Date: Thu, 4 Feb 1999 04:15:13 -0700
From: "Donald Moore (MindRape)" <mindrape@HOME.COM>
To: BUGTRAQ@netspace.org
Subject: Microsoft Access 97 Stores Database Password as Plaintext
======================================================================
Title: Microsoft Access 97 Stores Database Password as Plaintext
Date: 02/03/99
Author: Donald Moore (MindRape)
E-mail: damaged@futureone.com
======================================================================
Microsoft Access 97 databases protected with a password are stored in
foreign mdb's table attachements as plaintext. This can be accessed very
easily by issuing a strings and grep operation on the foreign mdb.
Example:
% strings db1.mdb | grep -i "pwd"
MS Access;PWD=plaintext;Table2pppppppjI'%
MS Access;PWD=plaintext;Table1qqqqqqqkJ(&
======================================================================
Impact of Exploit
======================================================================
Having the password allows the secured mdb to be unlocked, giving permission
to view database objects, possibily revealing other database connection
strings, propiertary source code, tampering of data. One such commercial
database marketed by FMS, Inc., Total VB SourceBook 6.0, can be easily
compromised using this method.
======================================================================
How to Recreate
======================================================================
1. Create an mdb
2. Create a Table
3. Reopen the new mdb in exclusive mode
4. From the Tools Menu, select Security and then click Set Database
Password
5. Set database password
6. Exit Access
7. Create another mdb
8. From the File Menu, select Get External Data, and click Link Tables....
Select
the passworded mdb and then select the table you created.
9. Exit Access
10. Perform a strings+grep on the 2nd mdb to reveal the password.
- - - ------------------------------------------------- - -- ---
______ ______ .
.:_\___ \\_ . \_::.
Donald Moore (MindRape) . .::./ ./ // ./__/.:::. .
_<_____/<____ >_:.
Email: mindrape@home.com . \/ .
damaged@futureone.com Damaged Cybernetics
- - - ------------------------------------------------- - -- ---
--------------------------------------------------------------------------
Date: Thu, 4 Feb 1999 22:07:40 -0700
From: "Donald Moore (MindRape)" <mindrape@HOME.COM>
To: BUGTRAQ@netspace.org
Subject: Re: Microsoft Access 97 Stores Database Password as Plaintext
Paul,
This recreation just demonstrates how you can recreate this situation. The
problem is that Microsoft Access stores the password to the database in
plaintext. Without knowing the password beforehand, one can search other
mdb's looking for table attachments orginiating from the passworded
database. The commercial product from FMS has been compromised, and a
number of others (including our own product).
______ ______ .
.:_\___ \\_ . \_::.
Donald Moore (MindRape) . .::./ ./ // ./__/.:::. .
_<_____/<____ >_:.
Email: mindrape@home.com . \/ .
damaged@futureone.com Damaged Cybernetics
- - - ------------------------------------------------- - -- ---
-----Original Message-----
>From: Paul Leach <paulle@microsoft.com>
To: 'Donald Moore (MindRape)' <mindrape@HOME.COM>; BUGTRAQ@NETSPACE.ORG
<BUGTRAQ@NETSPACE.ORG>
Date: Thursday, February 04, 1999 12:32 PM
Subject: RE: Microsoft Access 97 Stores Database Password as Plaintext
>I'm not an Access guru, so please forgive me, but I don't quite understand
>the scenario. Please see the questions below.
>
>> -----Original Message-----
>> From: Donald Moore (MindRape) [mailto:mindrape@HOME.COM]
>> Sent: Thursday, February 04, 1999 3:15 AM
>>
>> ======================================================================
>> How to Recreate
>> ======================================================================
>>
>> 1. Create an mdb
>> 2. Create a Table
>> 3. Reopen the new mdb in exclusive mode
>> 4. From the Tools Menu, select Security and then click Set Database
>> Password
>> 5. Set database password
>> 6. Exit Access
>> 7. Create another mdb
>> 8. From the File Menu, select Get External Data, and click
>> Link Tables....
>> Select
>> the passworded mdb and then select the table you created.
>
>At this point, didn't you have to enter the password of the first mdb to
get
>access to it?
>
>If so, then the fact you got access to the passwords after knowing the
>password doesn't seem very interesting.
>
>If not, then it seems like that's _actually_ the bug: you got access to a
>password protected database without having to know the password.
>
>> 9. Exit Access
>> 10. Perform a strings+grep on the 2nd mdb to reveal the password.
>>
>
>Finally, why wouldn't ACLs be used to protect the database instead of
>passwords?
