Data Protection Programs
This next section takes a look at programs that implement password protection schemes that are meant to keep data secure. Unlike the previous section that focused only on user account information, this section targets programs that were designed to store sensitive data such as banking transactions, stock information, credit card numbers, and lists of passwords. In this case, an attacker would have access to a much larger chunk of sensitive data that the user is assuming is secure.
Financial Management Programs
This section addresses a common problem that exists in numerous "secure" programs. Although some programs obscure the issue, all of the following titles can all have their security mechanisms bypassed by a small change in the registry. Note how some companies try to hide this fact by placing the registry key in unusual locations, or by burying the flag inside a large registry string.
It should also be mentioned that a malicious user can often just copy the "protected" data file off the target device and onto a device that has no protection enabled. Since the data itself is not truly protected, an alternate device will be able to open it without the need of a password.
PocketKeeper
PocketKeeper is program to manage daily out-of-pocket expenses with multiple accounts different currencies, intuitive register, customizable categories, budget, multiple report charts, and password protection. It has two levels of security: a global level that restricts access to the program, and an account level that secures each account.
Upon reviewing the files associated with this program, it was discovered that both passwords are stored as plaintext in the .dat files of the program directory. Specifically, the global password is stored in config.dat and each account password is stored in its relative account file.
PocketMoney
PocketMoney not only uses a weak encryption scheme to protect the password (discussed in previous section), but the protection scheme itself can be easily disabled by setting the following key in the registry to a 0.
HKLM\SOFTWARE\Handmark\PocketMoney\Active Password = 0
In response to this issue, PocketMoney's vendor rather alarmingly states, "The password in PocketMoney wasn’t designed to encrypt data or prevent anyone other than a casual browser from being able to access the data. I suggest the user turn on the Palm’s [sic] password protection if they want their palm [sic] secure." We, the users, beg to differ!
WebIS Money
WebIS Money states it includes "...secure password protection to your data to safeguard it in case your PDA is lost or stolen." Unfortunately, this protection can be disabled by removing the following key from the registry.
HKLM\SOFTWARE\Microsoft\Pim\Outlook\IMAP Folders\H11
MoneyTracer
MoneyTracer claims "Encryption of your data by your own password." While the password option is available, it only authenticates the user and does not actually encrypt any of the data, as claimed. To disable the "encryption," set the following key to "0."
\HKLM\SOFTWARE\Maction\MoneyTracer\bEnablePassword = 0
TinyStocks Stock Manager
TinyStocks states "Stock Manager can be protected with a 4-digit PIN number." This PIN is stored as a four byte value within a preferences string in the registry. The following lists the location and provides a screen shot of the key with the password set/unset.
HKCU\Software\TinyStocks\Stock Manager\
)
Figure 3: Screenshot of StockManager registry key
When asked about this issue, TinyStocks replied, "The password protection in Stock Manager is not meant to be secure but to stop casual access to the program. The data itself is unencrypted and so it’s quite easy to just look at it."
PocketExepense Pro
PocketExpense Pro creates a .vol file that contains all its financial information. Included in the file are the settings associated with the password option. In this program, all the preferences are stored in a large hex string in the registry. However, it is possible to disable the password by changing the hex at 0x7D94 from 0xF4 to 0xD4.
Inspiration
Inspiration is a project management program that uses "built-in security features" to "...keep files from accidentally being modified when handhelds are shared between multiple users." Therefore, it is fair to say that the password was never meant to offer any true security.
However, if an attacker wanted to remove the password requirement, they would only have to overwrite the encrypted password value that is stored in the project header. Specifically, bytes 0x95 - 0xA3 need to be set to 0x20 0x00 0x20 0x00 etc.
Microsoft Money for Windows Mobile 2006
MS Money for Windows Mobile 2006 is a financial tracking program that can be used independently or with the MS Money application that runs on many desktops. The program can be configured to require a password when it is launched. However, this password does not encrypt the data, which stored as plaintext in data stores in the Databases folder.
