• Ancient_Hacker (unregistered)

    Nooo!!! This is SUPER security!!! It's more secure than ROT-13 !!! It's SLIDE-15 !!!

  • (cs)

    That just looks like a bunch of gibberyjew

  • (cs) in reply to Ancient_Hacker
    Ancient_Hacker:
    Nooo!!! This is SUPER security!!! It's more secure than ROT-13 !!! It's SLIDE-15 !!!
    Agreed. FIFTEEN whole characters offsetting the true access information! I mean, I might try offsetting by one, two or even three characters to decode it, but fifteen!? Now *that's* secure!
  • Nathan (unregistered)

    Everyone knows the most important protection anyone can implement is against your coworkers. Forget script kiddies playing with a black box hoping for some response that hints at the inner workings. You should be worried about the people around you that can see the inner workings clear as day. If you don't need a self made notebook (preferably also written with a rotating cipher) to decipher your own code, your job isn't secure enough.

  • no images (unregistered)

    first!!!!!!!!!!!! well almost

  • Inhibeo (unregistered) in reply to Ancient_Hacker

    This method is highly secure. No self-respecting hacker is even going to waste his time trying bit-shifting algorithms.

    I call it "Security through stupidity." Genius.

  • ambshah (unregistered)

    obtuse obfuscation . i once had a colleague who suggested disguising an mdb file as a dll and placing it in the system folder....

  • (cs)

    Can somebody who's had their morning coffee (or just has VB running) please post the decoded version of the string, for curiosity's sake? I tried re-implementing it in Javascript, but I'm still getting garbage. Does VB use some magic non-unicode character set or something, or am I just having a serious case of the mondays?

  • A. Nonny Moos (unregistered) in reply to snoofle
    snoofle:
    I might try offsetting by one, two or even three characters to decode it, but fifteen!? Now *that's* secure!

    Secure? That's nothing. At my place of work, we go the added mile. First we offset by 37 characters, note that it's a prime offset. Then we do a reverse offset of 61 characters, again a prime offset. Finally, to mislead the potential hackers and confuse them even further, we do a third offset of 24 characters - a non-prime offset this time. This has them pounding their heads against their keyboards.

  • ENOINVAL (unregistered) in reply to vt_mruhlin

    I'm also curious to see other people's results; I'm pretty confident that this is close, but not quite right. I think it's been encrypted doubly using an encoding like "not English".

    Pv�o��idev�=SQLOLEDB.1;Pax�x���ov�d=WEB456;Pev�x�ix�z� Sec��v�iz��� Info=Tv���e;Ux�ev� ID=WEBREPORTS;Iniz�ial Caz�alog=FACTURATION_XEROX;Daz�a So��v�ce=lookx�u�lm;Ux�e Pv�oced��v�e fov� Pv�epav�e=1;A��z�o Tv�anx�laz�e=Tv���e;Packez� Si��e=4096;Wov�kx�z�az�ion ID=WDLK107

    Code:

    # encoding: utf8
    myStr = 'F?@Z[SfLSX/}~xÉpÉÇzÅ~fJEH?CLtâxb/' \
       + 'Étzrp_JtÑÅcLtÉp{Ç}pÅc/~ÉÑPJ@LtÅptÅ_/Å~u/tÅÑstr~Å_/tÇdJ|{ÄÇz~~{' \
       + 'LtrÅÑ~b/pÉpSJg^aTgn]^XcPadcRPULv~{pÉpR/{pxÉx}XJbca^_TaQTfLSX/ÅtÇ' \
       + 'dJtÑÅcL~u}X/àÉxÅÑrtb/ÉÇxÇÅt_JEDCQTfLsÅ~ÜÇÇp_J@=QST[^[`bLÅtsxÖ~Å_'
    
    def decode(s):
        newS = []
        for c in s:
            newS.append(chr(ord(c)-15))
        newS.reverse()
        return ''.join(newS)
    
    print decode(myStr)
    
  • blah (unregistered)

    More like job security.

