ms-access-97-passwords.txt

`Date: Thu, 4 Feb 1999 04:15:13 -0700  
From: "Donald Moore (MindRape)" <[email protected]>  
To: [email protected]  
Subject: Microsoft Access 97 Stores Database Password as Plaintext  
  
======================================================================  
Title: Microsoft Access 97 Stores Database Password as Plaintext  
Date: 02/03/99  
Author: Donald Moore (MindRape)  
E-mail: [email protected]  
======================================================================  
  
Microsoft Access 97 databases protected with a password are stored in  
foreign mdb's table attachements as plaintext. This can be accessed very  
easily by issuing a strings and grep operation on the foreign mdb.  
  
Example:  
% strings db1.mdb | grep -i "pwd"  
  
MS Access;PWD=plaintext;Table2pppppppjI'%  
MS Access;PWD=plaintext;Table1qqqqqqqkJ(&  
  
======================================================================  
Impact of Exploit  
======================================================================  
  
Having the password allows the secured mdb to be unlocked, giving permission  
to view database objects, possibily revealing other database connection  
strings, propiertary source code, tampering of data. One such commercial  
database marketed by FMS, Inc., Total VB SourceBook 6.0, can be easily  
compromised using this method.  
  
  
======================================================================  
How to Recreate  
======================================================================  
  
1. Create an mdb  
2. Create a Table  
3. Reopen the new mdb in exclusive mode  
4. From the Tools Menu, select Security and then click Set Database  
Password  
5. Set database password  
6. Exit Access  
7. Create another mdb  
8. From the File Menu, select Get External Data, and click Link Tables....  
Select  
the passworded mdb and then select the table you created.  
9. Exit Access  
10. Perform a strings+grep on the 2nd mdb to reveal the password.  
  
  
- - - ------------------------------------------------- - -- ---  
______ ______ .  
.:_\___ \\_ . \_::.  
Donald Moore (MindRape) . .::./ ./ // ./__/.:::. .  
_<_____/<____ >_:.  
Email: [email protected] . \/ .  
[email protected] Damaged Cybernetics  
- - - ------------------------------------------------- - -- ---  
  
--------------------------------------------------------------------------  
  
Date: Thu, 4 Feb 1999 22:07:40 -0700  
From: "Donald Moore (MindRape)" <[email protected]>  
To: [email protected]  
Subject: Re: Microsoft Access 97 Stores Database Password as Plaintext  
  
Paul,  
  
This recreation just demonstrates how you can recreate this situation. The  
problem is that Microsoft Access stores the password to the database in  
plaintext. Without knowing the password beforehand, one can search other  
mdb's looking for table attachments orginiating from the passworded  
database. The commercial product from FMS has been compromised, and a  
number of others (including our own product).  
  
  
______ ______ .  
.:_\___ \\_ . \_::.  
Donald Moore (MindRape) . .::./ ./ // ./__/.:::. .  
_<_____/<____ >_:.  
Email: [email protected] . \/ .  
[email protected] Damaged Cybernetics  
- - - ------------------------------------------------- - -- ---  
  
  
  
-----Original Message-----  
>From: Paul Leach <[email protected]>  
To: 'Donald Moore (MindRape)' <[email protected]>; [email protected]  
<[email protected]>  
Date: Thursday, February 04, 1999 12:32 PM  
Subject: RE: Microsoft Access 97 Stores Database Password as Plaintext  
  
  
>I'm not an Access guru, so please forgive me, but I don't quite understand  
>the scenario. Please see the questions below.  
>  
>> -----Original Message-----  
>> From: Donald Moore (MindRape) [mailto:[email protected]]  
>> Sent: Thursday, February 04, 1999 3:15 AM  
>>  
>> ======================================================================  
>> How to Recreate  
>> ======================================================================  
>>  
>> 1. Create an mdb  
>> 2. Create a Table  
>> 3. Reopen the new mdb in exclusive mode  
>> 4. From the Tools Menu, select Security and then click Set Database  
>> Password  
>> 5. Set database password  
>> 6. Exit Access  
>> 7. Create another mdb  
>> 8. From the File Menu, select Get External Data, and click  
>> Link Tables....  
>> Select  
>> the passworded mdb and then select the table you created.  
>  
>At this point, didn't you have to enter the password of the first mdb to  
get  
>access to it?  
>  
>If so, then the fact you got access to the passwords after knowing the  
>password doesn't seem very interesting.  
>  
>If not, then it seems like that's _actually_ the bug: you got access to a  
>password protected database without having to know the password.  
>  
>> 9. Exit Access  
>> 10. Perform a strings+grep on the 2nd mdb to reveal the password.  
>>  
>  
>Finally, why wouldn't ACLs be used to protect the database instead of  
>passwords?  
>  
>Paul  
  
-------------------------------------------------------------------------  
  
Date: Fri, 5 Feb 1999 09:03:22 -0500  
From: Eric Stevens <[email protected]>  
To: [email protected]  
Subject: FW: Microsoft Access 97 Stores Database Password as Plaintext  
  
