Everstrike's "Lock folder XP 3.4" vulnerability

hi all,

a friend of mine needed a tool to lock certain folders because someone needed to borrow his notebook.

after a bit of googling i've came up with this program:
Everstrike's Lock folder XP 3.4

Quote:

---

Lock Folder XP is a new security tool that lets you lock your files, folders and drives with your personal password. Locking folders, files and drives also effectively protects you from malicious programs, such as viruses, worms and trojans. Locking your files, folders and drives is the best way to guarantee that nobody, whether accidentally or intentionally, gets access to your financial, health, private or confidential information. And since locking your files, folders or drives makes them invisible, they can not be deleted, damaged or harmed in any other ways. We also advise that you get Lock Folder XP if you have a laptop and travel frequently. After all, if your notebook gets lost or stolen, you don't want strangers to see your financial data, credit card or social security numbers.

---

so he downloaded it and installed it with a password. The idea behind the program is that it encrypts the folders with a (by the american government approved) encryption scheme.
i believe this is true (haven't tested it), but i still wanted to find out how safe it is :)

here's what i did:

( i've obtained the admin password) and logged in as admin. now when you try to open the encrypted folder --> "access denied!". so far so good.

then i launched the taskmgr and killed all processes not original windows.
then i ran services.msc and did the same.

then i fired up regedit.exe and searched for the string "everstrike", after a couple of presses on F3, i came to the string where all data is stored for this program.
one of those things is a DWORD value "password" which i think stored the password in an md5 hash. (this is nice to crack :D).

but in the same key i've found some strings with values 1 and 2, these were for booting up the program. so i changed those values to 0, and rebooted the computer.

now when it is logged in again i have full access to those folders again!!!

nice program!. but i wouldn't ever use it!

http://www.everstrike.com/


i haven't contacted the authors because i believe this is done on purpose while coding it ( perhaps a backdoor for them?).

i also haven't show you the exact keys because i don't want some lame kid using this info to get to encrypted folders without even knowing what they exactly do ;)

but i think most of you will have enough knowledge of windows to know how to do this...

[edit] ps, this all took me about 6 minutes after starting[/edit]
kind regards,


Scorpius

Well... The best option would be using the EFS provided with XP (Pro only?) and using file permissions.


3rd party applications do not protect from local attacks very well.. Not that Microsoft is exactly a nexus of security, but the tools included are usually better (provided you know how) than a 3rd party app. Mainly because they are part of the OS and not an add on.

Good post...

I have played with many of these types of programs.
Most of the time you simply need to image the drive or partition, and then mount the image
and have full access to the files. This is also so with MS EFS as it relies on ntfs.
Linux boot disk can have the same effect on most file/folder encryption schemes.

False sense of security for people I think.

If it relies on the filesystem or memory resident programs / services for encryption, there is
really no security.

Limiting physical access can help of course.

another disadvantage of EFS is that it only works on NTFS, and it happens to be that my friend is running XP home and on FAT32, so that will never work, and like ss2chef already said, that's not that good either...

Enuff should do the trick. It was on one of my friend's computer once, and seemed impossible to get off.

A laptop is for mobile computing, therefore it has a higher risk of being physically stolen or abused. With this in mind I would severly limit the amount of personal data held on a laptop. Any data of this nature would have to be encrypted with something like PGP - of course it would be very wise to keep the key seperate. lol

Not entirely practical for people that only have a laptop, but then good security is always inconvenient!

Would PGP be susceptable to the method you used to disable everstrike? Hmmm!

As for your friend, lepricaun, I would suggest he removes anything that he doesn't want this temporary user to see., after making a couple of security copies and testing them of course.

My laptop is running an encrypted Reiser file system with permissions up the wazoo, and I still won't keep anything personal on it.

It just isn't safe.

I think we're all missing the point here... Why the hell would you lend out your laptop? I don't even give my girlfriend physical access to mine. She can SSH if she needs to use it.

