@Station
-
When I was coming to the end of high school in the mid-90s, my school finally upgraded one of its two computer rooms to a network of Windows-for-Workgroups 486s, replacing the BBC Micros that were there before. These machines were supplied by RM, who supply (or did at that time) most schools in the UK.
Naturally, myself and a couple of friends started to explore the network. We did the usual high-school "hacker" stuff, like writing an imitation of the login screen in VB to capture the administrator password, getting around the tiny disk-space limits and so on.
One day, whilst exploring around, I noticed that all the workstations that nobody was logged onto were actually showing up with a logged in user called @STATION. I tried logging on with that username and a blank password, and it let me in. It didn't have access to anything - it was a very limited account, but nonetheless it was now obvious that whenever a workstation booted up it logged in initially with @STATION, before presenting the logon prompt to the user.
So, further investigation was called for. Namely - what happens if you change the password from blank to something else (accomplished with NET PASSWORD IIRC). Well, I'll tell you what happens. It breaks the entire network. No machine can even boot correctly, and once a logged-on user logs off, it keels over and dies (the machine, not the user).
Whoops.
I tried to change it back, but it wouldn't let me as you could not change it more than once per day, and it kept a history of the last 7 passwords or something. Our Computer Science / network admin (by default) wasn't in, only another teacher who didn't know much about computers. With the network falling down around us, I said, with a tightening sphincter, that I think I know what the problem might be and if I could get to the server we could probably fix it (good thing I knew that administrator password...). She agreed, so I rolled the date forward a day, changed the password, rolled it forward again, changed again and so on, until it finally let me set it back to blank and the network came back to life.
I'm not sure what's the bigger WTF - that the system relied on a specific username/password to be present or else nothing would even boot, or that I was hailed as a hero for fixing the network.
-
Hm... I never really used Windows 3.11 (I jumped from 3.1 to 95) but at least in the NT family, "Administrator" can reset passwords regardless of the stupid complexity rules IIRC. But was this some pre-NT Windows Server, or was this more like Novell? That one definitely had a password reset option :)
-
Sheesh, sounds like a setup I'd have overhauled if I ran that network...
Choose your own TRWTF (provided the story):
- is that the administrator is restricted in the same way as the users
- is that the @STATION account's password wasn't locked.
- is that the Network Administrator was out with no replacement
- is that (as stated) netboot needed a login (or login mechanism needed it's own login to make the workstation function)
- is that netboot's (or login mechanism's) login could be changed via the regular authentication/password system
-
Well, this was the mid-90s... in a school (so little budget). I think a lot of the stuff was fairly proprietary from RM as well.
Can't blame the "network administrator", as it was my computer science teacher (a 60-year old lady who I have to thank for my career, I suppose after getting me into programming) who ended up with the "job" by default. The only other network we had was a network of 086s running Dos in the next room. So networking knowledge was not exactly high...
At least they stepped up the security on the new network - the server was actually in her office, rather than in the same room as the workstations.
I'm guessing things are a little better now!
