K7VMM Bios Password flaw

I was recently fiddling around with my bios and I put the boot password on to prevent siblings from screwing my computer up. Few days later, I turned my pc on put the password in and realized that the 9 character password I put in was wrong. The last character was incorrect BUT it let me boot my pc up. Thinking it was just a fluke, I tried it again with several different characters than the correct one, and sure enough, there exists a "flaw" in coding I assume, so that no matter what the last character is it will always let it go through. ECS makes the motherboard for those that want to know. I also thought that maybe AMI (bios) needed to be updated, so I did that too and it still did not fix it.

(If this is in the wrong catagory, please move it, thanks)

Dosent the bois password only stop people changing your bios settings?
If your booting you pc up and entering a password that would be your logon details not your bios details.

Actually with this motherboard, its a password to prevent booting too. I questioned that too at first when I bought the board, but thought eh why not give it a try. The password to enter the bios as well as booting up remains the same.

Nokia, you can also use a password you need to enter before your computer boots your OS.
But the BIOS password can be easily bypassed by resetting the CMOS. You shouldn't rely on this password if you can't lock up your case.

LOL, fortunatly enough my brother and sister would know what a CMOS setting is. I dont have anything confidential (with the exception of a few pictures) but I hate when settings get changed etc. They are the types that they know too much for their own good. Plus, I love when they get really p!ssed off at me because they cant check their email lol.

This will reley on your type of Mo Bo though and is not a standard feature.

Very true nokia, so going back to my original ?.....what should I do/who do I contact to see if there is a fix, or to let them know it has a flaw? anyone know?
thnx

I am a totally stupid moron.........so please neg me :)

I might suggest that your password system only accepts a certain number of characters (8) and that the array or whatever that you are presented with, lets you enter more than that? so the ones in excess of those that it checks are irrelevant from a security point..........it is a pretty elementary programming/design error..............so I must be at fault?

I am critical (not of you :) ) because this kind of error lulls you into a false sense of security?

Take care!

Thanks Nihil, I never thought about it that way, but it makes logical sense. I can enter a max of 9 characters, and only the 8 are recognized or accepted. So I assume then its a design/programming flaw, and I wonder if I contact ECS, if maybe I can get a free mobo WOOHOO. Also I assigned you posi-points. Thanks again.

Hi Wildred!

Thank you for your reply.............I guess you are fairly young compared to me at least :) so I just thought I should mention that this particular problem can happen elsewhere.

For example, if you are using a table or array within a program to store calculated sub-totals, you have to make sure that it is large enough. Otherwise, you see an input field that looks OK and an output field that is the same.....problem happens inside the program, where you might not see it. My message is that you need to "walk through" your program logic and design to be safe.

Similarly, you need to keep an eye on column widths and paper size in printed reports. Hey, I wish I had 1$ for every mistake that I have made :D Point is...learn from them.

Good Luck

Quote:

---

Originally posted here by nihil
Similarly, you need to keep an eye on column widths and paper size in printed reports. Hey, I wish I had 1$ for every mistake that I have made :D Point is...learn from them.

Good Luck [/B]

---

Amen to that. I am currently studying computer science and engineering and the most advice and tips that I can get the better. I hope to soon be able to get into a computer firm and actually be productive instead of being a data entry clerk. Again, thanks. FYI, I contacted ECS Group and I will let you know if you want, what their answer is, if I get one back.

Hi Wildred, it is a pleasure to attempt to help someone as polite as yourself. Yes I would be interested in the ECS answer..........please send me a PM or post to the thread.

A couple of other things came to me: your BIOS password can be circumvented by using a jumper switch on the motherboard. So it is only as secure as the physical security that you have. Guess your siblings don't have that skill yet? but I bet they have friends with older brothers & sisters? I would think about locking the case..............I do not like the idea of youngsters with screwdrivers and the case off with the power connected...............kinda scary :eek:

Might be an idea to set them up with their own profiles/ids? makes them feel more important and less likely to cause accidental damage :) You did not mention your OS or how old they are, so I am jumping to conclusions again.

Have a good browse around this site, there are lots of tutorials and interesting stuff :)

Good Luck

My siblings are 25 and 17 and have no clue what a jumper is thankfully. I also run windows 2000 and have a login password on that as well. My case is actually left open because I change out hard drives frequently, to test for my customers or install windows cor my customers. Also, with all the neon (yes, I do have neon, go ahead and gripe) it tends to get hotter then what it should be, and we all know that AMD chips are notorious for heat issues, even with an upgraded cpu fan etc. Thanks for your time though, ECS btw says they should get back to me within 48 hours, we shall see.

