Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I used this command to password protect a zip file on Linux :

zip -P 9000 hash.zip hash.py

and it creates the zip file just fine, then I wrote a program to test every possible password on it from 1 to 100000, the problem is that program find two password on it, first is: 9000 and the second is: 79095 , and both password unzip the file, is the any security vulnerability in Linux zip command?

share|improve this question
    
How did you write a program that checks the passwords? –  Thomas Mar 24 '13 at 0:00
    
Program is in this link .baltar.blog.com/2013/03/23/… nothing too complecated. –  user13934 Mar 24 '13 at 6:37
add comment

2 Answers

up vote 8 down vote accepted

Both passwords may decrypt the file, but only one password will yield the correct plaintext. The zip encryption format is just checking to see if the padding is correct to verify that the correct key was used. The password 79095 produced valid padding, however the resulting message is garbage.

share|improve this answer
    
yes , second password return rubbish , and it said : bad CRC 61349fb8 (should be 29a0c89d) –  user13934 Mar 23 '13 at 7:21
add comment

See http://en.wikipedia.org/wiki/Zip_(file_format)#Encryption.

It is worth mentioning that the issue is with the encryption standards of the zip format, not with the zip command.

Also, the man page of zip notes this issue.

    -P password
       --password password
              Use  password  to  encrypt zipfile entries (if any).  THIS IS
              INSECURE!  Many multi-user operating systems provide ways for
              any  user  to see the current command line of any other user;
              even on stand-alone systems there is  always  the  threat  of
              over-the-shoulder peeking.  Storing the plaintext password as
              part of a command line in an automated script is even  worse.
              Whenever possible, use the non-echoing, interactive prompt to
              enter passwords.  (And where security is truly important, use
              strong  encryption such as Pretty Good Privacy instead of the
              relatively weak standard encryption provided by zipfile util‐
              ities.)

For more comprehensive documentation on this issue, take a look at this paper (written by a professor at my University :) ) https://homes.cs.washington.edu/~yoshi/papers/WinZip/winzip.pdf

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.