_StringEncrypt [Someone hacked it]

[eHrgo]

Hi all,

Few hours ago, I fucked up, I have a little software (http://rsgetpoints.pureweb.fr) which as a functionality to remind password/username of a website [rapidshare]. Ok, I fucked up, I uploaded the Ini file which contain those 2 informations, those are encrypted with:

_StringEncrypt(1, $pass, 'WhateverKey')

So my ini only contains encrypted password.

Furthermore, those are displayed in an input, the password is hidden with dots.

Few hours after i uploaded it, someone deleted my account, I figured out I uploaded my INi.

How did he do that? Is there any way to read under dots/star in input fields? Is there any way to decrypt the password without the Encrypt key?

Thanks a lot.

Edited April 10, 2007 by eHrgo

[jvanegmond]

Hi all,

Few hours ago, I fucked up, I have a little software (http://rsgetpoints.pureweb.fr) which as a functionality to remind password/username of a website [rapidshare]. Ok, I fucked up, I uploaded the Ini file which contain those 2 informations, those are encrypted with:

_FileEncrypt(1, $pass, 'WhateverKey')

So my ini only contains encrypted password.

Furthermore, those are displayed in an input, the password is hidden with dots.

Few hours after i uploaded it, someone deleted my account, I figured out I uploaded my INi.

How did he do that? Is there any way to read under dots/star in input fields? Is there any way to decrypt the password without the Encrypt key?

Thanks a lot.

There is no '_FileEncrypt' in the standard library's of AutoIt..

[Xenobiologist]

Hi,

did you upload your exe, too?

So long,

Mega

[eHrgo]

_stringEncrypt My bad.

[eHrgo]

Yes, He had my exe, but not the source.

He had too the GuiCtrlCreateInput with $ES_PASSWORD [*]. He saw that :

And he had the encrypted password.

I think there is a way to see behind asterisk

[Xenobiologist]

What if he hacked the exe?

So long,

Mega

[eHrgo]

Can he get the source by hacking an exe?

[Xenobiologist]

Can he get the source by hacking an exe?

Hi,

yes that what is meant by hacking.

So long,

Mega

[eHrgo]

Is this guy a pro or is it easy to find a way to do this? Because 4 person downloaded it, and it has been down in 3 hours.

[Xenobiologist]

Hi,

it is very easy. Only 2 min work.

Edit: Try it yourself with google...

So long,

Mega

Edited April 10, 2007 by th.meger

[eHrgo]

Found... thats sucks, I've been owned.

Edit This shit is working great... And so easy.

Thanks for your help

Edited April 10, 2007 by eHrgo

[jvanegmond]

Found... thats sucks, I've been owned.

Edit This shit is working great... And so easy.

Thanks for your help

Try JdeB's new obfuscator.. He'll never figure it out again.

[Xenobiologist]

Try JdeB's new obfuscator.. He'll never figure it out again.

Hi,

next time he will be

So long,

Mega

[jvanegmond]

Hi,

next time he will be

So long,

Mega

Yeah, obfuscation does not make it unhackable..

[Jos]

Yeah, obfuscation does not make it unhackable..

This is soooo true ..... it only makes it difficult to read but the information is exactly the same....

[Xenobiologist]

Yeah, obfuscation does not make it unhackable..

Hi,

my comment wasn't refering to your previous post. I only meant that next time he will be attentive and smart enough to not giving away the exe that easily with such information in it.

So long,

Mega