Solved "Encrypted-Split-No-Strings-DB" - Security Challenge Solved (1 Viewer)

[FrankRuperto]

At the end of the day, the bottom line is that it's not difficult to enable the navigation pane and other db properties of encrypted FE's, which are used for opening forms to view/edit decrypted data stored in password-encrypted backends. It's very easy to export all the data displayed in those forms, as seen below. Having only one shared password for all users to open an FE is not adequate security. Most data breaches occur by workers who are not authorized to view certain sensitive data, e.g. payroll, credit card nums, etc, so only one shared password for everyone to open an FE is a major limitation. Most users and developers will agree that breaking into a "protected" accde or accdb FE and altering its db properties is unacceptable security.

 

[isladogs]

Frank also sent me an email with the above info & screenshot together with some additional material
This is a shortened version of my email reply:
=======================================

Unfortunately, Frank’s claims made about hacking this example app, in emails, here at AWF and earlier at UA, have included a lot of smoke and mirrors. The screenshots in the previous post continue this tradition.

It is certainly true that the FE can be unlocked and the supplied password removed either using VBA from an external application (or by the use of a $99 utility which Frank purchased for this purpose).

Doing so, will re-enable the Export context menu command
However, the Excel file in the screenshot is not the result of doing that export on any of the forms shown.
Those are indeed the 'apparent field names' that are exported...but actually they are the control names rather than the real field names
The data shown isn't what is exported when that process is done.

The Excel file shown has been populated by a different process
And in any case, it isn't the complete source table from the encrypted BE database.

Having only one shared password for all users to open the same accde FE further deteriorates security. Most data breaches occur by users who are not authorized to view certain sensitive data, e.g. payroll, credit card nums, etc, so only one shared password for everyone is a major shortcomming. Most users and even veteran UA and AWF developers will agree that breaking into an FE is unacceptable security.

Of course, much of that is true.
Nevertheless, users can also be required to login and, if desired, some form of two step verification can also be added
Sensitive data can be made more inaccessible using e.g. using password protected forms.

Particularly sensitive data such as Credit/debit card numbers should NEVER be stored in an Access database. The validity of credit/debit card data entered by customers would be checked against the card providers own data (16 digit number, expiry date, CRC)

Anyway, I thought I'd upload another partly completed example that I had already been working on
Its an encrypted ACCDE file made in A2010 32-bit with password FrankTheTank (thanks to @Mike Krailo for that idea!)

It has one password protected form and one deep hidden table
Unlocking the file will be relatively easy. The challenge is just to do the following:
1. Find out the password to the form
2. Decrypt the deep hidden table and email me the decrypted version
Simples!

NOTE:
1. Its far from finished & I may have left some unintended 'back doors'. If so. it will be easier than intended
2. The attached file should open in any 32-bit version of Access from 2010 onwards. If anyone would like a 64-bit version, let me know

 

[FrankRuperto]

Those are indeed the 'apparent field names' that are exported...but actually they are the control names rather than the real field names
The data shown isn't what is exported when that process is done.

What's the difference, I was still able to export all data that was decrypted for users to manipulate via a form they use for viewing/adding/editing records.
If you think the image I posted is doctored up, try it for yourselves. The bottom line is no matter what you do to "secure" your accde frontend, its a red herring security theatre.

FYI, The tool I purchased for altering the accde's db properties is called REDACTED. It also does a whole lot more. You can download the free trial version which has full functionality, in limited mode.

Access is just not the right tool for properly securing an application and its data, period.

EDITED by THE_DOC_MAN: @FrankRuperto , I removed the link. If someone wants that product, they can search for themselves, but there is some concern that we shouldn't make it TOO easy for people to do nefarious things.
2nd EDIT: After some discussion offline, some members felt it was not consistent with the tone of the forum to point to a hacker's tool, directly or implicitly.

 

[The_Doc_Man]

What's the difference, I was still able to export all data that was decrypted for users to manipulate via a form they use for viewing/adding/editing records.
If you think the image I posted is doctored up, try it for yourselves. The bottom line is no matter what you do to "secure" your accde frontend, its a red herring security theatre.

FYI, The tool I purchased for altering the accde's db properties is called Access Forensics. It also does a whole lot more. You can download the free trial version which has full functionality, in limited mode.

Access is just not the right tool for properly securing an application and its data, period.

EDITED by THE_DOC_MAN: Frank, I removed the link. If someone wants that product, they can search for themselves, but there is some concern that we shouldn't make it TOO easy for people to do nefarious things.

I will repeat that Access is no different than ANY OTHER TOOL in the toolchest. Databases are targets, PERIOD. If a hacker has a rocket in his pocket aimed at you, that will be your hard luck (to have been targeted). A determined hacker with enough time and money on his hands will get to you at some point. Not a matter of IF but WHEN.