  • Dmitri (unregistered) in reply to vt_mruhlin
    vt_mruhlin:
    Can somebody who's had their morning coffee (or just has VB running) please post the decoded version of the string, for curiosity's sake? I tried re-implementing it in Javascript, but I'm still getting garbage. Does VB use some magic non-unicode character set or something, or am I just having a serious case of the mondays?
    Code snippet is in Delphi, character set is ANSI ;).
  • Anonymouse (unregistered) in reply to A. Nonny Moos
    A. Nonny Moos:
    This has them pounding their heads against their keyboards.

    Ah, the dreaded ROT-0 encryption.

  • Anonymous Coward (unregistered)

    Bonus, you can use the same function to encode it. Only needing to run the same string through it 3840 times to do so.

    Captcha: mara (jade?)

  • (cs) in reply to vt_mruhlin
    vt_mruhlin:
    Can somebody who's had their morning coffee (or just has VB running) please post the decoded version of the string, for curiosity's sake? I tried re-implementing it in Javascript, but I'm still getting garbage. Does VB use some magic non-unicode character set or something, or am I just having a serious case of the mondays?

    The original code is not VB, but I "decoded" it with VB and get part gibberish, part connection string. I think it was fux0red by a copy/paste operation.

    P¶oÇide¶=SQLOLEDB.1;Pa¸¸Ío¶d=WEB456;Pe¶¸i¸º Sec¶iºÑ Info=T¶Âe;U¸e¶ ID=WEBREPORTS;Iniºial Caºalog=FACTURATION_XEROX;Daºa So¶ce=look¸µlm;U¸e P¶oced¶e fo¶ P¶epa¶e=1;Aºo T¶an¸laºe=T¶Âe;Packeº SiÓe=4096;Wo¶k¸ºaºion ID=WDLK107

    Addendum (2009-04-13 09:42): Provider=SQLOLEDB.1;Password=WEB456;Persist Security Info=True;User ID=WEBREPORTS;Initial Catalog=FACTURATION_XEROX;Data Source=looksµlm;Use Procedure for Prepare=1;Auto Translate=True;Packet Size=4096;Workstation ID=WDLK107

    Couldn't figure out the data source.

  • (cs)

    Sixteenth! ;-)

    Also, re it being Delphi, no wonder it reminded me of Pascal, from way back in kollij. Delphi is basically, er, I mean, essentially, Visual Pascal.

  • asdfvawevawef (unregistered) in reply to Anonymous Coward
    Anonymous Coward:
    Captcha: mara (jade?)

    Oh my god, I had all but forgotten those books. I should re-read them, see if they're still as good as they were in high school.

  • (cs)

    Oh, I didn't realize it was also reversed. That's some good encryption. Strings like SQLOLEDB are a pretty good indicator that you got it right and the rest is some other language or messed up. BDELOLQS not so much.

  • GetOff MyLawn (unregistered)

    Dear college kid, welcome to the real world.

    Where stupid people get hired and promoted, where stupid code lives on forever, where stupid managers and customers pay mounds of shining gold for steaming piles of dung because they can't tell junk from jet engines, where 90% of lusers need anti-virus because they have to be logged in as administrator while they're reading their SPAM.

  • (cs) in reply to GetOff MyLawn
    GetOff MyLawn:
    Dear college kid, welcome to the real world.

    Where stupid people get hired and promoted, where stupid code lives on forever, where stupid managers and customers pay mounds of shining gold for steaming piles of dung because they can't tell junk from jet engines, where 90% of lusers need anti-virus because they have to be logged in as administrator while they're reading their SPAM.

    I'm just glad you're not bitter.

  • Juan (unregistered) in reply to Anon Ymous
    Anon Ymous:
    vt_mruhlin:
    Can somebody who's had their morning coffee (or just has VB running) please post the decoded version of the string, for curiosity's sake? I tried re-implementing it in Javascript, but I'm still getting garbage. Does VB use some magic non-unicode character set or something, or am I just having a serious case of the mondays?

    The original code is not VB, but I "decoded" it with VB and get part gibberish, part connection string. I think it was fux0red by a copy/paste operation.

    P¶oÇide¶=SQLOLEDB.1;Pa¸¸Ío¶d=WEB456;Pe¶¸i¸º Sec¶iºÑ Info=T¶Âe;U¸e¶ ID=WEBREPORTS;Iniºial Caºalog=FACTURATION_XEROX;Daºa So¶ce=look¸µlm;U¸e P¶oced¶e fo¶ P¶epa¶e=1;Aºo T¶an¸laºe=T¶Âe;Packeº SiÓe=4096;Wo¶k¸ºaºion ID=WDLK107

    Addendum (2009-04-13 09:42): Provider=SQLOLEDB.1;Password=WEB456;Persist Security Info=True;User ID=WEBREPORTS;Initial Catalog=FACTURATION_XEROX;Data Source=looksµlm;Use Procedure for Prepare=1;Auto Translate=True;Packet Size=4096;Workstation ID=WDLK107

    Couldn't figure out the data source.

    Ahhh!!! A great job for the programmer. The data it's safe!!

  • Patrick (unregistered)

    I can just imagine the main function of the app now....

    Buyit(); useit(); breakit(); fixit(); Trashit(); changeit(); mail_upgradeit(); Chargeit(); pointit(); zoomit(); pressit(); Snapit(); workit(); quick_eraseit(); Writeit(); cutit(); pasteit(); saveit(); Loadit(); checkit(); quick_rewriteit(); Plugit(); playit(); burnit(); ripit(); Draganddropit(); zip_unzipit(); Lockit(); fillit(); callit(); findit(); Viewit(); codeit(); jam_unlockit(); Surfit(); scrollit(); pauseit(); clickit(); Crossit(); crackit(); switch_updateit(); Nameit(); rateit(); tuneit(); printit(); Scanit(); sendit(); fax_renameit(); Touchit(); bringit(); Payit(); watchit, Turnit(); leaveit(); start_formatit();

  • (cs) in reply to Anonymous Coward
    Anonymous Coward:
    Bonus, you can use the same function to encode it. Only needing to run the same string through it 3840 times to do so.

    Captcha: mara (jade?)

    Oh Dear Lord. Don't give people ideas. Some folks read these forums to LEARN stuff!

  • Sa (unregistered)

    I'm starting to think that the code is not a WTF after all. The intent seems to have been to hide the connection string from casual view. And that seems to have worked.

    Both the encrypted string and the decryption algorithm have been visible on the WTF site for about an hour now. A whole bunch of people have tried to decrypt it. A few have come close. None have completely succeeded.

    Looks to me like the original author succeeded in his intent quite nicely. Hmmmmmm....

  • FromCanada (unregistered)

    comment = first + 24

  • (cs) in reply to Sa
    Sa:
    I'm starting to think that the code is not a WTF after all. The intent seems to have been to hide the connection string from casual view. And that seems to have worked.

    Both the encrypted string and the decryption algorithm have been visible on the WTF site for about an hour now. A whole bunch of people have tried to decrypt it. A few have come close. None have completely succeeded.

    Looks to me like the original author succeeded in his intent quite nicely. Hmmmmmm....

    The data source is "looksqlm":

    Provider=SQLOLEDB.1;Password=WEB456;Persist Security Info=True;User ID=WEBREPORTS;Initial Catalog=FACTURATION_XEROX;Data Source=looksqlm;Use Procedure for Prepare=1;Auto Translate=True;Packet Size=4096;Workstation ID=WDLK107

  • mmmmmm...Cake. (unregistered) in reply to Patrick
    Patrick:
    I can just imagine the main function of the app now....

    Buyit(); useit(); breakit(); fixit(); Trashit(); changeit(); mail_upgradeit(); Chargeit(); pointit(); zoomit(); pressit(); Snapit(); workit(); quick_eraseit(); Writeit(); cutit(); pasteit(); saveit(); Loadit(); checkit(); quick_rewriteit(); Plugit(); playit(); burnit(); ripit(); Draganddropit(); zip_unzipit(); Lockit(); fillit(); callit(); findit(); Viewit(); codeit(); jam_unlockit(); Surfit(); scrollit(); pauseit(); clickit(); Crossit(); crackit(); switch_updateit(); Nameit(); rateit(); tuneit(); printit(); Scanit(); sendit(); fax_renameit(); Touchit(); bringit(); Payit(); watchit, Turnit(); leaveit(); start_formatit();

    whipit();

  • (cs) in reply to GetOff MyLawn
    where 90% of lusers need anti-virus because they have to be logged in as administrator while they're reading their SPAM.

