This page is intended to illustrate weaknesses of the cryptographic protection built into some popular DOS and Windows applications.

We'll do this by looking at a few of the "cracker software" utilities readily available from several sources; some of the links below will allow you to retrieve this software from the same sources we did. All of the sources we've identified to date are summarized in the Cracker Software Directory below. Our intent is not to low-rate anyone's product... the information provided here should:

a.give you a few datapoints on cryptographic strength, b.help you assess how much cryptographic strength you need for your data, and c.help you avoid some common mistakes in your own implementations.

Finally, if you're developing applications for Windows which demand strong cryptography, we hope you'll consider using our tools: DEScipher, and HASHcipher

Recent Additions (9/21/96):

The Novell Netware Hack FAQ exposes the dangers of entrusting your secrets to Novell's security system; available as a downloadable file, a web page, and occasionally posted to comp.security.misc

AccessData has added some "freebies" to their website, including a Quicken® cracker that they'll mail to you.

Word Processor Crackers:

The crackers in this section were designed to break the password protection/encryption built into popular word processor applications. The two we tested worked without a hitch, returning the correct password value in every case in less than one second. You may be taking significant risks if you are depending on the cryptography in these applications to protect data with any sensitivity or value.

WPCRACK vs. WordPerfect 5.1- One of the first cracker software packages to receive wide distribution was WPCRACK, developed by Ron Dippold to extract the password from a protected WordPerfect(tm) file. Judging by the readme.txt file in the WPCRACK distribution, it was widely disseminated over the Internet beginning late in 1992. WPCRACK makes short work of WP 5.1 files; in the documentation Mr. Dippold discusses the design flaw that allowed him to avoid a more lengthy brute force approach to recover the password. If you're a developer who'd like to avoid making the same errors, you can read the WPCRACK documentation here. You can get the WPCRACK distribution here. If you want to test WPCRACK, but don't have WordPerfect 5.1 you can get our WP5.1 password protected file (craktest.zip) here. The WPCRACK distribution includes an additional utility (WPUNCRYP) which will decrypt the WP5.1 file to a text file when supplied with the password found by WPCRACK. This avoids the necessity of even having a copy of WordPerfect to view the cracked files (this guy thought of everything)! The distribution comes with C source code only...you'll have to compile it to try WPCRACK for yourself.

Word Unprotect (WU) vs. Word 2.0- Sometime later the Word Unprotect program WU appeared. WU was developed by Marc Thibault to decrypt protected Microsoft Word v.1 and v.2 documents. We did not test WU (didn't have an old copy of MS Word). According to the WU documentation it creates a decrypted version of the file rather than produce the password as WPCRACK does. Mr. Thibault's comments (see the WU documentation link above) regarding the strength of the Word encryption algorithm are similar to those for WPCRACK. You can get the WU distribution here. The distribution includes C++ source code, and executables for DOS and Windows.

WFWCD vs. Word for Windows 6.0- The Word for Windows Cracker Demo (WFWCD) appeared fairly recently. WFWCD was developed by Fauzan Mirza to extract passwords from MS Word for Windows v 6.0 documents. According to the WFWCD documentation, the changes made to boost the security from the previous version of Word were ineffective. Like WPCRACK, WFWCD makes short work of extracting passwords. Run from the DOS command line, the WFWCD produces a short decrypted text sequence from the protected file, followed by the password value. You can get the WFWCD R8 distribution here. If you'd like to see WFWCD in action, but don't have MS Word 6.0, you can get our MS Word 6.0 password protected file (craktest.zip). The distribution comes with a DOS executable only (no source), and the documentation is more austere than that in WPCRACK and WU. Full file decryption requires a copy of Word 6.0...using the password determined from WFWCD.

Spreadsheet Crackers

excrak.zip UNTESTED

PKZIP Crackers:

Word processors are not the only applications genre to attract cryptanalysts... PKZIP's password protection has been a target for some time. Following is a list of three PKZIP crackers we found. Cracking PKZIP files is not trivial as it is with the word processor crackers. All the PKZIP cracker software found in our brief search employed a brute force/trial-and-error approach: repeatedly guessing password values until the correct one is found. This means that cracking zip files with long, obscure passwords will probably (but not necessarily) take longer than cracking files with short passwords. This is a good point to remember if you are depending on PKZIP's encryption to secure your data. While not trivial to crack, at least one of these tools probably poses a real threat to PKZIP security.

