PHP User Warning: fetch_template() calls should be replaced by the vB_Template class. Template name: bbcode_highlight in ..../includes/functions.php on line 4197
[RESOLVED] Database Encryption-VBForums
Results 1 to 15 of 15

Thread: [RESOLVED] Database Encryption

  1. #1

    Thread Starter
    Hyperactive Member
    Join Date
    Oct 2005
    Posts
    341

    Resolved [RESOLVED] Database Encryption

    Hi there. I've got an Access 2000 format database (.mdb) for a VB6 application that's stored locally on a customer's computer. I've used the default DAO Jet encryption and assigned a password to the database plus you need a password to open and run the program. But the customer backs up to a USB drive. If they lose the USB drive and somebody gets the MDB file, I hear it's not too hard to break that encryption. I know I could upgrade to an SQL database but short of that, is there anything I can do to improve security?

    Thanks for your help.

  2. #2
    Frenzied Member jdc2000's Avatar
    Join Date
    Oct 2001
    Location
    Idaho Falls, Idaho USA
    Posts
    1,472

    Re: Database Encryption

    A simple solution would be to make a backup copy of the .mdb file on the computer's hard drive, then encrypt that again with a stronger encryption program and copy that to the USB drive. With a stronger encryption program installed, this task could be automated so that the user just needs to double-click on a desktop icon with the USB drive attached to the computer for the encrypted backup file to be created and copied to the USB drive.

  3. #3
    Frenzied Member PlausiblyDamp's Avatar
    Join Date
    Dec 2016
    Location
    Newport, UK
    Posts
    1,108

    Re: Database Encryption

    You could use something like https://www.veracrypt.fr/en/Home.html to encrypt the USB

  4. #4

    Thread Starter
    Hyperactive Member
    Join Date
    Oct 2005
    Posts
    341

    Re: Database Encryption

    Both excellent suggestions. Just wondering if there was a more secure update or patch for the DAO/Jet/whatever format.

  5. #5
    Frenzied Member jdc2000's Avatar
    Join Date
    Oct 2001
    Location
    Idaho Falls, Idaho USA
    Posts
    1,472

    Re: Database Encryption

    An even simpler solution is to use something like an IronKey flash drive with built-in encryption. Yo can get some that will auto-erase after a few incorrect password entries so brute-forcing won't work on them.

    I think it is unlikely that the old encryption that you are using would have a newer more secure update.

  6. #6

    Thread Starter
    Hyperactive Member
    Join Date
    Oct 2005
    Posts
    341

    Re: Database Encryption

    I finally gave up and just had the customer install 7-Zip. First I popped up a screen with an animated GIF playing. Next I passed the password to 7Zip using a shell execute to a hidden window and a call to WaitForSingleObject. I created the ZIP on the customer's drive then made a copy to his external drive.

    Here's just a taste (not the full project obviously).

    Code:
       ' Given CompressMe$ is the path to the folder to compress
       '  See if 7-Zip is installed? 
    
       If Dir("C:\Program Files\7-Zip\7z.exe") = "" Then
          If Dir("C:\Program Files (x86)\7-Zip\7z.exe") = "" Then
             CompressData = False  ' 7Zip not installed
             A = MsgBox("7-Zip is not installed.  Open web browser and download it now?", vbYesNo)
             If A = vbYes Then
                WebPath$ = "https://www.7-zip.org"
                rc = ShellExecute(0&, vbNullString, WebPath$, vbNullString, vbNullString, vbMaximizedFocus)
                MsgBox "Run your backup again after installing 7-zip"
                exit function
             End If
          Else
             SevenZ$ = "C:\Program Files (x86)\7-Zip\7z.exe"
          End If
       Else
          SevenZ$ = "C:\Program Files\7-Zip\7z.exe"
       End If
       
    
       ' Make an archive called ArchiveName$ in the system temp directory
    
       TempDir$ = GetTempDir()
       
       ArchiveLocation$ = TempDir$ & ArchiveName$
       
       Cmd$ = Chr$(34) & SevenZ$ & Chr$(34) & " u " & Chr$(34) & ArchiveLocation$ & Chr$(34) & " -r -p" & Password$ & " " & Chr$(34) & CompressMe$ & Chr$(34)
    
       Call RunAndWait(Cmd$)   ' Compress the data and wait for it to finish
    
       ' Now we copy the file to the external drive...

  7. #7
    Frenzied Member wqweto's Avatar
    Join Date
    May 2011
    Posts
    1,581

    Re: Database Encryption

    I'm a little bit puzzled about the -r option you are passing to 7-zip. Do you recursively zip the whole directory or is CompressMe only a single file?

    Here is how to do the same w/ the help of ZipArchive class (full project of course, no extra DLLs/EXEs needed)

    thinBasic Code:
    1. Option Explicit
    2.  
    3. Private Sub Command1_Click()
    4.     Dim ArchiveLocation As String
    5.     Dim CompressMe      As String
    6.     Dim Password        As String
    7.    
    8.     ArchiveLocation = "d:\temp\aaa.zip"
    9.     CompressMe = "d:\temp\aaa.mdb"
    10.     Password = "secret"
    11.     With New cZipArchive
    12. '        .AddFromFolder CompressMe, Recursive:=True, Password:=Password
    13.         .AddFile CompressMe, Password:=Password
    14.         .CompressArchive ArchiveLocation
    15.     End With
    16. End Sub
    Just make sure to set ZIP_CRYPTO = 1 in projects Conditional Compilation (or the zip will be created w/o encryption)



    cheers,
    </wqw>

  8. #8

    Thread Starter
    Hyperactive Member
    Join Date
    Oct 2005
    Posts
    341

    Re: Database Encryption

    Hey! Thanks so much. I had never heard of ZipArchive. I'll check that out right away!

