To: 
Subject: Living Waterfalls Demo 'bug'
Importance: High

Hi!

I DL this utility yesterday, and after playing with it for ~20 min, found
out quite by accident that it has a serious 'hole'

Where the normal password-protected PC screensaver kicks in, and any mouse
movement or keypress returns one to the "Press CNTL-ALT-DEL" to login
screen, theirs does as well, but there's a 'back door' when this program
(Living Waterfalls) is running, which would allow anyone sitting at my desk 
to immediately assume my identity, including LOCAL/NETWORK rights, and ULoad,
DLoad, Surf, read, write edit or, yup, even delete files on the local or (really
scary) entire Network/LAN!!

All the user has to do is press 'SPACE', and he's IN!
As a matter of fact... I'm writing this from the 'Auto-lock-out' saver now.
It features a full WEB interface (IE5.1) and virtually allows me to do
ANYTHING.

You might want to try this yourselves, and then publish YOUR findings.  I
contacted the vendor, but they indicated it was a feature, and they have no
intention of 'fixing' this.  I see that this SS is already avail in Romania
and Russia too, and that's an awful LOT of un-secure PCs out there.

S. Johns
SA/DBA, TBMCS

No matter how much you know today, you'll have to know more tomorrow.