ZIPCRACK- The earliest example of PKZIP cracker software we found was ZIPCRACK v2.0, developed by Paul Kocher while he was a sophomore at Stanford University (circa 1992) to crack PKZIP v 1.1 protected files. ZIPCRACK does its work in a fundamentally different way than the word processor crackers above; it utilizes a dictionary attack. This is a brute force/trial-and-error technique that involves guessing passwords until the correct one is found. You can get the ZIPCRACK 2.0 distribution here. Note however that this distribution is crippled (only searches for passwords beginning with the letter "z"), has no source code, and only works against an antique version of PKZIP. We've included it here because the zipcrack.doc file in this distribution contains some useful information, including some of Mr. Kocher's views of PKZIP's approach to cryptography. Our brief search of the usual sites did not turn up any upgrades to ZIPCRACK, but we did locate a paper Mr. Kocher published with Eli Biham subsequent to (circa 1994) his release of ZIPCRACK. This paper detailed a known-plaintext attack on PKZIP 2.04 which "won" the cipher contest sponsored by PKWare. This is more powerful than the dictionary attack utilized in the other crackers reviewed here. Their paper reports that the software developed to crack the contest file produced the answer "within a few hours on a personal computer". You can get a copy of the Biham and Kocher paper titled "A Known Plaintext Attack on the PKZIP Stream Cipher" here (incl. PostScript and text versions). We have recently turned up a C implementation of the software described in this paper developed by Peter Conrad.

EPILOGUE: Mr. Kocher has just recently won further acclaim for himself (including an article in the New York Times!?) by finding a "timing attack" which could be used against many of the public key cryptosystems. You can get further details by visiting Paul Kocher's website.

PKCRACK- We have almost no information on the PKZIP password cracker known only as PKCRACK. Judging from the files in the distribution PKCRACK is 1993 vintage, but nothing was found to identify the author. Documentation is scarce... PKCRACK apparently employs a dictionary attack like ZIPCRACK. However, it is not crippled as ZIPCRACK is, the distribution includes source code, and it works on the latest version of PKZIP (2.04). Operation is straightforward; it tries all passwords contained in the file pkcrack.dat against the .zip file specified in the DOS command line. You can get the PKCRACK distribution here. It comes with an example .zip archive to illustrate its operation. The dictionary password must be an exact match with the one used to encrypt the zip'd files; missing even the case of a single letter in the password causes PKCRACK to come up empty-handed.

FZC The Fast ZIP Cracker (FZC) was developed by Fernando Papa Budzyn of Montevideo, Uruguay. The latest version, FZC 1.04, was released o/a September 3, 1995. You can get the FZC 1.04 distribution here. FZC is the most sophisticated of the PKZIP crackers we found. While similar in concept to PKCRACK and ZIPCRACK, FZC augments its dictionary attack with several features that enhance its ability to successfully complete its attack. Most of the documentation on FZC is "online" in the .exe file. While stand-alone documentation is sparse, it lists a pair of ftp sites from which you can replenish your password dictionary.

Cracking (Hacking) Contest

Seems that someone at Microsoft made some statements regarding Netscape's security problems that sounded like "the pot calling the kettle black". Consequently the people at Community Connexion have decided to show us just how black! Results are posted at the Hack Microsoft Contest page.

Commercial Crackers: Has Cracker Software Become an Industry?

Apparently so...We are now aware of two companies who develop and market software designed to recover information protected with "built-in" encryption software.

John Kuslich and the folks at CRAK Software are selling software crackers for many of the popular Windows applications, most of it for $99. They have demo (crippled) versions of at least some of their products. But hey, I'm stealing their thunder...you can go visit CRAK's web site from here. AccessData Corp. also markets an extensive line of utilities to recover passwords from a wide variety of Windows applications. Prices and demo versions are available from AccessData's website.