Security Basics mailing list archives

RE: password protection in office XP documents


From: "Chris Berry" <compjma () hotmail com>
Date: Mon, 16 Jun 2003 18:40:57 -0700

From: "matt willson" <mwillson () sbcglobal net>
Common known flaw with microsoft, and their program recognizing by file
extension method, is that if you rename a file (by right clicking the
file and hititng rename)blah.doc into blah.html then choosing the
program to open it up with, you have got a bypass.

Thats true, and you could do the same thing by right clicking and selecting open with, however it's also completely false. When an office document is password protected, it's encrypted to prevent exactly that kind of snooping. I have no idea how good the encryption is (they say 40-bit RC4 which doesn't sound that great), but it's definitely not plain text.

Chris Berry
compjma () hotmail com
Systems Administrator
JM Associates

"Within every man beats a heart of darkness." --The Shadow

_________________________________________________________________
The new MSN 8: smart spam protection and 2 months FREE* http://join.msn.com/?page=features/junkmail


---------------------------------------------------------------------------
Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts!
The Gartner Group just put Neoteris in the top of its Magic Quadrant,
while InStat has confirmed Neoteris as the leader in marketshare.
Find out why, and see how you can get plug-n-play secure remote access in
about an hour, with no client, server changes, or ongoing maintenance.
Visit us at: http://www.neoteris.com/promos/sf-6-9.htm
----------------------------------------------------------------------------


Current thread: