CRYPTOCard’s CRYPTOAdmin software is a challenge/response user authentication administration system. The PT-1 token, which runs on a Palm OS device, generates the one-time-password response. A Palm OS .PDB file is created for each user and loaded onto their Palm device. By gaining access to the .PDB file, the legitimate user’s PIN can be determined through a series of DES decrypt-and-compares in under 5 minutes on a Pentium III 450MHz.

Application: CRYPTOAdmin 4.1 server with CRYPTOCard PT-1 token 1.04
Platforms: Server software on any environment and token software on any Palm OS device
Severity: An attacker can clone the one-time-password response scheme of the legitimate user.

Security Advisory: CRYPTOCard PalmToken PIN Extraction

DeCRYPTO is a user PIN extraction tool for the CRYPTOCard PT-1 Palm soft token. Requires the Palm OS .PDB token file from the PT-1 Palm application.

Platforms: Unix and Win 95/98/NT/2K

Tool: DeCRYPTO

Originally published as an @stake Security Advisory.