Tuesday, March 1, 2016

Dell "FOR DELL INTERNAL USE" Password Protected Software

I have a Dell Inspiron 3147 which has an interesting item listed in the "Downloads and Drivers" section of the Dell support page:

INSPIRON 3147/3148/3152/3153/3157/3158 G-SENSOR CALIBRATION TOOL(FOR DELL INTERNAL USE)
This package provides Dell G-sensor calibration internally and is supported on Inspiron 3147/3148 that is running the following Operating Systems: Windows 8.1(64bit).
Link: http://www.dell.com/support/home/us/en/19/Drivers/DriversDetails?driverId=1MGNJ

So what's actually interesting is that this software is provided publicly and is contained in a password protected zip file.

(Just want to take a moment and say - the average user of this system does not need this software, I have no idea what it actually does. It's likely there so support can have customers acquire and run it when their issue meets a specific set of criteria. Also, if you break something because you ran it, that's your fault not Dell's.)

Anyways, I dumped the hashes and fed them into John the Ripper (community enhanced "Jumbo" release has support for zip file).

$ ./john ~/encrypted/gsensor.hashes 
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:06:41:48  3/3 0g/s 18284Kp/s 18284Kc/s 18284KC/s hrrlek0e
0g 0:07:29:56  3/3 0g/s 18130Kp/s 18130Kc/s 18130KC/s sumspy752*..sumskres9a
0g 0:09:38:53  3/3 0g/s 17980Kp/s 17980Kc/s 17980KC/s 1823adors4..1823adysac
0g 0:12:22:09  3/3 0g/s 17700Kp/s 17700Kc/s 17700KC/s 10932sho1*..10932spyon
0g 0:12:40:15  3/3 0g/s 17654Kp/s 17654Kc/s 17654KC/s 03433750458..03434741048
0g 0:13:21:40  3/3 0g/s 17532Kp/s 17532Kc/s 17532KC/s tutiairayes..tutiaimurla
0g 0:14:12:37  3/3 0g/s 17421Kp/s 17421Kc/s 17421KC/s lemrodm118..lemras061a
0g 0:15:01:52  3/3 0g/s 17302Kp/s 17302Kc/s 17302KC/s julk4tu00..julk46mb3
0g 1:05:22:06  3/3 0g/s 18348Kp/s 18348Kc/s 18348KC/s hg,bsp14s..hg,bh kuz
0g 1:08:09:16  3/3 0g/s 18343Kp/s 18343Kc/s 18343KC/s syarcr2ab..syarf0r61
0g 1:08:40:48  3/3 0g/s 18324Kp/s 18324Kc/s 18324KC/s zzjy@sk..zz42OF5
0g 1:13:25:46  3/3 0g/s 18142Kp/s 18142Kc/s 18142KC/s lk2hv''92..lk2hv/rs5
breakfix         (gsensor.zip)
1g 3:08:27:17 DONE 3/3 (2016-02-28 11:35) 0.000003g/s 18723Kp/s 18723Kc/s 18723KC/s bree3xyh..breal5fs
Use the "--show" option to display all of the cracked passwords reliably
Session completed
$

I assumed it would be something easy/simple that support could give an end-user over the phone, but still let JTR run with the default charset just in case. Leaving it to run over the weekend - the password is:
breakfix
Kind of a let-down. My Google-fu couldn't find any other software that had similar strings in Dell's support portal. Please comment if you find others. Also interesting that I can't find any examples of this password anywhere.

Curious if this is a one-time deal, or a common password used across multiple packages to keep the average user from accidentally running something.

I will add that the zip file contains some screenshots of the software running as well as a PDF instructions:



The 2nd pic shows what appears to be a snazzy Sensors Self Test Utility (SST).