Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft Dynamics GP "Encrypted" Using Caesar Cipher

Posted by kdawson on from the no-safety-in-numbers dept.

scribblej writes "Many large companies use Microsoft's Dynamics GP product for accounting, and many of these companies use it to store credit card numbers for billing customers. Turns out these numbers (and anything else in GP) are encrypted only by means of a simple substitution cipher. This includes the master system password, which can be easily selected and decrypted from the GP database by any user. Quoting: '[Y]ou DON'T HAVE TO GIVE ACCESS TO THE DYNAMICS DATABASE. What that means is if you create a base user in GP, that user can log into the SQL server and run a select statement on the table containing the "encrypted" GP System password. Not good.'" Update: 05/22 02:57 GMT by T : The original linked post has been revised in a few places; significantly, the following has been added as a correction: "By default, GP gives the user access to the DYNAMICS database but the user CANNOT login to the SQL server using SQL Enterprise Manager."

4 of 206 comments (clear)

  1. But... by the_one_wesp · · Score: 5, Funny

    Ohg vg'f jnl zber frpher gung jnl

  2. I have a fix for this. by 2names · · Score: 5, Funny

    They should hire some of them "too smart for their own good" Googlers.

    --
    "I'm just here to regulate funkiness."
  3. My encryption method... by Eberlin · · Score: 5, Funny

    I figure that the variation of Caesar Cipher, ROT13, was easy to decipher so for maximum security, I always run it through the ROT13 encoder twice before I send it. Hell, I'm encoding this message in that method now so it will have to take a bit of cunning for you to read this comment. So if you've managed to read this, congratulations, you are qualified to work in Microsoft's security department.

  4. Re:obligatory by Kilrah_il · · Score: 5, Funny

    And to make it clearer:

    [Brian is writing graffiti on the palace wall. The Centurion catches him in the act]
    Centurion: What's this, then? "Romanes eunt domus"? People called Romanes, they go, the house?
    Brian: It says, "Romans go home. "
    Centurion: No it doesn't ! What's the latin for "Roman"? Come on, come on !
    Brian: Er, "Romanus" !
    Centurion: Vocative plural of "Romanus" is?
    Brian: Er, er, "Romani" !
    Centurion: [Writes "Romani" over Brian's graffiti] "Eunt"? What is "eunt"? Conjugate the verb, "to go" !
    Brian: Er, "Ire". Er, "eo", "is", "it", "imus", "itis", "eunt".
    Centurion: So, "eunt" is...?
    Brian: Third person plural present indicative, "they go".
    Centurion: But, "Romans, go home" is an order. So you must use...?
    [He twists Brian's ear]
    Brian: Aaagh ! The imperative !
    Centurion: Which is...?
    Brian: Aaaagh ! Er, er, "i" !
    Centurion: How many Romans?
    Brian: Aaaaagh ! Plural, plural, er, "ite" !
    Centurion: [Writes "ite"] "Domus"? Nominative? "Go home" is motion towards, isn't it?
    Brian: Dative !
    [the Centurion holds a sword to his throat]
    Brian: Aaagh ! Not the dative, not the dative ! Er, er, accusative, "Domum" !
    Centurion: But "Domus" takes the locative, which is...?
    Brian: Er, "Domum" !
    Centurion: [Writes "Domum"] Understand? Now, write it out a hundred times.
    Brian: Yes sir. Thank you, sir. Hail Caesar, sir.
    Centurion: Hail Caesar ! And if it's not done by sunrise, I'll cut your balls off.

    --
    Whenever in an argument, remember this.