    Have you tried running Windows XP as a non-administrator? It gets to be kind of a pain. Vista is noticeably better in that regard, but still has a ways to go before it's as nice in that regard as Linux.

  • RBoy (unregistered) in reply to Patrick
    Patrick:
    I can just imagine the main function of the app now....

    Buyit(); useit(); ...

    I Lol'd

  • Yorknoken (unregistered) in reply to Sa

    Or Alex changed the string to protect the identity of the actual company that originated this code.

    P.S. Digging the Daft Punk reference.

  • mstum (unregistered)

    I can only imagine the other functions:

    WorkIt() MakeIt() DoIt() MakesUs() Harder() Better() Faster() Stronger()

  • mstum (unregistered) in reply to mstum

    Ah Crap, someone was faster making a Daft Punk reference :D

  • Bennett (unregistered)

    Reminds me of that Daft Punk Song

    Buy it, use it, break it, fix it, Trash it, change it, mail, upgrade it, Charge it, point it, zoom it, press it, Snap it, work it, quick erase it, Write it, cut it, paste it, save it, Load it, check it, quick rewrite it

    hahaha

  • Bennett (unregistered) in reply to Bennett

    Sigh, it seems I'm too slow too :P

  • (cs) in reply to Patrick
    Patrick:
    I can just imagine the main function of the app now....

    Buyit(); useit(); breakit(); fixit(); Trashit(); changeit(); start_formatit();

    We have a winner! Please collect your prize!

  • Prosthetic Lips (unregistered) in reply to Yorknoken
    Yorknoken:
    Or Alex changed the string to protect the identity of the actual company that originated this code.

    P.S. Digging the Daft Punk reference.

    No, it is just some copy-and-paste problem with the extended ASCII codes. I have one character I am not sure of, in the "Data Source=" part. I used "q" for the weird character, but others might know the correct code reference.

    Provider=SQLOLEDB.1;Password=******;Persist Security Info=True;User ID=WEBREPORTS;Initial Catalog=FACTURATION_XEROX;Data Source=looksqlm;Use Procedure for Prepare=1;Auto Translate=True;Packet Size=4096;Workstation ID=WDLK107

    Yes, I replaced the password with stars, although you can probably figure it out from the other posts here.

  • ih8u (unregistered) in reply to mmmmmm...Cake.
    mmmmmm...Cake.:
    Patrick:
    I can just imagine the main function of the app now....

    Buyit(); useit(); breakit();

    • snip * leaveit(); start_formatit();

    whipit();

    This comment generated as a result of the invocation of method postit()

  • (cs) in reply to A. Nonny Moos
    A. Nonny Moos:
    snoofle:
    I might try offsetting by one, two or even three characters to decode it, but fifteen!? Now *that's* secure!

    Secure? That's nothing. At my place of work, we go the added mile. First we offset by 37 characters, note that it's a prime offset. Then we do a reverse offset of 61 characters, again a prime offset. Finally, to mislead the potential hackers and confuse them even further, we do a third offset of 24 characters - a non-prime offset this time. This has them pounding their heads against their keyboards.

    Well, at least part of that is a good idea.

    In the spirit of the original developer, I think a more radical solution is to return to the very earliest days of ciphers:

    (1) Write security string on wooden table in purple crayon. (2) Acquire slave (available on most downtown corners these days). (3) Shave head of slave. (4) Bang slave's head repeatedly on wooden table. (5) Wait for hair to grow back. (6) Send slave to remote server, which has its own wooden table. (7) Shave head of slave. (8) Bang slave's head repeatedly on wooden table. (9) Et voila! Security Through Alopecia!

    Ideally, the slave should not be bald and not have some strange scalp disease that causes the Public Health Authorities to shave his head at some intermediate point.

    Of course, I'll admit that performance may suffer somewhat. But that's the price you pay for real security.

  • BBT (unregistered) in reply to mmmmmm...Cake.
    whipit();

    Whipit(GOOD);

  • Bernie (unregistered)

    biteit() before it bites me!