  
Appologies, the files were too large to send through Bugtraq, you may go  
here instead:  
http://cs.millersv.edu/~ejsteven/linked.mdb  
http://cs.millersv.edu/~ejsteven/protected.mdb  
  
-----Original Message-----  
>From: Eric Stevens [mailto:[email protected]]  
Sent: Friday, February 05, 1999 8:53 AM  
To: [email protected]  
Subject: RE: Microsoft Access 97 Stores Database Password as Plaintext  
  
  
What our friend is saying is that if you File >> Get External Data >> Link  
Tables [which is something that I use regularly] on a password protected  
database, the passwords to the protected database are stored in the database  
that contains the linked tables in plain text.  
Attached are two databases, Protected.mdb and Linked.mdb. Their names are  
self explanatory. If you text edit the Linked.mdb, you'll quickly discover  
the unprotected password. The threat is this: You have a database system  
set up that may be prone to attack (and ALL general use systems are prone to  
attack, perhaps by a disgruntled employee) which uses linked tables, and a  
simple-minded fool could figure out how to gain full access, and place in  
some malicious code, even if the database that contains the links is  
protected with a password. Here's some of the text right from Notepad to  
your computer:  
  
C:\My Documents\protected.mdb [...about 10 ASCII characters...] MS  
Access;PWD=protected;protected  
  
The passwords to the two databases attached are:  
linked.mdb; linked  
protected.mdb; protected  
  
,----/ +  
/ Eric Stevens \  
/--/ [email protected] \  
/ Dept. of Computer Science \  
'----/ Millersville University, PA +  
  
-------------------------------------------------------------------------  
  
Date: Fri, 5 Feb 1999 09:14:11 MST  
From: Sozni <[email protected]>  
To: [email protected]  
Subject: Re: Microsoft Access 97 Stores Database Password as Plaintext  
  
I noticed that there was a bit of confusion about MindRape's comments and I  
thought I would help clear them up.  
  
What he is talking about is that when one Microsoft Access database attaches  
to tables from another Microsoft Access database, the connection string  
(including the password) is stored in the MSysObjects table. Since you will  
need the database password to attach a table, you must have a database with  
the table already attached.  
  
However, it is not uncommon (and considered good practice) to have one  
database for code and another for the data tables. The point is to keep your  
code in a separate database and attach to the other tables so that when you  
update your code, you just replace the code database.  
  
The obvious problem with this is that the password to the data database is  
stored in the MSysObjects table of the code database.  
  
The quickest solution is to encrypt the database as well as using password  
protection. Of course, one should also set the proper rights and permissions  
on a production database. As added protection, the tables could all be  
attached in code using an autoexec macro. You could use the ACL to limit  
database access, but MindRapes' method would simply require read access. If  
you take away read access to the database, it isn't very useful.  
  
This same problem shows up anywhere you must save the connection string to a  
database. I often find passwords visible in plaintext in an executable that  
access a protected database. Connection strings can also be exposed on poorly  
protected .asp pages and cgi scripts.  
  
In short, it would be nice if Access encrypted the connection string by  
default but since it doesn't this is probably more of a misconfiguration  
exploit rather than a software bug.  
  
.sozni  
  
-------------------------------------------------------------------------  
  
Date: Mon, 8 Feb 1999 10:15:39 -0500  
From: [email protected]  
To: [email protected]  
Subject: Re: Microsoft Access 97 Stores Database Password as Plaintext  
  
This other issue you have brought up is indeed a very serious security risk. In fact I always open up  
Access databases in a hex editor just to see what I can find. There was an old add-in from Microsoft  
that contained a confidential (although not interesting) internal memo. I also once found a password  
for an online brokerage account in a production database.  
  
The problem is that Access allocates the the space it needs for its tables but until used, that space  
will contain whatever used to be on those sectors on the hard drive.  
  
My solution was to write a utility that will make a huge file filled with zeros the same size as the  
remaining space on the hard drive. Then I deleted that file and compacted the database into a new  
filename.  
  
Of course this was several years ago when remaining space on a hard drive was negligent. I look at my  
remaining hard drive space now and making a 3GB file would not be practical. Perhaps you could make a  
small partition or even a ram drive just for this purpose.  
  
.sozni  
  
>Another issue: while looking ate mdb files in a text editor, i noticed  
that the files contain 'garbage' info also (random memory  
content, since it was info i typed minutes ago).  
'compact database' didn't help.  
  
A service provided by TechAID Computer Services, http://www.techaid.net  
The e-mail address of the sender MAY NOT BE AUTHENTIC.  
  
-------------------------------------------------------------------------  
  
ate: Fri, 12 Feb 1999 10:07:18 -0800  
From: Ian Holsman <[email protected]>  
To: [email protected]  
Subject: Re: Microsoft Access 97 Stores Database Password as Plaintext -- MS Money Affected  
  
This also affect Microsoft Money.. as it stores it's details in a Access MDB  
format.  
  
you can use the all-access program posted here to find out your Money password  
  
`