Text 43352, 83 rader
Skriven 2008-02-17 04:36:24 av James Bradley (1:134/77.0)
  Kommentar till text 43305 av Jean Parrot (1:123/140)
Ärende: Hd Pw.
==============
On or about: 02-16-08  10:11, Jean Parrot did engage James Bradley regarding,
but not limited to: Hd Pw.

 JB> But about the HDs, there *has* to be a repository for the password. I
 JB> doubt Toshiba will tell you where to find it, but if it's visible to
 JB> the system that wrote it, it *is* accessible.

 JP> If you go and read the notes on the Toshiba site, you will see

Ah... Not my HD, and only a curiosity to me.

 JP> that it is set on the next sector to the MBR. The board logic will

Snugged up amongst the otherwise unused 16 sectors. Now we get somewhere!

 JP> seek it on booting and will stop unless the PW requirement is

This is where we hit it with a cracker, crack-a. When did it hit the wall?

 JP> validated. So, the HD is not "seen" unless this is done, therefore,

Wrong!

 JP> there is no way that it can be flushed. There are Master PWs and

Wrong! You "flush" it with the supplied program. Why not use the gate they
provide? It's easier than climbing a fence. <G> If you are stopped from using
the gate after x# of attempts, *then* you try again, and start where you left
off.

 JP> users PW. You set the user as you see fit. The Master is a trade
 JP> secret, I have been seeking it now for two years, why they will not
 JP> disclose it is beyond my understanding as it would "save" a drive

Money, and the illusion of security is why you will never see a master key from
Toshiba, unless they POed an employee enough for them to release it. Now, it
could be someone already "Social-Engineered" the code out already, and you just
need to look in the right place, but I don't hear much of labour strife
encircling Toshiba, or IBM. (These are IBM supplied drives, as manufactured by
Toshiba, right?)

 JP> from being a paper weight. Using the Master PW will flush the HD,
 JP> no access to the protected data, this is the purpose of the
 JP> exercise. As you say, yes, it is accessible but !!!

Time and money... If it cost more to crack it, than the drive would be worth,
why bother? As you say, you have 24/day like the rest of us. If you can
automate the "Try three passwords - reset the wall - try next three
passwords..." then you can leave it on the bench for a year and come back to
it. Otherwise, you're going to cut into a lot of coffee time, cycling the
reset, and initiating the next set of passwords. Because the user entered value
is likely more mundane than the master key, you'd still want to start with real
words, then proper names, then...

You're not mining for the data, are you?

 JP> I set a user's HD PW on all the laptops that I see. Some on
 JP> the IBM user groups say that the one HD has to be in the laptop, if
 JP> you insert another drive, as the PW is set in BIOS, it will not
 JP> work. I still have to experiment this. Would reinserting the set HD
 JP> release the lock or would the laptop be history ??? One Thinkpad
 JP> owner has mentioned that inserting a PW protected HD in his laptop,
 JP> locked it and he could not use it even after typing his know PW. I
 JP> doubt it, there might have been another fault somewhere.

I've no expertise on the matter, but there is a way to "increment" a password,
to make it a moving target. Think of the Enigma machine. The message can remain
"dog" but the settings to the cypher-decipher engine can synchronously be
incremented. Step one bootup attempt, without the client moving its settings
instep, can make it go dumb to what the settings du-boot is. Das-Boot? Ka-Put!
<G>

There's a couple of guys that read this sort of stuff on MEMORIES. You might be
able to mine them for info like this. As far as I know, it is a bombastic
approach that is the only way in if it is this complex.


... James

___ Blue Wave/QWK v2.20

--- Maximus 3.01
 * Origin: -=-= Calgary Organization CDN (403) 242-3221 (1:134/77)