>
>Paul
-------------------------------------------------------------------------
Date: Fri, 5 Feb 1999 09:03:22 -0500
From: Eric Stevens <ejsteven@CS.MILLERSV.EDU>
To: BUGTRAQ@netspace.org
Subject: FW: Microsoft Access 97 Stores Database Password as Plaintext
Appologies, the files were too large to send through Bugtraq, you may go
here instead:
http://cs.millersv.edu/~ejsteven/linked.mdb
http://cs.millersv.edu/~ejsteven/protected.mdb
-----Original Message-----
>From: Eric Stevens [mailto:ejsteven@cs.millersv.edu]
Sent: Friday, February 05, 1999 8:53 AM
To: bugtraq@netspace.org
Subject: RE: Microsoft Access 97 Stores Database Password as Plaintext
What our friend is saying is that if you File >> Get External Data >> Link
Tables [which is something that I use regularly] on a password protected
database, the passwords to the protected database are stored in the database
that contains the linked tables in plain text.
Attached are two databases, Protected.mdb and Linked.mdb. Their names are
self explanatory. If you text edit the Linked.mdb, you'll quickly discover
the unprotected password. The threat is this: You have a database system
set up that may be prone to attack (and ALL general use systems are prone to
attack, perhaps by a disgruntled employee) which uses linked tables, and a
simple-minded fool could figure out how to gain full access, and place in
some malicious code, even if the database that contains the links is
protected with a password. Here's some of the text right from Notepad to
your computer:
C:\My Documents\protected.mdb [...about 10 ASCII characters...] MS
Access;PWD=protected;protected
The passwords to the two databases attached are:
linked.mdb; linked
protected.mdb; protected
,----/ +
/ Eric Stevens \
/--/ ejsteven@cs.millersv.edu \
/ Dept. of Computer Science \
'----/ Millersville University, PA +
-------------------------------------------------------------------------
Date: Fri, 5 Feb 1999 09:14:11 MST
From: Sozni <sozni@USA.NET>
To: BUGTRAQ@netspace.org
Subject: Re: Microsoft Access 97 Stores Database Password as Plaintext
I noticed that there was a bit of confusion about MindRape's comments and I
thought I would help clear them up.
What he is talking about is that when one Microsoft Access database attaches
to tables from another Microsoft Access database, the connection string
(including the password) is stored in the MSysObjects table. Since you will
need the database password to attach a table, you must have a database with
the table already attached.
However, it is not uncommon (and considered good practice) to have one
database for code and another for the data tables. The point is to keep your
code in a separate database and attach to the other tables so that when you
update your code, you just replace the code database.
The obvious problem with this is that the password to the data database is
stored in the MSysObjects table of the code database.
The quickest solution is to encrypt the database as well as using password
protection. Of course, one should also set the proper rights and permissions
on a production database. As added protection, the tables could all be
attached in code using an autoexec macro. You could use the ACL to limit
database access, but MindRapes' method would simply require read access. If
you take away read access to the database, it isn't very useful.
This same problem shows up anywhere you must save the connection string to a
database. I often find passwords visible in plaintext in an executable that
access a protected database. Connection strings can also be exposed on poorly
protected .asp pages and cgi scripts.
In short, it would be nice if Access encrypted the connection string by
default but since it doesn't this is probably more of a misconfiguration
exploit rather than a software bug.
.sozni
-------------------------------------------------------------------------
Date: Mon, 8 Feb 1999 10:15:39 -0500
From: sozni@USA.NET
To: BUGTRAQ@netspace.org
Subject: Re: Microsoft Access 97 Stores Database Password as Plaintext
This other issue you have brought up is indeed a very serious security risk. In fact I always open up
Access databases in a hex editor just to see what I can find. There was an old add-in from Microsoft
that contained a confidential (although not interesting) internal memo. I also once found a password
for an online brokerage account in a production database.
The problem is that Access allocates the the space it needs for its tables but until used, that space
will contain whatever used to be on those sectors on the hard drive.
My solution was to write a utility that will make a huge file filled with zeros the same size as the
remaining space on the hard drive. Then I deleted that file and compacted the database into a new
filename.
Of course this was several years ago when remaining space on a hard drive was negligent. I look at my
remaining hard drive space now and making a 3GB file would not be practical. Perhaps you could make a
small partition or even a ram drive just for this purpose.
.sozni
>Another issue: while looking ate mdb files in a text editor, i noticed
that the files contain 'garbage' info also (random memory
content, since it was info i typed minutes ago).
'compact database' didn't help.
A service provided by TechAID Computer Services, http://www.techaid.net
The e-mail address of the sender MAY NOT BE AUTHENTIC.
-------------------------------------------------------------------------
ate: Fri, 12 Feb 1999 10:07:18 -0800
From: Ian Holsman <IanHolsman@INAME.COM>
To: BUGTRAQ@netspace.org
Subject: Re: Microsoft Access 97 Stores Database Password as Plaintext -- MS Money Affected
This also affect Microsoft Money.. as it stores it's details in a Access MDB
format.
you can use the all-access program posted here to find out your Money password