fair here, BIOS passwords do
have a use - especially on laptops.

Although nobody in there right mind would rely on them as the sole
protection for a machine, they are certainly worthwhile both as a
deterrant to the casual snooper and as a delaying tactic to your average
criminal.

At the very least they can buy a couple of hours for the end-user to
contact his/her IT department to block any dial-in accounts and reset
any passwords that may be compromised... assuming they remember to call
you that is ;-)

Cheers

Ross

_____________________________________________=20
From: jon schatz <jon@divisionbyzero.com>@RADIO =20
Sent: 09 December 2003 07:38
To: James Evans
Cc: bugtraq@securityfocus.com
Subject: Re: Dell BIOS DoS

=20
James Evans wrote:
> This is not an incredibly serious problem as such, since a user can go
> back into the BIOS setup and change the password there, provided the
> BIOS Setup is not protected with an unknown password. Or, as a last
> resort, Dell can be phoned to provide a master backdoor password, as
> long as the user can prove herself the legal owner of the computer. Of
> course, the prerequisite of physical access to the machine highly
> mitigates this vulnerability.

....and once upon a time the default backdoor dell password was "dell".

seriously, bios passwords are worthless. there are numerous ways to get
around them. most motherboards have a jumper that you can set to reset
your cmos / bios (probably misusing one of those terms) to the factory
defaults. or you can just yank the cmos battery out. for your laptop, it
might be a bit trickier, but you can usually get to the jumpers
underneath the keyboard (at least on my old sager you could).

hth.

-jon
--
jon@divisionbyzero.com || www.divisionbyzero.com
gpg key: www.divisionbyzero.com/pubkey.asc
think i have a virus? www.divisionbyzero.com/pgp.html
"You are in a twisty little maze of Sendmail rules, all confusing."





GWR on the Web

http://www.musicradio.com http://www.classicfm.com
=09
http://www.corefreshhits.com http://www.planetrock.com

http://www.opusonline.co.uk http://www.gwrgroup.com

CONFIDENTIALITY NOTICE

************************************************** *************************

The information in this e-mail and any attachments to it is confidential
and may be legally privileged or prohibited from disclosure and
unauthorised use. If you are not the intended recipient, any use, copying,
disclosure, modification, distribution and/or publication of this=20
message or its attachments (if any) is prohibited and may be unlawful.

We will not accept liability for any claims arising as a result
of the use of the internet to transmit information by or to GWR Group plc.
************************************************** *************************



The information in this e-mail and any attachments to it is confidential
and may be legally privileged or prohibited from disclosure and
unauthorised use. If you are not the intended recipient, any use, copying,
disclosure, modification, distribution and/or publication of this=20
message or its attachments (if any) is prohibited and may be unlawful.
We will not accept liability for any claims arising as a result
of the use of the internet to transmit information by or to GWR Group plc.

[der Mouse]

>> Or, as a last resort, Dell can be phoned to provide a master
>> backdoor password, [...]

Actually, that there even _is_ a backdoor password sounds like a fairly
serious security problem. That Dell would tell it to _anyone_ (as
opposed to "ship it back to us and we'll fix it") is another,
especially in the presence of all the ways you point out of working
around the BIOS password. To me, this clearly says "don't trust the
BIOS password for anything on a Dell", since anyone who cares to bother
can learn the backdoor password (at most, it takes buying a machine).

> seriously, bios passwords are worthless.

Well, if implemented right (which it appears Dell didn't), they can be
useful - but you have to be careful; they're useful for a lot less than
many people seem to think they are.

In particular, as you point out, if you have full physical access there
are various of ways to get around them. But this doesn't make them
worthless; it just means that they're worthless against a threat model
which includes attackers with physical access to inside the case. But
that's not always the case; I've seen, for example, university labs
where the machines are inside locked metal cages but the human
interface components (screen, keyboard, mouse) are accessible.

/~\ The ASCII der Mouse
\ / Ribbon Campaign
X Against HTML mouse@rodents.montreal.qc.ca
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B

[Jim Paris]

> > seriously, bios passwords are worthless.
>
> There is no such thing as security from someone who has physical access to
> the hardware.

There are different types of physical access. For example, many
computers at my university are publically accessible but strapped to
the table in such a way that the case cannot be removed without a key
or a lot of force. It is trivial to reboot them and attempt to enter
BIOS, but an entirely different matter to open it up and move a jumper
or swap the hard drive.

-jim