ADVISORY FOR IOPUS SECURE EMAIL ATTACHMENTS

##############################################################################
##############################################################################
################# ADVISORY FOR IOPUS SECURE EMAIL ATTACHMENTS ################
##############################################################################
##############################################################################

Affected : iOpus Secure Email Attachments

Link : http://www.iopus.com/freeware/secure%2Demail/

Type : File Encryption Tool

Problem : Passphrase guessing, Passphrase Issue

Date : 2006-04-22

Author : NtWaK0, Noph0bia @ www.SafeHack.com

##############################################################################

From iopus web site "iOpus SEA protects your data not only on its way

across the internet, but also on the recipient's PC." THIS IS ONLY

TRUE IF YOU DID NOT PICK SOME TYPE OF PASSWORDS.

I have found a problem with the way iOpus handle the user password.

The problem can EXPOSE your Protected encrypted file if you did not

pay attention when you pick your password.

Here is some examples

/////////////////////

1- Create a text file with one word inside "hello"

2- Encrypt your text.txt file using iOpus. The out put is text.exe

3- Pick AAAAAAAAAAAAAAAAAAA as password

4- Encrypt the file

5- Double click text.exe to open it, you should see Enter Password

6- Now you think you need to enter AAAAAAAAAAAAAAAAAAA right ? WRONG

Just enter A or AA and you will have access to your so called

protected file(s).

7- You can try with ABCABCABCABCABC as password. To access the file

you guessed it you DO NOT NEED To enter ALL your password :-) you

can just enter ABC and you will have access to your protected data

8- Let us see if you can find what you need to enter if you have a

password like this "ABCDEFGABCDEFGABCDEFG". I hope you got it

You need to enter ABCDEFG.

##############################################################################

To read why we have so many problem in information security check

http://www.safehack.com/Textware/badsecurity.txt

##############################################################################
##############################################################################