full-disclosure - Product activation is exploitable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20030908125904.GHFL13237.lakemtao05.cox.net@winxppro>
From: rkingsla at cox.net (Rick Kingslan)
Subject: Product activation is exploitable

Good thought, but I think that the 'security by obscurity' of the current MS
WPA scheme is still at work here.  The mechanism on what happens on the
other end (MS Clearing House end) is somewhat, to a large degree - not fully
understood.  And, it's encrypted, hashed, etc. to boot.  To be able to
receive the key is one thing - but to send back an appropriate response is
something different altogether.  Without the correct response, activation
fails with an error - and the user is going to be contacting MS as the
information on how and who to contact is right there.

Maybe the thought should be, 'Who cares? Get the key - I don't care about
the response.'  However, I'd think this would leave this scheme short-lived
as users figured out rather quickly that they aren't being activated.  And,
the witch hunt would be rather swift, I suspect.

-rtk

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Eduardo Reis
Sent: Monday, September 08, 2003 6:35 AM
To: Full-Disclosure@...ts.Netsys.Com
Subject: RE: [Full-Disclosure] Product activation is exploitable

Just one question about this, why didn't anyone made a server (software)
that would accept product activations and processed them as a MS server? Is
that hard to do such an attack?

I don't have the resources or the knowledge to do such a thing but I think
is easier to do than to patch the windows itself.

As anyone tried to do this? know anyone who tried? have any info on the
protocol used?

------------------------------------------
This message may contain confidential information or privileged material,
and is intended only for the individual(s) named. If you are not in the
named addressee you should not disseminate, distribute or copy this e-mail. 
Please notify the sender immediately by e-mail if you have received this
e-mail by mistake and delete this e-mail from your system.

E-mail transmission cannot be guaranteed to be secure or error-free as
information could be intercepted, corrupted, lost, destroyed, arrive late or
incomplete, or contain viruses. The sender therefore does not accept
liability for any errors or omissions in the contents of this message which
arise as a result of e-mail transmission. If verification is required please
request a hard-copy version.

Vodafone (Portugal)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html