cryptoanarchy.wiki

Arise, you have nothing to lose but your barbed wire fences!

1998-05-09 - Re: [Fwd: 3Com switches - undocumented access level.]

Header Data

From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: Sunder <sunder@brainlink.com>
Message Hash: f807146f9316a9e70e84cb035c24fafc692e5e0f788cb59c86953b9f34da8e4c
Message ID: <Pine.BSF.3.91.980509032901.17424A-100000@mcfeely.bsfs.org>
Reply To: <355372B4.C837F915@brainlink.com>
UTC Datetime: 1998-05-09 21:45:32 UTC
Raw Date: Sat, 9 May 1998 14:45:32 -0700 (PDT)

Raw message

From: Rabid Wombat <wombat@mcfeely.bsfs.org>
Date: Sat, 9 May 1998 14:45:32 -0700 (PDT)
To: Sunder <sunder@brainlink.com>
Subject: Re: [Fwd: 3Com switches - undocumented access level.]
In-Reply-To: <355372B4.C837F915@brainlink.com>
Message-ID: <Pine.BSF.3.91.980509032901.17424A-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: text/plain



Since you didn't specify the method of access. it is hard to determine if
this is a large security hole. Most equipment can be rebooted and brought
up without a password IF you have local access. For example, Cisco routers
can be brought up without password simply by specifying the starting
address of the load file, but you have to be at the local console to do
this. 

UNIX systems can be brought up w/o password in single-user mode, if you 
have local access. Yes, there are firmware passwords to guard against 
this on many systems, but one can always swap up the eeprom, etc.

I'd only be worried about the 3Com backdoor if it can be used remotely.
Got any details?

-r.w.

Thread