The password is stored in the registry at HKLM\SOFTWARE\Microsoft\Money2000 CE\Options\Display in an encrypted format. However, the encryption scheme used to protect the password from viewers is a weak proprietary algorithm and can be cracked using the following equation:
(((encrypted byte - A0)/4) * 8) + 24h) – encrypted byte = password byte (all hex calcs)
Finally, the password requirement can be nullified by deleting the key from the registry, which will cause the program to think the password option is not set.
Password\Credit Card\PIM Management Programs
The following programs are used to store sensitive information, such as password lists, web site login information, credit card numbers and more. Due to the nature of the data, these programs need to be secure. If an attacker can access the "protected" information, they will have gained access to a wealth of information.
As illustrated, the previous financial programs do not protect your data. Although most vendors use security as a selling point, in reality a simple registry tweak will allow anyone access to this sensitive data. Even the vendors admit their software is insecure and recommend alternative steps to secure the data.
Password Master 1.0 — Free version
Password Master 1.0 allows you to "Keep all your passwords, Credit Card Numbers and other details in a single place. Carry your money or details virtually everywhere." According to their website, "Since all the details you enter are sensitive data, the Password Manager helps you to create a Secure Login to the records. You can create a Master Password, which will work as your Master key for all the virtual locks you know."
Unfortunately, if someone deletes the following key from the registry, the master key will be reset, thus allowing full access to the data.
\HKEY_CURRENT_USER\Software\Data\Password Master\Pref\dt
This version of the program is free. The vendor's website provides this tool, but also advertises their Password Master 3.5 version that requires a payment. We look at this version later in this section.
Passman 1.2
Passman 1.2 is a password management program that can create and store a list of passwords. It includes an option for a startup password and also provides for "512bit encryption" of the data. Both protection measures can be cracked.
To bypass the startup password, a malicious user only has to set the startpasswdenabled registry key to "0."
\HKEY_CURRENT_USER\Software\passman\preferences\startpasswdenabled.
However, if the database is encrypted, the actual data will still be secure. Unfortunately, the password used to encrypt the database is itself not properly protected. The following equation will decrypt the password stored in the registry, thus giving an attacker full access to the database.
Assume:
B is byte of password in hex
P is position of target byte (0-5 for this example)
B-(25-(3*P)) = Bplaintext
[ra]26 23 20 1D 1A 17 = 111111
The end result is that the password option can be disabled, the password can be cracked, and the database can be decrypted by an unauthorized user.
Password Master 3.5
Password Master 3.5 states it will "Keep all your passwords, Credit Card Numbers and other secured details in a single place. Carry your money or details virtually everywhere. Now includes a Free Desktop Companion!" In other words, it performs much the same function as CodeWallet Pro.
Ironically, like the previous example, Password Master 3.5 also does not encrypt its information using a unique password. Instead it relies on the user provided password to authenticate the operator to the file, and then decrypts the data using an internal algorithm.
Therefore, using the same technique outlined previously, an attacker only has to obtain the secure file and overwrite a few bytes of hex in the header to gain access to that file, and the "secured" contents within. In this case, the hex range is from 0x2A - 0x5B.
In addition to the overwrite vulnerability, this program also was found to have a bug in the "hint" feature that enables a user to obtain their password if they forget it based on a question/answer. However, if the user never configures the hint option, the program will give up the password regardless of a correct hint/answer combination. While this is a security risk, it is based on a software bug — not a broken security model.
It is important to note that Password Master 3.5 also includes a desktop companion that operates in the exact same way as its mobile counterpart. This desktop based program also suffers from the header overwrite bug.
CodeWallet 6.0.5
CodeWallet is one of the premier programs that fall into the category of Secure Information Manager. It will protect your sensitive information, including credit cards, passwords, etc., in an encrypted file that a user decrypts with a password when opening.
During testing, we initially thought that CodeWallet used the same dysfunctional method of "encryption" used by Password Master. However, CodeWallet looked into our report and commented that the while it was possible to open a file, all the data was still encrypted.
After further research, we found that when a Wallet file is created, its encryption is tied to the original password used to create the file. If the password is changed after this, it will only change the authentication requirements, and not affect the encryption. Unfortunately, the My Sample Wallet included with the program comes with a known password, which an attacker can use against other files based on the Sample Wallet. As a result, anyone who used the Sample Wallet as a template to build their own secure Wallet is vulnerable to the header overwrite attack.