Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Dameware Passes Weak File Encryption Key in the Clear
From: "ax09001h ax09001h" <ax09001h () hotmail com>
Date: Tue, 23 Mar 2004 20:00:19 +0000

Dameware Mini Remote Control version 4.1.0.0 and presumably previous versions pass a Blowfish encryption key over the wire in the clear. It is bad enough that they appear to be using Blowfish in Electronic Codebook Mode; but they compound their errors by the following two vulnerabilities.

The Dameware Mini Remote Control offers the capability to transfer files between the host and client encrypted using 128-bit Blowfish Encryption. Their first mistake is using a poor random bit generator to create their encryption key. After identifying the key in the clear I was able to surmise that the lack of cryptographic expertise of the Dameware developers was systemic and checked to see if they were using the built-in rand() function to generate the key. It did not take long to exhaust the small space of the WindowsÂ’ linear congruential generator (LCG) in rand() to discover the following hypothesized loop for generating their file encryption key.

int                     i;
unsigned char   dw_f_key[16];
srand(time(NULL));
for(i=0;i<16;i++){
        dw_f_key[i] = rand();
}

The second major and more serious mistake is that they actually pass the file encryption key in the clear over the wire. This can be seen by analyzing packets between host and target. In a packet just prior to the file being sent the second to the last string of 16-bytes is the file encryption key.

_________________________________________________________________
Check out MSN PC Safety & Security to help ensure your PC is protected and safe. http://specials.msn.com/msn/security.asp

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


  By Date           By Thread  

Current thread:
  • Dameware Passes Weak File Encryption Key in the Clear ax09001h ax09001h (Mar 23)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]