bugtraq - Re: ADVISORY FOR IOPUS SECURE EMAIL ATTACHMENTS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 25 Apr 2006 13:20:03 +0200
From: fabio <ctrlaltca@...ero.it>
To: ntwak0@...ehack.com
Cc: bugtraq@...urityfocus.com
Subject: Re: ADVISORY FOR IOPUS SECURE EMAIL ATTACHMENTS


ntwak0@...ehack.com wrote:
> ##############################################################################
> ##############################################################################
> ################# ADVISORY FOR IOPUS SECURE EMAIL ATTACHMENTS ################
> ##############################################################################
> ##############################################################################
> ### Affected    : iOpus Secure Email Attachments                           ###
> ### Link        : http://www.iopus.com/freeware/secure%2Demail/            ###
> ### Type        : File Encryption Tool                                     ###
> ### Problem     : Passphrase guessing, Passphrase Issue                    ###
> ### Date        : 2006-04-22                                               ###
> ### Author      : NtWaK0, Noph0bia @ www.SafeHack.com                      ###
> ##############################################################################
> ### From iopus web site "iOpus SEA protects your data not only on its way  ###
> ### across the internet, but also on the recipient's PC." THIS IS ONLY     ###
> ### TRUE IF YOU DID NOT PICK SOME TYPE OF PASSWORDS.                       ###
> ###                                                                        ###
> ### I have found a problem with the way iOpus handle the user password.    ###
> ### The problem can EXPOSE your Protected encrypted file if you did not    ###
> ### pay attention when you pick your password.                             ###
> ###                                                                        ###
> ### Here is some examples                                                  ###
> ### /////////////////////                                                  ###
> ### 1- Create a text file with one word inside "hello"                     ###
> ### 2- Encrypt your text.txt file using iOpus. The out put is text.exe     ###
> ### 3- Pick AAAAAAAAAAAAAAAAAAA as password                                ###
> ### 4- Encrypt the file                                                    ###
> ### 5- Double click text.exe to open it, you should see Enter Password     ###
> ### 6- Now you think you need to enter AAAAAAAAAAAAAAAAAAA right ? WRONG   ###
> ###    Just enter A or AA and you will have access to your so called       ###
> ###    protected file(s).                                                  ###
> ### 7- You can try with ABCABCABCABCABC as password. To access the file    ###
> ###    you guessed it you DO NOT NEED To enter ALL your password :-) you   ###
> ###    can just enter ABC and you will have access to your protected data  ###
> ### 8- Let us see if you can find what you need to enter if you have a     ###
> ###    password like this "ABCDEFGABCDEFGABCDEFG". I hope you got it       ###
> ###    You need to enter ABCDEFG.                                          ###
> ##############################################################################
> ### To read why we have so many problem in information security check      ###
> ### http://www.safehack.com/Textware/badsecurity.txt                       ###
> ##############################################################################
> ##############################################################################
> 

Quoting IOpus website:
...
iOpus SEA uses the Blowfish encryption algorithm with a  key length of
up to 448 bits. Blowfish encryption is so strong that it has never been
cracked yet. In fact, most experts agree that it cannot be cracked with
current computer technology and that includes supercomputers!
...

Blowfish implementations are well know to suffer to this problem. You
found nothing new.

fabio