decrypting VRU passwords

[anglefire]

Hi,


We are using Lucent Sierra VRUs running VIS 3.0 software and are extracting the user data using the OCL commands MailboxReadByUID command and URRead.


We can obtain the user password in encrypted form with these two commands (but the two commands give different strings...). We need to find a way to decrypt these passwords so was can extract the customer audio data to move it to a new platform.

We have found that we can set the user password to all 0's and then x-or the original encrypted password with the all 0's encrypted password and get the user password, and then set the user password back to what it was. However this sets some flag that then requires the user to reset their password when they log in again.



So does anyone know how to avoid having this reset password flag set, or how to unset it or how to decrypt the password without having to go through the 0000 stuff I described above?



We know the decryption key is somehow related to the mailbox create date (minutes since 1/1/1884) since any mailbox created in the same minute has the same encrypted password when it's set to all zero's.



Thanks.

 

[KenMeans]

I am pretty sure I have seen a tool from Lucent that will do this but I think you can only get it from them. I will see if I can find the old document on it.

Ken Means

http://www.tel-is.com

 

[anglefire]

Thanks, anything would help.

 

[KenMeans]

Also just wondering what the new vender is telling you about this thy may have run into it before. I can't seem to find the doc's I had but I will keep looking. And if you can change the user record in the system you should be able to disable the resetting of the password when the user logs in. Just look at the record before and then see what flag is changed from before the reset.

Ken Means

http://www.tel-is.com

 

[anglefire]

I know... we have tried looking at the before and after records and we can't find anything different, we've looked down to the raw hex dumps and we can't tell what is different after we change a mailbox password using the OCL commands.

Our new vendor is unable to assist us in decrypting passwords from the old Lucent VRU's.


We want to make the migration totally seamless for our users, but unless we can get the user passwords without making them reset it the next time they access the old VRU, we won't be able to make it seamless.



We know it's not that complicated and we've seen patterns in the encrypted passwords by adding mailboxes every minute (since we know the mailbox create date is part of the key) but so far we can't figure out the encryption formula. Just the fact that it's a simple x-or with the all zero password tells us it's just not that secure, but so far, we can't find the pattern.



Anything you can come with would sure be appreciated. Thanks.