Pwdencrypt() Weakness

By Bill Graziano on 10 July 2002 | Tags: Security


Uberbloke submitted From "The Register" The inner workings of the undocumented pwdencrypt() hash function in Microsoft SQL Server have been revealed in a paper by security researcher David Litchfield of Next Generation Security Software (NGSS). Sort of thing that we ought to know about, I suppose. Thanks! The article is really a scare piece. It's really only a problem if you're already a system administrator on SQL Server. The other issue is if you used pwdencrypt() to secure other data in SQL Server. Turns out it's not quite that secure.

Link: Pwdencrypt() Weakness


Related Articles

Alerts for when Login Failures Strike (14 July 2008)

SQL Server Connection Strings (14 November 2007)

Understanding the Difference between Owners and Schemas in SQL Server (5 October 2007)

Improving Data Security by Using SQL Server 2005 (28 October 2005)

10 Steps to Help Secure SQL Server 2000 (16 September 2003)

MS Security Vulnerability (11 September 2003)

MS Response to the Slammer Worm (26 January 2003)

Building and Configuring More Secure Web Sites (21 December 2002)

Other Recent Forum Posts

SQL database is in RESTORING mode (2h)

Need to total/SUM by another column condition (6h)

Need to total/SUM by another column condition (6h)

Sparse Tables (7h)

Interesting recursive update (9h)

Pivot from row-level without loosing the ColNames (11h)

How to split comma separated values stored in XML node and display as individual records Without using function- SQL Server 2012 (12h)

Return only records that net to zero (15h)

- Advertisement -