Re: [Full-disclosure] New Tool - Flashfxp Password Decryptor Released !

[Nicolai () nxtgn org]

How is this a "terribly mistake" ? 
If people use the "Site > Security > Set password" then this program can't decrypt the "sites".

Security through obscurity vs plain text

  _____  

From: Valdis.Kletnieks () vt edu
To: Nagareshwar Talekar [mailto:tnagareshwar () gmail com]
Cc: Full Disclosure [mailto:full-disclosure () lists grok org uk]
Sent: Mon, 09 May 2011 14:21:34 +0200
Subject: Re: [Full-disclosure] New Tool - Flashfxp Password Decryptor Released !

On Mon, 09 May 2011 17:38:30 +0530, Nagareshwar Talekar said:
  > FlashFXP stores the password for all the configured FTP sessions in
  > the local file called "sites.dat". Passwords are encrypted with XOR
  > based encoding mechanism using the magic string as
  > “yA36zA48dEhfrvghGRg57h5UlDv3″. 
  
  A magic string of upper/lower/numeric. That just makes Baby Cryptographer Jesus
  cry...
  
  At that point, one has to wonder what *else* FlashFPX does terribly wrong.  I'm
  sure you brilliant guys can find lots of hilarious uses for feeding it an ftp://
   URI of your own choosing. :)
  
    


This e-mail and any attachments may contain confidential material for the sole use of the intended recipient. If you 
are not the intended recipient, please be aware that any disclosure, copying, distribution or use of this e-mail or any 
attachment is prohibited. If you have received this e-mail in error, please contact the sender and delete all copies.
Thank you for your cooperation

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/