Could be your Mobo only supports 8 characters, and the last one is truncated :P
Try with only 8 or with 10, aslong as the first 8 are correct it prolly will let you through

Hi,

Yep, if they've lived that long they are obviously not in the habit of sticking screwdrivers into powered-up electrical devices :zap:

Your problem is obviously physical security, and it seems that there IS access to your machine, and the case is not locked down. An alternative you might like to consider is removeable drive bays? Over here they cost just under £15, but I would have thought you could get them for about the same in $ where you are?

I quite like them, as the frames just screw into your 5.25" bays, and the actual drive fits into a carrier which you just plug in and out of the frame. There is the facility to screw the drive into the carrier, but the whole fit is pretty snug, so you don't have to do that, if it's just a drive you are working on for someone. For security, you just take the hard drives out and lock them up.

A real plus is that they have a front fan that blows air over the surface of the HDD, so if you extract properly, it makes the system cooler. Those 7200rpm drives generate a fair bit of heat!

I was given two of those neons.........haven't done anything with them yet, but I noticed that they have a sound activation capability :D You surprised me by suggesting that they were a concern regarding heat. I was always under the impression that neon was "cold light"..........I would have looked to cooling 7200rpm HDDs and maybe putting a cooling fan on the videocard, and heatsinks on fast DDR RAM strips first?

I don't know the ECS mobo, but I have seen quite a few instances where the password was limited to 8 characters, and would not even support a "strong" password. That is including symbols, as well as letters & numbers. I am not sure, but I guess that as the BIOS password is pretty much inaccessible, and you only get three goes at it (typically) they did not think it too important.

I did wonder if that last digit might not be some kind of check digit in the BIOS, and the guy who programmed the input screen thought 9 characters...here you go.......seen that sort of thing before.

Let us know how you get on.

Good Luck

Johnno

Ok, this will kinda wrap things up for what has been done to "fix" this issue. I set the password to 8 characters as it will only accept a max of 9.....it wont let you use special characters either for a strong password , which sucks, but thats besides the point. After setting it for 8 characters, it will not work unless I have the 8 correct, so it leads me to think that its only checking the first 8 characters. It also does this with a number only password and a letter only password. Thankfully win2k has the bootup password and that so far prevents the "others" from getting access. If you, nihil, happen to find a link or site that sells those hard drive things you discussed, please mesg me them so I can look into it. It almost sounds like a RAID type setup but def. seems handy to have. Ugh, so much information to learn and so little time, thanks all for your help. I will post the response from ECS when/if I get the answer.

Just to let everyone know, I got an email from ECS..this is what they say.

Hello,

The maximum character you can use to setup a password is "8" so the 9th character is negligible.

ECSUSA Tech Support

Thanks.

Hi Wildred,

Sorry for the delay regarding removable drives...............I am over here in England, so I couldn't just recommend my local store :) I spoke with a couple of friends and got this:

http://www.mycableshop.com/3rd_level/drawers_IDE.htm

Hope the link works, the outfit is myCableshopInc.

You, and any other interested parties, might like to check out:

http://www.ce-infosys.com

This is the site for CompuSec v4.15, it is a security app. that gives you "pre-boot" authentication and "full hard disk encryption". As it is in the POST sequence, it cannot be switched off by using the CMOS battery or jumper switch. I have not had a chance to look at it closely, so I do not know if it is significantly better than the WIN2k password. I am guessing, but I think it is a straight "know this or it won't start" whereas you can generally get into a WIN2k box as a default or guest user?

The bottom line, as I see it, is that this cuts in after powerup, but before Windows, so it seems to be very much aimed at the physical security situation?

It only runs on NT4.0, 2k, and XP, and has an industrial strength "big brother".

Naturally it is free for private use (they don't call me "nihil" for nothing :p )

Good Luck

Johnno

I would think that if you use something like this and forget the password...............you are history?............so be careful.

Thanks for getting back to me. That looks like a good idea for me to put on my pc, instead of the bios password. Reason being, I found out that if I put 7 character password only 6 are "
needed". So , essentially my password is getting smaller and smaller and easier to break into. Again thanks.

This is not uncommon. Many peices of software, whether they be BIOS or whatever can accept input larger than the field. Usually the entry is just truncated, but occasionally with crapware, like what I have to fix at work, the entry is lost. I'm guessing that the password field is 8 charachters, standard for BIOS's. The first 8 you input go through, nothing afterword. There is almost always an option to have the password protection just for CMOS settings, or for the system itself.