The magazine of the Melbourne PC User Group Advanced Office XP Password Recovery 2.0 Ash Nallawalla ash@melbpc.org.au |
 |
From time to time, Microsoft Office users protect their documents with a password and then they forget it.
What can you do in such a situation?
* In AOXPPR Professional version only
In Use
I then took an Excel worksheet that was protected with a password that hid its formulas but you could use
it to enter data. AOXPPR cracked it in about one second. I didn't believe it and thought it was a fluke.
I tried another password and again, it was cracked almost immediately. The suggested password was nothing
like the original, and yet it worked. What was going on?
I wrote to the owner of Elcomsoft, Dmitry Harchenko and posed some questions.
For example, if you check for digits only, and the length is 7, the total will be:
On the other hand, you can resume password discovery if you need to shut down the computer for some time.
That is useful if you have plenty of time and absolutely need to get the password.
Advanced Office XP Password Recovery (AOXPPR) 2.0 by Elcomsoft is designed for recovering the lost
passwords for documents/files created with the following applications:
The program is compatible with all international (non-English) versions of MS Office. Most passwords are
being recovered (or removed) instantly. However, the "password to open" in Office 97/2000
is encrypted with a very strong algorithm and requires time-consuming brute-force or dictionary attacks to
be performed; the success/recovery rate is about 80-85 percent but, if the password is long (8+ characters)
and complex, it cannot be recovered at all in a reasonable time. Microsoft Office XP files protected using
CSP (Cryptographic Service Provider) are also supported.
Program Requirements
The program works as intended! Its only job is to discover the password, so it is a matter of selecting
the options and letting it rip. I tested only two types of documents: Microsoft Word 2002/XP and Microsoft
Excel 2002/XP.
The Word documents were protected with a password. One was eight characters long and included uppercase
letters, lowercase letters and numbers. I let the program run for about four days while I did other things
on the PC or went off to work. After four days, it looked like the program could take many more days to
do its job and I gave up. I then tried an 8-letter, lowercase-only password and it was cracked within a
day or so.
Figure 1. My password, which was similar to 8Zb1/?op,
would have taken about 866 years to be cracked on
my machine, which can process 213222 passwords
per second.
AN: Why is the Excel worksheet protection password cracked so quickly with a substitute
password?
DH: That's because of the nature of encryption algorithm used there. The password itself is not
stored at all; Excel calculates some 16-bit (2 byte) hash value from it, like CRC-16. When you enter
the password in Excel, it calculates the hash using the same algorithm, and compares it with the stored
one; if they match, the password considered to be valid. The total number of possibilities, however,
is 2^16 (or 65,536), and so there are a lot of passwords that have the same hash, and so from Excel's
point of view, they're the same ;) What AOXPPR does is: it simply creates the "easiest" password that
has the hash needed.
AN: Do you have some figures for the time taken to recover a password of x characters, depending
on whether it uses only lowercase, alphanumeric, non-alphanumeric etc characters?
DH: (As I understand, you're talking about "open" password for Word/Excel 97/2000/XP only, because
all other ones are being recovered instantly; only this "open" password uses strong encryption)
Unfortunately, no, but you can prepare them yourself very easy. To get the total number of passwords, use
the following formula):
n^ password_length
where n = number of characters in the set
10^7 = 10,000,000
If you check for small and capital letters, and the maximum length is 5, the total is:
(26 + 26)^5 = 380,204,032
The speed of brute-force engine is available using the "Benchmark" feature in the program. Eg. on my
machine (PIII-450), it is shown as approximately 100,000 passwords per second. So to get the maximum
time needed to recover the password in the given range, simply divide the total number of passwords by
the attack speed; for 5-character passwords mentioned above it will be:
380,204,032/100,000 = ~3802 seconds (or just about an hour)
[End of quote]
So, if you have a fast machine and a lot of time, you can crack nearly any password. The corollary is
that you should choose a long password comprising letters, numbers, symbols, foreign characters, mixed
case, and so on, if you want to protect a document against the amateur password cracker. It is not such
a good idea if you want to use AOXPPR to recover your own document at a later date.
Figure 2. You can see why I decided to give up.
Figure 3. A Word or Excel document that is merely
protected (against tracked changes) can be opened
immediately with a substitute password.
Figure 4. A Word document protected (against opening)
with a dictionary word ("table") was processed almost
immediately.
My test machine is a 1 GHz Pentium III with 256 MB RAM, but my 8-character password mentioned earlier
withstood my own patience. See Figure 1. A simpler, 8-letter password "zzzzzzzz" could have taken
about 11 days or less, had it started with an "a" and we knew that only lowercase letters were used.
Usually, you tend to remember part of a password and can start the search from that point.
If you use words that are found in a dictionary, e.g. "table", you might as well not bother, but if you
modified them slightly, e.g. "GoDoggies", the cracker may have loaded the dictionary with names of
football teams and supporter slogans, or he may not. In the latter case, the brute force method will
eventually find it.
Sometimes, you have to decide if it would be quicker to recreate your own document than to crack its
password.
Note:
The program is licensed to you provided that you are the legal owner of all files or data you are going
to recover or have permission from the legitimate owner to perform these acts.
Availability and Price
Elcomsoft is a Moscow-based developer of many interesting products in addition to AOXPPR. They focus on
password recovery or PC security. There are so many products that use passwords and, if you are like me
and use a different password for each service or product, you are bound to forget some of them. Check
out Elcomsoft's Web site at http://www.elcomsoft.com
to see the full range of offerings. For the Standard Edition, a personal use licence costs US$60, whereas
a business use licence is US$120. The Professional Edition costs US$150. The trial version is completely
identical to the registered version except that it has a limit of 4 characters in the password.
Reprinted from the November 2002 issue of PC Update, the magazine of Melbourne PC User Group, Australia
