Re: [gnukeyring-discuss] Re: A truly dumbass question

[Alan W. <al...@ma...>]

* Martin Pool (mb...@sa...) [010904 08:20]:
> You might be able to find it using minor bugs in 1.0, but I'm afraid I
> don't have time at the moment (changing jobs, study, etc) to chase it.
> So, if you want to try, go ahead.
> 
> Alternatively we could write a program to brute-force the password.
> You might be able to even do that with Perl based on the existing
> keyring-link program.

If your password was generated by keyring itself I've done the very
thing Martin mentions.  Specifically, I modified keyring-link to brute
force password by starting with ones that are randomly generated by
keyring.  

You have to tip the program off in terms of whether you used mixed case,
the length of the password, etc.

I managed to brute force my password in under 42s on a PII-350.

Of course this isn't a very good general-purpose hack.   I only wrote it
because I actually needed it.  Thankfully, the new realease of keyring
(whenever that comes) should close this backdoor (the reliance on the
Palm SysRandom() function).

Thanks goes to the individual who published the original strip(c)
exploit on Bugtraq.  I basically just borrowed their implementation of
SysRandom() and went from there.

I've attached the diff for anyone that's curious.  To be a general
purpose cracking tool this really needs to be cleaned up.  For example
I've hardcoded the "tips" above into the gen_passwd() routine.

-Alan

-- 
al...@ma...     GPG: 2D45 402F 7A1C 98F7 0B98  3ED4 BB06 A8CF 01EE 8925
www.madllama.net/~alan  PGP: E3 93 15 12 32 9E 46 01  C6 95 14 66 4F 51 06 42