[41706] in bugtraq
Re: Bios Information Leakage
daemon@ATHENA.MIT.EDU (Ron van Daal)
Fri Dec 16 17:36:18 2005
Date: Fri, 16 Dec 2005 10:33:21 +0100 (CET)
From: Ron van Daal <ronvdaal@n1x.nl>
To: bugtraq@securityfocus.com
Cc: Jonathan Brossard <jbrossar@messel.emse.fr>
In-Reply-To: <20051213052418.03A3A5C01B@messel.emse.fr>
Message-ID: <20051216101651.F21095@zarathustra.linux666.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
On Tue, 13 Dec 2005, Jonathan Brossard wrote:
> The two following techniques were pretty common under MS DOS several years
> ago (see the "Bios Companion" [4] for instance).
> It made use of debug to access physical ports. Under Linux, this
> requires special permissions that are given using ioperm.
> The main idea to reset CMOS is to make the checksum fail.
To make the CMOS checksum fail in the 'good old DOS days' I just typed a
file to CLOCK$ which caused the CMOS to be partly overwritten, disabling
the BIOS password checks.
I agree with you on the fact that plaintext password storage is outdated.
Kind regards,
Ron van Daal
The Netherlands