  9. #9

    Thread Starter
    Hyperactive Member
    Join Date
    Oct 2005
    Posts
    341

    Re: [RESOLVED] Database Encryption

    Hey wqweto ... thanks for the tips. I found the demo project in the archive. Very nice! Thanks for the help.
    Last edited by Darkbob; Apr 20th, 2019 at 11:05 AM.

  10. #10
    Hyperactive Member
    Join Date
    Sep 2010
    Location
    Italy
    Posts
    462

    Re: [RESOLVED] Database Encryption

    @wqweto
    I tried your zipArchive.
    For me it works very well but I found a problem that I think is good to point out. As it could damage files.
    Without encryption it seems to me to work perfectly.
    But be careful! Using encryption (password) the files I extracted are corrupted !!!
    I tried to zip a folder containing jpgs.
    (as mentioned before, without password, everything is ok)
    But with password and the ZIP_CRYPTO = 1, there are a lot of corrupted images in the unzipped files folder. (Jpg unreadable)

    I don't want to disturb you. sorry but I think this is a very serious problem that needs to be solved.

    Screenshot of extracted folder:
    Name:  screens.jpg
Views: 63
Size:  43.7 KB


    Code used:

    Code:
        ZIP.AddFromFolder SourcePath & "\*.*" , True, , , "pass"
    
        ZIP.CompressArchive App.Path & "\TEST.zip"
    
        ZIP.OpenArchive App.Path & "\TEST.zip"
        
        ZIP.Extract App.Path & "\Extracted", , "pass"

    (Win 7 - 32 bits)

  11. #11
    Frenzied Member wqweto's Avatar
    Join Date
    May 2011
    Posts
    1,581

    Re: [RESOLVED] Database Encryption

    Yes, there seems to be some troubles with traditional ZipCrypto (the CRC check is failing).

    Until I investigate it further you can pass EncrStrength:=1 parameter for the WinZip AES-128 encryption (or EncrStrength:=3 for AES-256) which seems to work on the sample folder you sent me.

    Thanks for the bug report!

    cheers,
    </wqw>

  12. #12
    Frenzied Member wqweto's Avatar
    Join Date
    May 2011
    Posts
    1,581

    Re: [RESOLVED] Database Encryption

    Here is what's going on: the way "traditional" ZipCrypto is implemented you cannot password protect a zip archive when the level of compression is 0 -- i.e. when storing files in the archive with no compression.

    In your case some JPGs cannot be compressed (the compressed size becomes bigger than the original file) so ZipArchive decides to store these files uncompressed *but*. . . still keeps the password protection which is illegal under the ZIP spec and produces (somewhat) invalid archives w/ entries that fail CRC check. ZipArchive make the effort to check CRC on extract but does not raise an error on failure (WAT?!:-)) so this explains the corrupted JPG files on extraction.

    I'll have to think it through what to do in this case: whether to raise an error, whether to silently remove the password (very bad) or to keep encrypted and compressed entry although bigger than original file (less worse but still suboptimal).

    My *overall* advice is to stay away from ZipCrypto w/ EncrStrength:=3 for AES-256 whenever possible (I'll make it the default in vNext). Using traditional ZipCrypto can be justified only on WinXP machines as CNG support is missing and AES encryption is not supported by ZipArchive there.

    cheers,
    </wqw>

  13. #13

    Thread Starter
    Hyperactive Member
    Join Date
    Oct 2005
    Posts
    341

    Re: [RESOLVED] Database Encryption

    Edit: Solved my first problem - you need to compile the program once to see the m_Ozip object. D'oh.

    But next problem...

    Without EncrStrength when I clicked on the zip file in Windows it would open. When I tried to drag a file out of the archive to a folder Windows would ask for my password then copy the file.

    I tried EncrStrength:=1 and also EncrStrength:=3 using this line:

    .AddFromFolder CompressMe, Recursive:=True, Password:=Password, EncrStrength:=1

    Now when I try and decrypt the file using Windows it fails.

    Name:  Pic.jpg
Views: 84
Size:  39.8 KB

    It does decrypt OK using 7-Zip. Is that how it's designed or am I doing something wrong?
    Last edited by Darkbob; Apr 20th, 2019 at 07:36 PM.

  14. #14
    Frenzied Member wqweto's Avatar
    Join Date
    May 2011
    Posts
    1,581

    Re: [RESOLVED] Database Encryption

    WinZip's AES encryption in not supported by the Windows built-in zip folder support, so that might be a show-stopper in your case.

    If you have to support Windows zip folder then the traditional ZipCrypto (EncrStrength:=0) is the only option for compatible password protected archives, although this level or protection is weak and long ago broken. Probably with some very long passwords could be still good enough. . .

    cheers,
    </wqw>

  15. #15
    Frenzied Member wqweto's Avatar
    Join Date
    May 2011
    Posts
    1,581

    Re: [RESOLVED] Database Encryption

    @reexre: The problem with corruption of password protected uncompressible files is fixed in commit f2ac4b0. ZipArchive now just drops the password protection in this case as not to produce illegal archives under ZIP 2.0 spec.

    cheers,
    </wqw>

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  



Featured


Click Here to Expand Forum to Full Width