Page 1 of 1

Is the gfp container secure?

Posted: Sat Jul 17, 2010 11:23 am
by RocketRider
We are convinced that the gfp container format is secure. However, with this challenge you can prove us wrong.

The challenge is about decrypting the given media file without giving a password.
If someone can decrypt this media file, I will upload the complete sourcecode of the current version of the GreenForce-Player.

1) Download media file
2) Decrypt the media file
3) Send me the password or the decrypted video

What is the prize:
The complete sourcecode of the current version of the GreenForce-Player will be released to everyone.

GreenForce-Player

Re: Is the gfp container secure?

Posted: Sat Jul 17, 2010 1:33 pm
by Fluid Byte
This challenge is pointless. The player has to read the file anyway. So you will just debug the player and check where password check/decryption occurs. No one will even bother looking at the files but rather for the decryption in your program.

Re: Is the gfp container secure?

Posted: Sat Jul 17, 2010 11:51 pm
by Thorium
Fluid Byte wrote:This challenge is pointless. The player has to read the file anyway. So you will just debug the player and check where password check/decryption occurs. No one will even bother looking at the files but rather for the decryption in your program.
Right, and then ripping the code and do a bruteforce attack on the file to get the password.
You can't do anything against a brute force attack except having long passwords and a slow encryption algo.

Re: Is the gfp container secure?

Posted: Sun Jul 18, 2010 12:52 am
by PB
> You can't do anything against a brute force attack

What about a Captcha in the password input routine?

Re: Is the gfp container secure?

Posted: Sun Jul 18, 2010 4:10 am
by Thorium
PB wrote: What about a Captcha in the password input routine?
Captchas are just annoying for the user and could be just patched out by a cracker.

Re: Is the gfp container secure?

Posted: Mon Jul 19, 2010 9:29 pm
by blueznl
Just the password wouldn't matter, but I guess if someone could return a proper unencrypted media file then that would make sense.