Quickies: PalmConnect USB Drivers, Password Decoding

Just find the user's Palm Desktop data files...

I wasn't under the impression that it was meant to be terribly secure...

Matt

That people don't actually rely on the security features built into Palms. Just by looking at it, one can simply deduct it isn't exactly something you'd trust anything secret with. I'll have to mess around with the app that they made. That'll be amusing

While SecuriTeam.com may be security experts, they certainly aren't Palm experts. While there may be a problem with the Palm passwords, it doesn't really matter, because the information on the Palm isn't secure in the first place.

Palm 'secret' files aren't actually secret at all. They're just hidden. Each program written for the Palm is supposed to take account of hidden records and not show them.

However, there's nothing forcing applications to obey this rule. Also, hidden records are just stored in the Palm like any other record, without any form of encryption.

So, any resonable Palm developer can write programs to access your hidden data either on the Palm or during a HotSync. Also, any database reader can be used by anyone to look at all the records on the Palm including hidden ones.

Because of this, you should never use the built-in Palm hidden / secret functionality to store private or sensitive data, as it's just not safe at all.

If you wish to store such information on the Palm, you'll want to get some special software that encrypts the information stored. That way not only does it need a password to access it, but anyone looking at the record will just see encypted gobble-de-gook.

There are various encytpion programs on the market, most are either Encypted Memo Pad programs or specific password / pin-code storing applications.

Cheers
Russell

Russell K Bulmer
Noble(star
http://noblestar.com

rbulmer@noblestar.com
+44 797 082 3259

Looking forward to Palm’s release of USB port cable for Palm IIIx.

I am writing from a school yard in Malaysia.

I think that there is a huge difference between poor data protection (which I understood) & poor protection of the password itself. A lost pass would compromise more privacy than just the contents of my palm.