Quote:

---

I think we're all missing the point here... Why the hell would you lend out your laptop? I don't even give my girlfriend physical access to mine. She can SSH if she needs to use it.

---

well, because it isn't really his laptop.. although he is a friend of mine, he's also my collaegue (right spelling?). and the notebook he has really is from our company, and another collaegue of ours needs to borrow it. and although there aren't really very private things on it, he still has some so he wanted it to be blocked for them... he used this program though, although he has seen how easy it is for us to go around it... it was his choice.... the reason he still used this program is because we both know they aren't the most knowledgable people when it comes to computer security...

so that problem is solved so far, but the fact still remains that this is a worthless program, and i strongly suggest no one would ever use it to keep his data safe. dispite the fact that the following lines are said by the company to sell the product:

Quote:

---

After all, if your notebook gets lost or stolen, you don't want strangers to see your financial data, credit card or social security numbers.

---

Quote:

---

No one, but yourself will be able to access the locked files, folders and drives

---

Quote:

---

All information will be encrypted before transmission to prevent possible interception by a third party. Your transmissions, while in this area, are absolutely secure and private.

---

nice company, selling a product and saying that it is safe, while it doesn't take any effort to get around this security!

You might like to look at Scramdisk. It creates an encrypted virtual drive protected by up to four passwords.

Just move the folders into that. In all probability the colleague wouldn't even see that it was there because until you mount it, it is reported as part of the visible drive in which you have created it.

Cheers

EDIT: It is now called "DriveCrypt" http://www.securstar.com/

But you can get the older versions here: http://www.scramdisk.clara.net/

Quote:

---

You might like to look at Scramdisk. It creates an encrypted virtual drive protected by up to four passwords.

Just move the folders into that. In all probability the colleague wouldn't even see that it was there because until you mount it, it is reported as part of the visible drive in which you have created it.

Cheers

EDIT: It is now called "DriveCrypt" http://www.securstar.com/

But you can get the older versions here: http://www.scramdisk.clara.net/

---

thanks, i will look this up ;)

Quote:

---

Would PGP be susceptable to the method you used to disable everstrike? Hmmm!

---

No, because it the program doesn't rely on Windows registry. Once those files are encrypted you can put them anywhere, and you would still need to decrypt them for any sort of access. The encryption does rely on the program, but the way PGP handles passphrase usage is completely different than the origonal application in Everstrike. It's all internally in the program, using keys to unlock data with phassphrases. Thus you would have to attack the file, rather than the program.

The only two people that have access to my computers is myself and my wife, but I still use a very good form of security for any personal data.

I just burn all personal data to a CD and have it encrypted with PGP. The data is not resident on the computer at all. If it were very sensitive and I didn't want anyone to ever be able to see it, I would also use PGP's free space wiper utility after I deleted the raw data and had it copied to the CD. ( note > I have not ever really done this because I really don't have any data that is that secure or sensitive)

Quote:

---

Originally posted here by ss2chef
Most of the time you simply need to image the drive or partition, and then mount the image
and have full access to the files. This is also so with MS EFS as it relies on ntfs.
Linux boot disk can have the same effect on most file/folder encryption schemes.

---

if i understood , you stated that you can break EFS mouting ntfs disk on other OS, such as a linux. that is correct? could you explain better this? some examples perhaps? As i far i know you cant break EFS on that way except if you keep keys on HD.

Quote:

---

Originally posted here by cacosapo
if i understood , you stated that you can break EFS mouting ntfs disk on other OS, such as a linux. that is correct? could you explain better this? some examples perhaps? As i far i know you cant break EFS on that way except if you keep keys on HD.

---

No, please re-read what I wrote..
With Linux boot disks, you are still mounting NTFS.
To defeat EFS, I image a drive or partition and mount that image RAW and
have complete access to each file or folder.

Quote:

---

No, please re-read what I wrote..
With Linux boot disks, you are still mounting NTFS.
To defeat EFS, I image a drive or partition and mount that image RAW and
have complete access to each file or folder.

