Prevent enabling of shift bypass – Access 2010

by

My approach to security in Access is the following:

Encrypt the main database using a complex password.

Use a second database to log in to this encrypted database. The second database stores usernames, user salts, and an encrypted version of the main database password with the user password. This way, no user needs to have the main password.

Then, compile the second database, so it’s harder to modify the database and print the main encryption key.

Weaknesses:

  1. Revoking access to a certain user only works if he doesn’t have a
    backup of the login database (or you have to change the encryption key on
    the main database, forcing you to recreate accounts for every user).
  2. The encryption I’m using is RC4 (implementation in VB by wqw found as an answer here), which isn’t that strong
  3. A tech savvy user that has a valid password could decompile the database and use it to acquire the main database password
  4. If you’re not signing your databases and enforcing all databases to be signed, someone might modify or replace it to weaken security

To go through all the details is too much, so here is my implementation.

File metadata: size: 672 KB, SHA1 hash: 19A6C756B8D5B0CDCEBE505B289062A1BBD94DEC

Quick manual: on first run it prompts main database password, location, first user name and password. After that, you can just use the forms to do anything you want.

Note that it’s earlier work, and I haven’t deeply thought about SQL injection (I use doublequote escaping and am ashamed for it). However, this isn’t a security risk for the main database, it only opens up a possibility for a destructive hack (and someone with write access to the database file can probably destroy it anyway).

It’s not compiled and menus aren’t hidden, so you can easily inspect and modify it. When implementing it, hide all menus and compile it.

The database, as all SO content, is licensed CC BY SA 3.0

More Related Contents:

  1. UrlDownloadToFile in Access 2010 – Sub or Function not Defined
  2. How does one decompile and recompile a database application?
  3. What are the rules governing usage of parenthesis in VBA function calls?
  4. Autonumber value of last inserted row – MS Access / VBA
  5. Is it possible to pass parameters programmatically in a Microsoft Access update query?
  6. Code to loop through all records in MS Access
  7. Bang Notation and Dot Notation in VBA and MS-Access
  8. Difference between Microsoft.Jet.OleDb and Microsoft.Ace.OleDb
  9. How do I force VBA/Access to require variables to be defined?
  10. Why is my query not updateable?
  11. VBA: Difference in two ways of declaring a new object? (Trying to understand why my solution works)
  12. How to diagnose MS access crashes
  13. Equivalent cURL in VBA?
  14. How do I access the selected rows in Access?
  15. Run-time error ‘3061’. Too few parameters. Expected 1. (Access 2007)
  16. VBA procedure to import csv file into access
  17. Transform multiple rows into columns with unique key
  18. how to show query results in a datasheet in the same form?
  19. FileDialog doesn’t work
  20. Access VBA: Find max number in column and add 1
  21. MS Access prepared statements
  22. Create sequential ID value based on the year that a record is added
  23. Null values for variables in VBA
  24. Using a centralized VBA module in multiple Access databases
  25. How to execute a query in ms-access in VBA code?
  26. How to add a menu item to the default right click context menu
  27. VBA – Run Time Error 3271 using DAO object
  28. Trouble with InputBoxes
  29. Get Name of Current VBA Function
  30. Convert Access image OLE Object into raw image byte array in C#

Leave a Comment