bugtraq - IObit Protected Folder Authentication Bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 15 Jun 2012 10:24:52 -0500
From: "Adam Behnke" <adam@...osecinstitute.com>
To: <bugtraq@...urityfocus.com>
Subject: IObit Protected Folder Authentication Bypass

>From IObit: "Protected Folder is designed to password-protect your folders
and files from being seen, read or modified in Windows 7, Vista, XP and
Server 2008, 2003. It works like a safety box, just drag and drop the
folders or files you want to hide or protect into Protected Folder, then no
one can see, read or modify them. Whether you are concerned with privacy,
data theft, data loss, or data leaks, Protected Folder is an ideal tool for
you."

InfoSec Institute Security Researcher Kyriakos Economou reports that some
simple bit flipping of the return value from password checking function
allows anyone to bypass the security of this product:
http://resources.infosecinstitute.com/iobit-bypass/

It is not recommended to use this product to protect your (or anyone else's)
personal information.