Date: Thu, 4 Feb 1999 04:15:13 -0700 From: "Donald Moore (MindRape)" To: BUGTRAQ@netspace.org Subject: Microsoft Access 97 Stores Database Password as Plaintext ====================================================================== Title: Microsoft Access 97 Stores Database Password as Plaintext Date: 02/03/99 Author: Donald Moore (MindRape) E-mail: damaged@futureone.com ====================================================================== Microsoft Access 97 databases protected with a password are stored in foreign mdb's table attachements as plaintext. This can be accessed very easily by issuing a strings and grep operation on the foreign mdb. Example: % strings db1.mdb | grep -i "pwd" MS Access;PWD=plaintext;Table2pppppppjI'% MS Access;PWD=plaintext;Table1qqqqqqqkJ(& ====================================================================== Impact of Exploit ====================================================================== Having the password allows the secured mdb to be unlocked, giving permission to view database objects, possibily revealing other database connection strings, propiertary source code, tampering of data. One such commercial database marketed by FMS, Inc., Total VB SourceBook 6.0, can be easily compromised using this method. ====================================================================== How to Recreate ====================================================================== 1. Create an mdb 2. Create a Table 3. Reopen the new mdb in exclusive mode 4. From the Tools Menu, select Security and then click Set Database Password 5. Set database password 6. Exit Access 7. Create another mdb 8. From the File Menu, select Get External Data, and click Link Tables.... Select the passworded mdb and then select the table you created. 9. Exit Access 10. Perform a strings+grep on the 2nd mdb to reveal the password. - - - ------------------------------------------------- - -- --- ______ ______ . .:_\___ \\_ . \_::. Donald Moore (MindRape) . .::./ ./ // ./__/.:::. . _<_____/<____ >_:. Email: mindrape@home.com . \/ . damaged@futureone.com Damaged Cybernetics - - - ------------------------------------------------- - -- --- -------------------------------------------------------------------------- Date: Thu, 4 Feb 1999 22:07:40 -0700 From: "Donald Moore (MindRape)" To: BUGTRAQ@netspace.org Subject: Re: Microsoft Access 97 Stores Database Password as Plaintext Paul, This recreation just demonstrates how you can recreate this situation. The problem is that Microsoft Access stores the password to the database in plaintext. Without knowing the password beforehand, one can search other mdb's looking for table attachments orginiating from the passworded database. The commercial product from FMS has been compromised, and a number of others (including our own product). ______ ______ . .:_\___ \\_ . \_::. Donald Moore (MindRape) . .::./ ./ // ./__/.:::. . _<_____/<____ >_:. Email: mindrape@home.com . \/ . damaged@futureone.com Damaged Cybernetics - - - ------------------------------------------------- - -- --- -----Original Message----- >From: Paul Leach To: 'Donald Moore (MindRape)' ; BUGTRAQ@NETSPACE.ORG Date: Thursday, February 04, 1999 12:32 PM Subject: RE: Microsoft Access 97 Stores Database Password as Plaintext >I'm not an Access guru, so please forgive me, but I don't quite understand >the scenario. Please see the questions below. > >> -----Original Message----- >> From: Donald Moore (MindRape) [mailto:mindrape@HOME.COM] >> Sent: Thursday, February 04, 1999 3:15 AM >> >> ====================================================================== >> How to Recreate >> ====================================================================== >> >> 1. Create an mdb >> 2. Create a Table >> 3. Reopen the new mdb in exclusive mode >> 4. From the Tools Menu, select Security and then click Set Database >> Password >> 5. Set database password >> 6. Exit Access >> 7. Create another mdb >> 8. From the File Menu, select Get External Data, and click >> Link Tables.... >> Select >> the passworded mdb and then select the table you created. > >At this point, didn't you have to enter the password of the first mdb to get >access to it? > >If so, then the fact you got access to the passwords after knowing the >password doesn't seem very interesting. > >If not, then it seems like that's _actually_ the bug: you got access to a >password protected database without having to know the password. > >> 9. Exit Access >> 10. Perform a strings+grep on the 2nd mdb to reveal the password. >> > >Finally, why wouldn't ACLs be used to protect the database instead of >passwords? > >Paul ------------------------------------------------------------------------- Date: Fri, 5 Feb 1999 09:03:22 -0500 From: Eric Stevens To: BUGTRAQ@netspace.org Subject: FW: Microsoft Access 97 Stores Database Password as Plaintext Appologies, the files were too large to send through Bugtraq, you may go here instead: http://cs.millersv.edu/~ejsteven/linked.mdb http://cs.millersv.edu/~ejsteven/protected.mdb -----Original Message----- >From: Eric Stevens [mailto:ejsteven@cs.millersv.edu] Sent: Friday, February 05, 1999 8:53 AM To: bugtraq@netspace.org Subject: