[RESOLVED] Database Encryption

[Darkbob]

Hi there. I've got an Access 2000 format database (.mdb) for a VB6 application that's stored locally on a customer's computer. I've used the default DAO Jet encryption and assigned a password to the database plus you need a password to open and run the program. But the customer backs up to a USB drive. If they lose the USB drive and somebody gets the MDB file, I hear it's not too hard to break that encryption. I know I could upgrade to an SQL database but short of that, is there anything I can do to improve security?

Thanks for your help.

[jdc2000]

A simple solution would be to make a backup copy of the .mdb file on the computer's hard drive, then encrypt that again with a stronger encryption program and copy that to the USB drive. With a stronger encryption program installed, this task could be automated so that the user just needs to double-click on a desktop icon with the USB drive attached to the computer for the encrypted backup file to be created and copied to the USB drive.

[PlausiblyDamp]

You could use something like https://www.veracrypt.fr/en/Home.html to encrypt the USB

[Darkbob]

Both excellent suggestions. Just wondering if there was a more secure update or patch for the DAO/Jet/whatever format.

[jdc2000]

An even simpler solution is to use something like an IronKey flash drive with built-in encryption. Yo can get some that will auto-erase after a few incorrect password entries so brute-forcing won't work on them.

I think it is unlikely that the old encryption that you are using would have a newer more secure update.

[Darkbob]

I finally gave up and just had the customer install 7-Zip. First I popped up a screen with an animated GIF playing. Next I passed the password to 7Zip using a shell execute to a hidden window and a call to WaitForSingleObject. I created the ZIP on the customer's drive then made a copy to his external drive.

Here's just a taste (not the full project obviously).

   ' Given CompressMe$ is the path to the folder to compress
   '  See if 7-Zip is installed? 

   If Dir("C:\Program Files\7-Zip\7z.exe") = "" Then
      If Dir("C:\Program Files (x86)\7-Zip\7z.exe") = "" Then
         CompressData = False  ' 7Zip not installed
         A = MsgBox("7-Zip is not installed.  Open web browser and download it now?", vbYesNo)
         If A = vbYes Then
            WebPath$ = "https://www.7-zip.org"
            rc = ShellExecute(0&, vbNullString, WebPath$, vbNullString, vbNullString, vbMaximizedFocus)
            MsgBox "Run your backup again after installing 7-zip"
            exit function
         End If
      Else
         SevenZ$ = "C:\Program Files (x86)\7-Zip\7z.exe"
      End If
   Else
      SevenZ$ = "C:\Program Files\7-Zip\7z.exe"
   End If
   

   ' Make an archive called ArchiveName$ in the system temp directory

   TempDir$ = GetTempDir()
   
   ArchiveLocation$ = TempDir$ & ArchiveName$
   
   Cmd$ = Chr$(34) & SevenZ$ & Chr$(34) & " u " & Chr$(34) & ArchiveLocation$ & Chr$(34) & " -r -p" & Password$ & " " & Chr$(34) & CompressMe$ & Chr$(34)

   Call RunAndWait(Cmd$)   ' Compress the data and wait for it to finish

   ' Now we copy the file to the external drive...

[wqweto]

I'm a little bit puzzled about the -r option you are passing to 7-zip. Do you recursively zip the whole directory or is CompressMe only a single file?

Here is how to do the same w/ the help of ZipArchive class (full project of course, no extra DLLs/EXEs needed)

Option Explicit
 
Private Sub Command1_Click()
    Dim ArchiveLocation As String
    Dim CompressMe      As String
    Dim Password        As String
    
    ArchiveLocation = "d:\temp\aaa.zip"
    CompressMe = "d:\temp\aaa.mdb"
    Password = "secret"
    With New cZipArchive
'        .AddFromFolder CompressMe, Recursive:=True, Password:=Password
        .AddFile CompressMe, Password:=Password
        .CompressArchive ArchiveLocation
    End With
End Sub

Just make sure to set ZIP_CRYPTO = 1 in projects Conditional Compilation (or the zip will be created w/o encryption)



cheers,
</wqw>

[Darkbob]

Hey! Thanks so much. I had never heard of ZipArchive. I'll check that out right away!

