SecureMac, Inc.

Computer security news. Just for Macs.

Get the latest computer security news for Macs and be the first to be informed about critical updates. Industry news, security events and all you need right at your fingertips. Malware threats change daily, so keep up to date on the latest developments to help ensure your privacy and protection. You can never be too safe. – Internet Config Advisory

Posted on June 2, 2001

Password weakness in Internet Config in MacOS

What is Internet Config?

From Internet Config FAQ: “The Internet Configuration System was designed to make your life easier by reducing the number of times which you need to enter your Internet preferences into the various preferences dialogs of all your Internet applications.

For example, currently you need to enter your Email address into many common
Macintosh Internet applications, for example Eudora, NewsWatcher and Anarchie.
The goal of the system was to get each of these applications to get this information
from one common place and to give you a tool to edit these common preferences.”

For example: When You install Power Mail 2.3.1 You can find Internet Config 2.0 in
Power Mail folder. You can use it to set Your Internet configuration and then click
on the “Use Internet Config” option when You set your e-mail account. Internet Config allows You among others to set Email Password, News Password and FTP
Proxy Password. All of these passwords are coded the same way.

Where can You find a password?

In Internet Preferences file in Preferences folder. Open this file using resource editor (ResEdit for instant) and open ICRP resource. Here You can find encrypted passwords: MailPassword, NewsAuthPassword and FTPProxyPassword. You can also find them with any hex editor, but offset depends on configuration.

Some examples

09 38 3E 3F 31 2E 29 3D 34 30 = nightrain

08 14 3B 39 3A 31 1F 33 3A = BlackDog

09 3B 38 37 37 36 32 3B 35 2A = moonlight

06 19 02 0C 15 1B 0C = OUTLAW

05 37 27 28 35 3F = apple

The first bite is the length of the password, so we don’t need it.

AA BB CC DD EE FF GG HH II JJ = aa bb cc dd ee ff gg hh ii jj


AA BB CC DD EE FF GG HH II JJ – encrypted password (hex)

aa bb cc dd ee ff gg hh ii jj – decrypted password in ASCII codes (hex)

aa=AA XOR 56H

bb=BB XOR 57H

cc=CC XOR 58H

dd=DD XOR 59H







and so on…

An example:

38H XOR 56H = 6EH = n

3EH XOR 57H = 69H = i

3FH XOR 58H = 67H = g

31H XOR 59H = 68H = h

2EH XOR 5AH = 74H = t

29H XOR 5BH = 72H = r

3DH XOR 5CH = 61H = a

34H XOR 5DH = 69H = i

30H XOR 5EH = 6EH = n


Don’t use it or at least don’t enter any password. I wonder why Netscape support it for example.

tested on:

Internet Config v.1.3, v.1.4, v.2.0 and v.2.0.2

Netscape Messenger 4.5, PowerMail 2.3.1, E(asy)-mail 2.0,

From the Internet Config FAQ:

“The following programs supported Internet Config before 8 Nov 1995.  NewsWatcher 2.0b21 and higher, Register 1.1 and higher, NotifyMail 2.5 and higher, BlitzMail 2.0.2 and higher, MacGzip 0.2.2 and higher, FTPd 2.4.0 and higher, ICeTEe 1.1 and higher, Internet Config Access, Mpack 1.5 and higher, BBEdit 3.1.1 and higher, NewsHopper 1.1 and higher, Anarchie 1.5.0 and higher, NCSA Telnet 2.6.1d7 and higher, Black Night 0.1.4 and higher, DropURL 1.1 and higher, CyberFinder, Symantec Project Manager 8.0.3 and higher, Personal Log 2.0 and higher, most programs based on the WASTE text editing engine, Claris Emailer, Fetch 3.0b5 and higher, PowerMail, ICScriptor, Kapito, Style 1.3.2 and higher, Internet Toolkit, NetSnagger.”

Simply Apple Script to show the weakness of the password.

Usage: Don’t enter first number and don’t use spaces between.

For exapmle: 383E3F312E293D3430, but not 09383E3F312E293D3430 or 38 3E 3F 31 2E 29 3D 34 30.

(*             IC Pass 2.1 by adix        21.07.99; Apple Script English    *)

set hex1 to text returned of (display dialog “Enter encrypted password:” default answer “”

buttons {” Ok “} default button ” Ok “)

set Alicia to “01010110010101110101100001011001010110100101101101011100


set pass to “”

set i to 1

set skok to 0

set ile to count items in hex1

if ile = 1 or ile = 0 then

set pass to “”


repeat until (i > (ile – 1))

set kodascii to 0

set zn to items (i) thru (i + 1) in hex1

set lbin to hex2bin(zn) as string

repeat with a from 1 to 8

set bit2 to item (a + skok) of Alicia

set bit1 to item a of lbin

if (bit1 = bit2) then

set bitk to “0”


set bitk to “1”

end if

set kodascii to {kodascii + bitk * (2 ^ (8 – a))}

end repeat

set pass to {pass & (ASCII character kodascii)}

set skok to skok + 8

set i to i + 2

end repeat

end if

display dialog “Password:   ” & pass & return & return & “by adix” buttons {” Ok “} default button ” Ok ”

on hex2bin(zn)

set temphex to {“0000”, “0001”, “0010”, “0011”, “0100”, “0101”, “0110”, “0111”, “1000”, “1001”,

“1010”, “1011”, “1100”, “1101”, “1110”, “1111”}

set t2hex to “0123456789ABCDEF”

set bin to “” as string

repeat with j in zn

set t1 to j as string

repeat with i from 1 to (count items in t2hex)

if ((item i in t2hex) = t1) then

set temp to (item i in temphex)

exit repeat

end if

end repeat

set bin to {bin & temp} as string

end repeat

return (bin)

end hex2bin


From the Internet Config FAQ:

IC does provide the ability for applications to share preferences. Any information you enter into Internet Config can be accessed by any other software you execute on your machine.

This includes preferences like the email password. You should be aware that such passwords are available to any software on your computer. IC stores passwords in a non-secure fashion.

While each password is scrambled to prevent idle viewing with ResEdit, the scrambling algorithm is publicly documented in the IC Programming Kit. Anyone with a trivial programming background can access these passwords.

Note: This situation is no different from the passwords you enter into other applications. When you ask a program (such Users & Groups) to store a password, it must be stored in some file somewhere on your hard disk.  The only difference is that IC provides a public API for getting at these passwords. The important thing to keep in mind is that you should not install software that you do not trust on your machine.

Note: If you ignore this advice (and install software you do not trust on to your computer), password secrecy is the least of your problems. Specifically, the Mac OS does not prevent a program from erasing the entire contents of your hard disk.
If you want to know which applications are accessing which IC preferences, you can install:

ICAccess Logger (

Join our mailing list for the latest security news and deals