RE: Microsoft Access 97 Stores Database Password as Plaintext What our friend is saying is that if you File >> Get External Data >> Link Tables [which is something that I use regularly] on a password protected database, the passwords to the protected database are stored in the database that contains the linked tables in plain text. Attached are two databases, Protected.mdb and Linked.mdb. Their names are self explanatory. If you text edit the Linked.mdb, you'll quickly discover the unprotected password. The threat is this: You have a database system set up that may be prone to attack (and ALL general use systems are prone to attack, perhaps by a disgruntled employee) which uses linked tables, and a simple-minded fool could figure out how to gain full access, and place in some malicious code, even if the database that contains the links is protected with a password. Here's some of the text right from Notepad to your computer: C:\My Documents\protected.mdb [...about 10 ASCII characters...] MS Access;PWD=protected;protected The passwords to the two databases attached are: linked.mdb; linked protected.mdb; protected ,----/ + / Eric Stevens \ /--/ ejsteven@cs.millersv.edu \ / Dept. of Computer Science \ '----/ Millersville University, PA + ------------------------------------------------------------------------- Date: Fri, 5 Feb 1999 09:14:11 MST From: Sozni To: BUGTRAQ@netspace.org Subject: Re: Microsoft Access 97 Stores Database Password as Plaintext I noticed that there was a bit of confusion about MindRape's comments and I thought I would help clear them up. What he is talking about is that when one Microsoft Access database attaches to tables from another Microsoft Access database, the connection string (including the password) is stored in the MSysObjects table. Since you will need the database password to attach a table, you must have a database with the table already attached. However, it is not uncommon (and considered good practice) to have one database for code and another for the data tables. The point is to keep your code in a separate database and attach to the other tables so that when you update your code, you just replace the code database. The obvious problem with this is that the password to the data database is stored in the MSysObjects table of the code database. The quickest solution is to encrypt the database as well as using password protection. Of course, one should also set the proper rights and permissions on a production database. As added protection, the tables could all be attached in code using an autoexec macro. You could use the ACL to limit database access, but MindRapes' method would simply require read access. If you take away read access to the database, it isn't very useful. This same problem shows up anywhere you must save the connection string to a database. I often find passwords visible in plaintext in an executable that access a protected database. Connection strings can also be exposed on poorly protected .asp pages and cgi scripts. In short, it would be nice if Access encrypted the connection string by default but since it doesn't this is probably more of a misconfiguration exploit rather than a software bug. .sozni ------------------------------------------------------------------------- Date: Mon, 8 Feb 1999 10:15:39 -0500 From: sozni@USA.NET To: BUGTRAQ@netspace.org Subject: Re: Microsoft Access 97 Stores Database Password as Plaintext This other issue you have brought up is indeed a very serious security risk. In fact I always open up Access databases in a hex editor just to see what I can find. There was an old add-in from Microsoft that contained a confidential (although not interesting) internal memo. I also once found a password for an online brokerage account in a production database. The problem is that Access allocates the the space it needs for its tables but until used, that space will contain whatever used to be on those sectors on the hard drive. My solution was to write a utility that will make a huge file filled with zeros the same size as the remaining space on the hard drive. Then I deleted that file and compacted the database into a new filename. Of course this was several years ago when remaining space on a hard drive was negligent. I look at my remaining hard drive space now and making a 3GB file would not be practical. Perhaps you could make a small partition or even a ram drive just for this purpose. .sozni >Another issue: while looking ate mdb files in a text editor, i noticed that the files contain 'garbage' info also (random memory content, since it was info i typed minutes ago). 'compact database' didn't help. A service provided by TechAID Computer Services, http://www.techaid.net The e-mail address of the sender MAY NOT BE AUTHENTIC. ------------------------------------------------------------------------- ate: Fri, 12 Feb 1999 10:07:18 -0800 From: Ian Holsman To: BUGTRAQ@netspace.org Subject: Re: Microsoft Access 97 Stores Database Password as Plaintext -- MS Money Affected This also affect Microsoft Money.. as it stores it's details in a Access MDB format. you can use the all-access program posted here to find out your Money password