[Darkbob]

Hey wqweto ... thanks for the tips. I found the demo project in the archive. Very nice! Thanks for the help.

[reexre]

@wqweto
I tried your zipArchive.
For me it works very well but I found a problem that I think is good to point out. As it could damage files.
Without encryption it seems to me to work perfectly.
But be careful! Using encryption (password) the files I extracted are corrupted !!!
I tried to zip a folder containing jpgs.
(as mentioned before, without password, everything is ok)
But with password and the ZIP_CRYPTO = 1, there are a lot of corrupted images in the unzipped files folder. (Jpg unreadable)

I don't want to disturb you. sorry but I think this is a very serious problem that needs to be solved.

Screenshot of extracted folder:



Code used:

    ZIP.AddFromFolder SourcePath & "\*.*" , True, , , "pass"

    ZIP.CompressArchive App.Path & "\TEST.zip"

    ZIP.OpenArchive App.Path & "\TEST.zip"
    
    ZIP.Extract App.Path & "\Extracted", , "pass"

(Win 7 - 32 bits)

[wqweto]

Yes, there seems to be some troubles with traditional ZipCrypto (the CRC check is failing).

Until I investigate it further you can pass EncrStrength:=1 parameter for the WinZip AES-128 encryption (or EncrStrength:=3 for AES-256) which seems to work on the sample folder you sent me.

Thanks for the bug report!

cheers,
</wqw>

[wqweto]

Here is what's going on: the way "traditional" ZipCrypto is implemented you cannot password protect a zip archive when the level of compression is 0 -- i.e. when storing files in the archive with no compression.

In your case some JPGs cannot be compressed (the compressed size becomes bigger than the original file) so ZipArchive decides to store these files uncompressed *but*. . . still keeps the password protection which is illegal under the ZIP spec and produces (somewhat) invalid archives w/ entries that fail CRC check. ZipArchive make the effort to check CRC on extract but does not raise an error on failure (WAT?!:-)) so this explains the corrupted JPG files on extraction.

I'll have to think it through what to do in this case: whether to raise an error, whether to silently remove the password (very bad) or to keep encrypted and compressed entry although bigger than original file (less worse but still suboptimal).

My *overall* advice is to stay away from ZipCrypto w/ EncrStrength:=3 for AES-256 whenever possible (I'll make it the default in vNext). Using traditional ZipCrypto can be justified only on WinXP machines as CNG support is missing and AES encryption is not supported by ZipArchive there.

cheers,
</wqw>

[Darkbob]

Edit: Solved my first problem - you need to compile the program once to see the m_Ozip object. D'oh.

But next problem...

Without EncrStrength when I clicked on the zip file in Windows it would open. When I tried to drag a file out of the archive to a folder Windows would ask for my password then copy the file.

I tried EncrStrength:=1 and also EncrStrength:=3 using this line:

.AddFromFolder CompressMe, Recursive:=True, Password:=Password, EncrStrength:=1

Now when I try and decrypt the file using Windows it fails.



It does decrypt OK using 7-Zip. Is that how it's designed or am I doing something wrong?

[wqweto]

WinZip's AES encryption in not supported by the Windows built-in zip folder support, so that might be a show-stopper in your case.

If you have to support Windows zip folder then the traditional ZipCrypto (EncrStrength:=0) is the only option for compatible password protected archives, although this level or protection is weak and long ago broken. Probably with some very long passwords could be still good enough. . .

cheers,
</wqw>

[wqweto]

@reexre: The problem with corruption of password protected uncompressible files is fixed in commit f2ac4b0. ZipArchive now just drops the password protection in this case as not to produce illegal archives under ZIP 2.0 spec.

cheers,
</wqw>