That doesn't really make any sense. That's not a MySQL default, so you're saying they intentionally set the root user password to '*'? I'm not sure I buy that.