full-disclosure - Re: New Tool - Flashfxp Password Decryptor Released !

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 09 May 2011 19:12:52 +0200
From: Nicolai@...gn.org
To: full-disclosure@...ts.grok.org.uk
Cc: Valdis.Kletnieks@...edu
Subject: Re: 
	New Tool - Flashfxp Password Decryptor	Released !

How is this a "terribly mistake" ? 
If people use the "Site > Security > Set password" then this program can't decrypt the "sites".

Security through obscurity vs plain text

  _____  

From: Valdis.Kletnieks@...edu
To: Nagareshwar Talekar [mailto:tnagareshwar@...il.com]
Cc: Full Disclosure [mailto:full-disclosure@...ts.grok.org.uk]
Sent: Mon, 09 May 2011 14:21:34 +0200
Subject: Re: [Full-disclosure] New Tool - Flashfxp Password Decryptor Released !

On Mon, 09 May 2011 17:38:30 +0530, Nagareshwar Talekar said:
  > FlashFXP stores the password for all the configured FTP sessions in
  > the local file called "sites.dat". Passwords are encrypted with XOR
  > based encoding mechanism using the magic string as
  > â€œyA36zA48dEhfrvghGRg57h5UlDv3â€³. 

  A magic string of upper/lower/numeric. That just makes Baby Cryptographer Jesus
  cry...

  At that point, one has to wonder what *else* FlashFPX does terribly wrong.  I'm
  sure you brilliant guys can find lots of hilarious uses for feeding it an ftp://
   URI of your own choosing. :)

This e-mail and any attachments may contain confidential material for the sole use of the intended recipient. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of this e-mail or any attachment is prohibited. If you have received this e-mail in error, please contact the sender and delete all copies.
Thank you for your cooperation

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/