Re: ADVISORY FOR IOPUS SECURE EMAIL ATTACHMENTS
ntwak0@xxxxxxxxxxxx wrote:
> ##############################################################################
> ##############################################################################
> ################# ADVISORY FOR IOPUS SECURE EMAIL ATTACHMENTS ################
> ##############################################################################
> ##############################################################################
> ### Affected : iOpus Secure Email Attachments ###
> ### Link : http://www.iopus.com/freeware/secure%2Demail/ ###
> ### Type : File Encryption Tool ###
> ### Problem : Passphrase guessing, Passphrase Issue ###
> ### Date : 2006-04-22 ###
> ### Author : NtWaK0, Noph0bia @ www.SafeHack.com ###
> ##############################################################################
> ### From iopus web site "iOpus SEA protects your data not only on its way ###
> ### across the internet, but also on the recipient's PC." THIS IS ONLY ###
> ### TRUE IF YOU DID NOT PICK SOME TYPE OF PASSWORDS. ###
> ### ###
> ### I have found a problem with the way iOpus handle the user password. ###
> ### The problem can EXPOSE your Protected encrypted file if you did not ###
> ### pay attention when you pick your password. ###
> ### ###
> ### Here is some examples ###
> ### ///////////////////// ###
> ### 1- Create a text file with one word inside "hello" ###
> ### 2- Encrypt your text.txt file using iOpus. The out put is text.exe ###
> ### 3- Pick AAAAAAAAAAAAAAAAAAA as password ###
> ### 4- Encrypt the file ###
> ### 5- Double click text.exe to open it, you should see Enter Password ###
> ### 6- Now you think you need to enter AAAAAAAAAAAAAAAAAAA right ? WRONG ###
> ### Just enter A or AA and you will have access to your so called ###
> ### protected file(s). ###
> ### 7- You can try with ABCABCABCABCABC as password. To access the file ###
> ### you guessed it you DO NOT NEED To enter ALL your password :-) you ###
> ### can just enter ABC and you will have access to your protected data ###
> ### 8- Let us see if you can find what you need to enter if you have a ###
> ### password like this "ABCDEFGABCDEFGABCDEFG". I hope you got it ###
> ### You need to enter ABCDEFG. ###
> ##############################################################################
> ### To read why we have so many problem in information security check ###
> ### http://www.safehack.com/Textware/badsecurity.txt ###
> ##############################################################################
> ##############################################################################
>
Quoting IOpus website:
...
iOpus SEA uses the Blowfish encryption algorithm with a key length of
up to 448 bits. Blowfish encryption is so strong that it has never been
cracked yet. In fact, most experts agree that it cannot be cracked with
current computer technology and that includes supercomputers!
...
Blowfish implementations are well know to suffer to this problem. You
found nothing new.
fabio