  • silent d (unregistered) in reply to BBT
    BBT:
    whipit();

    Whipit(GOOD);

    Function call whipit() should only be invoked on an error condition (i.e., when a problem comes along )

  • (cs)

    Actually, after being encoded with SHIFT-15, the bytes were interpreted as MacRoman (instead of ISO-8859-1), then encoded with HTML-entities, then finally UTF-8 (as presented on TDWTF webpage).

    So, decoding the encoded text as MacRoman yields

    Provider=SQLOLEDB.1;Password=WEB456;Persist Security Info=True;User ID=WEBREPORTS;Initial Catalog=FACTURATION_XEROX;Data Source=looksqlm;Use Procedure for Prepare=1;Auto Translate=True;Packet Size=4096;Workstation ID=WDLK107

    No need for guessing.

  • (cs) in reply to Ancient_Hacker
    Ancient_Hacker:
    Nooo!!! This is SUPER security!!! It's more secure than ROT-13 !!! It's SLIDE-15 !!!
    Not just SLIDE-15, but SLIDE-15 AND REVERSE! Super secure!

    Also, I think the code (it's Delphi) would compile fine in Free Pascal (free/open-source)

  • Dazed (unregistered) in reply to Sa
    Sa:
    I'm starting to think that the code is not a WTF after all. The intent seems to have been to hide the connection string from casual view. And that seems to have worked.
    Yes, I'll go along with that. Though one might have thought that obscuring the password would have been sufficient.
  • (cs) in reply to WayneCollins
    WayneCollins:
    where 90% of lusers need anti-virus because they have to be logged in as administrator while they're reading their SPAM.

    Have you tried running Windows XP as a non-administrator? It gets to be kind of a pain. Vista is noticeably better in that regard, but still has a ways to go before it's as nice in that regard as Linux.

    I've been running as a Limited User since Windows 2000 days. No problems whatsoever. Of course, some piece of crap (like ICQ) would refuse to work, but that's just a reason not to use ICQ.

  • (cs) in reply to Patrick
    Patrick:
    I can just imagine the main function of the app now....

    Buyit(); useit(); breakit(); fixit(); Trashit(); changeit(); mail_upgradeit(); Chargeit(); pointit(); zoomit(); pressit(); Snapit(); workit(); quick_eraseit(); Writeit(); cutit(); pasteit(); saveit(); Loadit(); checkit(); quick_rewriteit(); Plugit(); playit(); burnit(); ripit(); Draganddropit(); zip_unzipit(); Lockit(); fillit(); callit(); findit(); Viewit(); codeit(); jam_unlockit(); Surfit(); scrollit(); pauseit(); clickit(); Crossit(); crackit(); switch_updateit(); Nameit(); rateit(); tuneit(); printit(); Scanit(); sendit(); fax_renameit(); Touchit(); bringit(); Payit(); watchit, Turnit(); leaveit(); start_formatit();

    Teknologic

    Teknologic

  • Edward Royce (unregistered)

    Hmmm.

    Ok. So what precisely is the point of this? To keep someone from scanning for connection strings in a EXE file?

  • (cs) in reply to zokar
    zokar:
    Actually, after being encoded with SHIFT-15, the bytes were interpreted as MacRoman (instead of ISO-8859-1), then encoded with HTML-entities, then finally UTF-8 (as presented on TDWTF webpage).

    So, decoding the encoded text as MacRoman yields

    Provider=SQLOLEDB.1;Password=WEB456;Persist Security Info=True;User ID=WEBREPORTS;Initial Catalog=FACTURATION_XEROX;Data Source=looksqlm;Use Procedure for Prepare=1;Auto Translate=True;Packet Size=4096;Workstation ID=WDLK107

    No need for guessing.

    Only I posted the complete connection string an hour earlier.

  • iusto (unregistered) in reply to no images
    no images:
    first!!!!!!!!!!!! well almost
    If you were fifteenth, that would be funny
  • Eureka (unregistered)

    Idhitit();

Leave a comment on “That Kind of Security”

Log In or post as a guest

Replying to comment #:

« Return to Article