Security experts warn of holes in Lotus Domino

From...

by Jennifer Disabatino

(IDG) -- Dutch engineers have found a pair of holes in Lotus Notes and Domino's password encryption and the security on public versions of the address list.

User passwords are encrypted as they are entered on both Domino and Notes servers, but the alphanumeric strings (or hashes) to which they are converted can be matched against a master password encryption key and used as a live password by users on the same server, warned Trust Factory B.V., a Netherlands-based security consulting firm, at the Def Con hackers convention in Las Vegas over the weekend.

	MESSAGE BOARD
Security on the net
	ALSO
Dutch Secret Service accused of e-mail snooping

Though cracking an organization's system in this way would require a pretty high level of sophistication for one of the holes, Web-based systems are particularly vulnerable, the Trust Factory warning said.

Trust Factory engineer Patrick Guenther was able to crack Notes to gain access to passwords and individual files, which he demonstrated at the conference in a joint presentation with Secure Design International Group (SDI).

"I wouldn't describe it as minor. I think that the implications are rather large, based on the way that Notes [servers] are configured at most organizations," said Matthew Devost, one of the presenters for SDI.

MORE COMPUTING INTELLIGENCE

IDG.net home page

Computerworld's home page

Hackers demo Notes sabotage

Security issues lie behind messaging battles

Cybercops need better tools

Reviews & in-depth info at IDG.net

E-BusinessWorld

TechInformer

Questions about computers? Let IDG.net's editors help you

Subscribe to IDG.net's free daily newsletter for IT leaders

Search IDG.net in 12 languages

News Radio

Fusion audio primers

Computerworld Minute

He said Notes administrators can protect their databases simply by "salting" hashes -- adding a random number into the scrambled alphanumeric string that represents a password. This function is an option built into newer versions of both Domino and Notes.

Devost said a cracker can access the hashes with a few commands through a Web browser if the address list is publicly available there.

Another way to break the hashings is through a brute-force attack using macros, viruses or other code designed to grab the recipient's personal information, including the encrypted passwords, and sending them back to the author of the code. Even salted hashes could be sent back to a cracker in this way, Devost said.

"All it takes is one person to run a Word document," he said.

Domino product managers Kevin Lynch and Katherine Spanbauer said Lotus has advised users of these vulnerabilities for some time, and urged administrators to use the salted encryption. However, some systems need the unsalted version to remain backwards-compatible in a mixed shop.

"Simply use the other hash that's been available since [Notes version] 4.6 and you will no longer be able to perpetrate that attack," Lynch said.

"It's an extremely sophisticated style of attack and the attacker would have to already have internal access to resources," Spanbauer said. The attacker would also need special software to decipher the hash, then place it where the password is normally stored in memory.

That technique is only valid if the user has the same password for Web and server access. Most users access the server through Notes, not the Web, Spanbauer said.

Trust Factory and SDI suggest taking the following steps to protect your Notes database:

  • Restrict access from the Web
  • Choose different passwords for ID and HTTP accounts
  • Store user ID files on removable media
  • Use strong password hashing
  • Manually upgrade to the stronger hash
  • Exit Notes completely when leaving your desk
  • Never click on any e-mail attachments

Lack of funding threatens cybersecurity project
July 31, 2000
Debate erupts over disclosure of software security holes
July 31, 2000
Microsoft security executive promises improvements
July 27, 2000
Microsoft scrambling to fix new Outlook security hole
July 21, 2000
Clinton administration announces new cyber-security proposals
July 17, 2000

Hackers demo Notes sabotage
(PC World Online)
Security issues lie behind messaging battles
(IT World)
Pentagon scrutinizes handheld security
(FCW)
Hackers: Naughty and nice
(Computerworld)
Uncle Sam recruits hackers
(PC World Online)
Cybersecurity project threatened
(The Industry Standard)
Cybercops need better tools
(Computerworld)
NSA exec calls for better security
(Computerworld)

Lotus Development Corp.

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.