Access was designed for small businesses, not for some giant fiduciary corporation subject to national laws on privacy and security. Your attitude of caution is not wrong, but you seem to have taken it to a level of total disdain. That is inappropriate for this forum. I will ask you to tone that down because we have people who use Access for legitimate non-fiduciary business purposes related to scheduling or inventory or property management. They use what they use because of cost-effectiveness. If you don't like Access, don't use it. But respect the people who have limited choice and respect us for trying to help them with what they've got.

 

[FrankRuperto]

Your attitude of caution is not wrong, but you seem to have taken it to a level of total disdain

Disdain?... Why would anyone have disdain for such a cute little toy like Access?...

It just so happens I do have a fiduciary duty towards my customers because if their data gets hacked I could be held responsible for using a development tool which has a reputation of being very easy to hack.

@isladogs started this whole controversy by posting his "Security Challenge" over a year ago. No one that I am aware of really made any effort to break into his challenge demo until I came along, uncovering several built-in Access vulnerabilites and his demo design flaws. Then he gets a defensive cavalier attitude when I reported my findings in several forums and the MS Bounty Program.

Long story short, we have already converted many of our applications to browser-based intranet solutions and phasing out Access all together, and I suggest you all start looking for better alternatives. That's all!

 

[The_Doc_Man]

Converting apps to web-intranet? As the French would say, chacun a son gut. (Forgive me for leaving out diacritical marks.)

@FrankRuperto - I have to ask... what is your purpose in posting here? Surely not altruism, because your approach doesn't seem so beneficent. You posted something similar on UA and it has been removed. Your attitude appears to be unwelcome there. I should point out that in truth, that same attitude isn't particularly welcome here, either.

You act as though you believe that security is black and white, but we all know that it is shades of gray. If I harden my site, my app, or my server, I raise the level of my low-hanging fruit to something that the script-kiddies will avoid because it is too much like work. By percentages, most of the hackers you see online are wannabe-hackers who couldn't decipher a TCPIP transport-layer header if their lives depended on it.

Anything that resists their efforts more than just a little bit immediately discourages them. Make your stuff just hard enough to stop them because they have no patience and then you have done something useful. After that, the degree of hardening depends on your application's subject matter. Monetary stuff? Harden the hell out of it. Sales and shipping records? Maybe not worth someone's time to hack anyway.

And, Frank, for what it is worth, I helped maintain the U.S.Navy's BUMED personnel application for their Medical Scholarships program, which was written with an Access front-end and an SQL Server back-end. This was hosted out of the Navy Enterprise Data Center/New Orleans. That app was subject to Privacy Act, Federal Records Management Act, and HIPAA regulations (among others), but the Navy still used Access up front. You know why? Because we hardened the environment and kept the casual hackers out of the intranet. And that was good enough for the Navy.

I think you have an issue of purpose that you need to resolve. You ACT as though you have an axe to grind. Ask yourself why you have a burr up your butt regarding Access. While you have that kind of attitude, you do nobody any good. Go vent your spleen elsewhere.

 

[The_Doc_Man]

I see you gave me a Dislike, Frank. No surprises there. I understand you don't like being called down, but I'm not the first one to notice you in that negative light. That should tell you something.

 

[FrankRuperto]

It's all good Doc, I'm not offended. My relationship with Access is like Marmite, "Love it, or hate it"

I know I come off too strong and obnoxious, but I am actually fond about Access and wish MS would do something to improve
its security. So I am using reverse psychology to get their attention. Nobody likes bad publicity. I have personally known Chris Capossela, MS' Chief Marketing Officer, since he was Manager of Database Products in 1992. l was a Product Planner and was with him at Comdex Vegas that year when he introduced Access 1.0

I directly approached Chris in 2016 about including Access in all O365 Business Plans, and it became reality. So you see, I'm not that bad after all, it's my unorthodox way of raising consciousness and influencing... nothing personal.

https://access.uservoice.com/forums...de-access-desktop-in-all-o365-subscription-pl

 

[The_Doc_Man]

Frank, let me say this: You did come across a bit strong, and reverse psychology might work somewhere. But here, we have lots of newcomers to Access who would be confused by your remarks. I think if there is any negativity, it is there. I have no doubts that you have some serious skills, please don't ever think otherwise. But we like to make this a friendly place (within our limits to do so) and find that excessive negativity doesn't help. For people who have strict fiduciary requirements, they will find out soon enough. For folks whose use of Access isn't so strongly regulated, it may be that Access is what they need. And for some folks, it may be that Access is all they can afford until their business gets going. We have to try to accommodate all of those groups. So please, if you have any specific answers, DO stick around and chime in. But just consider the scope and needs of our audience when you do so.

Is that a fair request?