---

how do you mount a RAW partition under linux? i was under the impression that the normal mount command always needs a selected file system. so this means that you have another tool to do this, which tool is it?

Quote:

---

Originally posted here by ss2chef
No, please re-read what I wrote..
With Linux boot disks, you are still mounting NTFS.
To defeat EFS, I image a drive or partition and mount that image RAW and
have complete access to each file or folder.

---

ok, but its still the same problem. How, mounting as a raw image, you get files, since they are encripted? what kind of tool do that? i still dont understand the concept. please post more details.

Quote:

---

Originally posted here by cacosapo
ok, but its still the same problem. How, mounting as a raw image, you get files, since they are encripted? what kind of tool do that? i still dont understand the concept. please post more details.

---

No, they are encryped while wrapped in NTFS.
NTFS is stripped in the imaging process.
EFS is a logical encryption under NTFS so no NTFS - no encryption...
I can show you sometime if you like...

The main point is the encryption should follow the file regardless or OS or filesystem.

man, after i read your reply ive started to research again about. According ive read, you cant do it (access data) just accessing disk outside windows (like using a disk sector editor). File' data is encrypted too, not just protect. So, if you mount as raw and use and disk editor, find i-nodes that represent the file, you will get only ..... encrypted data.

I cant find anywhere your reference about "its encrypted while wrapped in NTFS". According the some sites (links bellow) FILE DATA is encrypted. So file encryption is following file, as you noticed. i cant see how EFS is weak as you stated. The only way (except brute force RSA algorithm) is getting private key of the user, that must be managed accordingly.


http://www.winntmag.com/Windows/Arti...87/pg/3/3.html
http://www.pcguide.com/ref/hdd/file/...Encrypt-c.html

Simply put.

If I encrypt a file in XP

FTP that file to one of my FTP servers.

Jump on another XP box and grab that file from ftp server, there is no encryption
associated. No Decryption is required to run/use the file.

The encryption does not follow the file

If the encryption service is not running when the disk is imaged via bootdisk, the image
can be mounted "service less" providing access to the files unecrypted. I can copy those
files via a virtual drive mounted to the image without encryption and ntfs permissions for
that matter.

First, please keep in mind that I am a bit fuzy on the internal workings of EFS, but this is from what I remebmer... don't quote me on any of this..

edit: Also note that I've heard sources on both sides saying that file transfers from one Filesystem to the next would be encrypted still, and other sources say that they would no longer be encrypted. So I'm afraid I can't be much more help


ss2chef is correct here. Moving or copying EFS files to another file system removes the encryption, but backing them up preserves the encryption, this is because the encryption is not actually encryption, it is "We will protect and encrypt, but only if EFS is running and active." So it's half-ass encryption.

I know it doesn't make much sense acosapo, but that's how EFS works. It will encrypt as long as the EFS is running and the file system is active. If a file is copied to another file system that is not running EFS it loses it's encryption because there is nothing left to -continue- the encryption process. So going from NTFS EFS to FAt32 would completely remove all encryption. Actually the word remove is bad because we assume that the file stays encrypted during EFS. That isn't correct. The file is "Granted" encryption ability while EFS is running, and when EFS isn't active on that filesystem, that ability is gone.

WARNING, THEORY!! : In fact, in theory even moving it to another EFS active filesystem should still break the encryption merely because the file would then have to have a different encryption key for this new filesystem, and thus have no encryption after the file transfer.


A good article on EFS in general:

http://www.winntmag.com/Articles/Ind...&Key=Internals

pooh sun tzu:

Thank you for the much more informational explanation.
I struggle with that and need to work on it..!!

Nice work..

yes, it is indeed useful info, i did knew there was an option like this (i've done it before by copying a n encrypted file to a fat32 filesystem i think, but it is too long ago to remember... i'll have to see it for myself again ;)