Security experts warn of holes in Domino

[InfoSec News <isn () C4I ORG>]

http://www.infoworld.com/cgi-bin/deleteframe.pl?story=/articles/hn/xml/00/08/01/000801hndomino.xml

Published at: Tuesday, Aug. 1, 2000 7:12 am PT

By Jennifer DiSabatino, Computerworld

DUTCH ENGINEERS HAVE found a pair of holes in Lotus Development's
Notes and Domino's password encryption and the security on public
versions of the address list.

User passwords are encrypted as they are entered on both Domino and
Notes servers, but the alphanumeric strings (or hashes) to which they
are converted can be matched against a master password encryption key
and used as a live password by users on the same server, warned Trust
Factory, a Netherlands-based security consulting firm, at the Defcon-8
conference in Las Vegas this weekend.

Though cracking an organization's system in this way would require a
pretty high level of sophistication, Web-based systems are
particularly vulnerable, the Trust Factory warning said.

Trust Factory engineer Patrick Guenther was able to crack Notes to
gain access to passwords and individual files, which he demonstrated
at the conference in a joint presentation with Secure Design
International Group (SDI).

"I wouldn't describe it as minor. I think that the implications are
rather large, based on the way that Notes [servers] are configured at
most organizations," said Matthew Devost, one of the presenters for
SDI.

He said Notes administrators can protect their databases simply by
"salting" hashes -- adding a random number into the scrambled
alphanumeric string that represents a password. This function is an
option built into newer versions of both Domino and Notes.

Devost said a cracker can access the hashes with a few commands
through a Web browser if the address list is publicly available there.

Another way to break the hashings is through a brute-force attack
using macros, viruses, or other code designed to grab the recipient's
personal information, including the encrypted passwords, and sending
them back to the author of the code. Even salted hashes could be sent
back to a cracker in this way, Devost said.

"All it takes is one person to run a Word document," he said.

Domino product managers Kevin Lynch and Katherine Spanbauer said
Cambridge, Mass.-based Lotus has advised users of these
vulnerabilities for some time, and urged administrators to use the
salted encryption. However, some systems need the unsalted version to
remain backwards-compatible in a mixed shop.

"Simply use the other hash that's been available since [Notes,
Version] 4.6 and you will no longer be able to perpetrate that
attack," Lynch said.

"It's an extremely sophisticated style of attack and the attacker
would have to already have internal access to resources," Spanbauer
said. The attacker would also need special software to decipher the
hash, then place it where the password is normally stored in memory.

That technique is only valid if the user has the same password for Web
and server access. Most users access the server through Notes, not the
Web, Spanbauer said.

Trust Factory and SDI suggest taking the following steps to protect
your Notes database:

- Restrict access from the Web

- Choose different passwords for ID and HTTP accounts

- Store user ID files on removable media

- Use strong password hashing

- Manually upgrade to the stronger hash

- Exit Notes completely when leaving your desk

- Never click on any e-mail attachments

ISN is hosted by SecurityFocus.com
---
To unsubscribe email LISTSERV () SecurityFocus com with a message body of
"SIGNOFF ISN".