 

[FrankRuperto]

Frank, let me say this: You did come across a bit strong, and reverse psychology might work somewhere. But here, we have lots of newcomers to Access who would be confused by your remarks. I think if there is any negativity, it is there. I have no doubts that you have some serious skills, please don't ever think otherwise. But we like to make this a friendly place (within our limits to do so) and find that excessive negativity doesn't help. For people who have strict fiduciary requirements, they will find out soon enough. For folks whose use of Access isn't so strongly regulated, it may be that Access is what they need. And for some folks, it may be that Access is all they can afford until their business gets going. We have to try to accommodate all of those groups. So please, if you have any specific answers, DO stick around and chime in. But just consider the scope and needs of our audience when you do so.

Understood

Is that a fair request?

Yes

 

[NauticalGent]

Why would anyone have disdain for such a cute little toy like Access?...

That one made me spit out my coffee! That "cute little toy" has provided me a fairly comfortable lifestyle since 2008 - to me, the cuteness is almost GD beautiful!

 

[arnelgp]

I directly approached Chris in 2016 about including Access in all O365 Business Plans, and it became reality. So you see, I'm not that bad after all, it's my unorthodox way of raising consciousness and influencing... nothing personal.

you are a great influencer? or is it already rolling from inside the idea?

 

[FrankRuperto]

you are a great influencer? or is it already rolling from inside the idea?

The idea was not already rolling from within MS.
When has MS marketing given much thought to Access?... They still don't mention it in all their Office marketing.
In year 2015, I initially posted the idea in Access UserVoice and the then MS Access Team admin, Michal Bar closed it.
Then I reposted the idea and escalated it with an email to Chris Cap.
Notice that in the repost I also suggested MS bundle 1 free year of O365 with Windows 10 as an incentive for users to upgrade.

https://access.uservoice.com/forums...racking_code=f8f1f2184a6391cc667cc201c1286020

 

[FrankRuperto]

That one made me spit out my coffee! That "cute little toy" has provided me a fairly comfortable lifestyle since 2008 - to me, the cuteness is almost GD beautiful!

That one certainly captivated your attention and spawned a great cottage industry.

 

[NauticalGent]

And now I know who Richard Arkwright is...this forum includes history too!

 

[FrankRuperto]

And now I know who Richard Arkwright is...this forum includes history too!

The inventor of the cotton gin?

 

[isladogs]

Inventor of the spinning frame as well as the rotary carding engine used in cotton processing in the Industrial Revolution.
I wrongly thought he invented the Spinning Jenny but that was by James Hargreaves around the same time.

 

[FrankRuperto]

Inventor of the spinning frame as well as the rotary carding engine used in cotton processing in the Industrial Revolution.
I wrongly thought he invented the Spinning Jenny but that was by James Hargreaves around the same time.

Actually, Eli Whitney was who invented and patented the cotton gin.

 

[Isaac]

whatever you post in public becomes a public property.
there is no need for your permission, unless it was it was hacked from your
private messages or the conversation is strictly private between the two of you.

Certainly this is far from being true. Posting something in public does not make it public property. That is an oversimplification of the truth.

Regardless, the program terms state "

• represent and warrant that your Submission is your own work, that you haven't used information owned by another person or entity, and that you have the legal right to provide the Submission to Microsoft."

There are a number of civil penalties allowed for, for persons who deliberately break those (among others) rules.

 

[Isaac]

Frank, let me say this: You did come across a bit strong, and reverse psychology might work somewhere. But here, we have lots of newcomers to Access who would be confused by your remarks. I think if there is any negativity, it is there. I have no doubts that you have some serious skills, please don't ever think otherwise. But we like to make this a friendly place (within our limits to do so) and find that excessive negativity doesn't help. For people who have strict fiduciary requirements, they will find out soon enough. For folks whose use of Access isn't so strongly regulated, it may be that Access is what they need. And for some folks, it may be that Access is all they can afford until their business gets going. We have to try to accommodate all of those groups. So please, if you have any specific answers, DO stick around and chime in. But just consider the scope and needs of our audience when you do so.

Is that a fair request?

Frank reminds me a little of ButtonMoon (older UA members may remember), the main difference is ButtonMoon was exquisitely knowledgeable, but alas - he didn't last long due to inappropriate elevation of "anti-access" discussions. Frank is a little newer to UA and less experienced but tries his best. Frank, if you need a place to brag about your skillset of this and that and the other that has nothing to do with Access, then logically you ought to find a home in a forum dedicated to that (or can't you?) It's a funny phenomenon, but I've noticed that every now and then people like to join a VBA / Office / Excel / Access forum and spend most of their time trying to convince everyone how many other, super-cool languages they know. (Adam is a prime example). It seems to make them feel good. The only place their charade falls down is that if they really WERE in that place, knowledge-wise, they wouldn't be looking for a home in a VBA forum in the first place. Ever. Oops..