1 2 Previous Next 15 Replies Latest reply on Oct 31, 2012 2:59 AM by james.gould

    Is the data in a .fmp12 encrypted?

    james.gould

      My various attempts to answer this question have been left unresolved...

       

      It looks like the data in a .fmp12 is stored unencrypted while the user account information is encrypted when you create each account and never unencrypted after that point (presumably the login just compaes hashes?)

       

      If anybody has any additional information about this matter it would be greatly appreciated.

        • 2. Re: Is the data in a .fmp12 encrypted?
          AlanStirling

          Hi Lyndsay

           

          Thanks for your link to this FileMaker 12 Security document, which in itself makes interesting reading - it is full of useful information, updated for FMP version 12.

           

          But as far as I can see, the document you recommend is completely devoid of any advice on the encryption of FileMaker data and physical file security - and isn't that what this question is about?

           

          Perhaps you actually haven't read the document?

           

          I have my own views on the format in which FileMaker stores data in its files and I'm keen to learn more, but your advice has wasted my time in this respect.

           

          As regards the actual question, I have found that user data IS encrypted in a FileMaker database, but not to an extent that would stop a hacker (for long) from finding a way to decode it once they had gained physical access to the file. 

           

          Parts of a FileMaker file are not encoded, but these areas hold layout and database definitions - not user data. 

           

          There is a separate area in the file that encodes the security schema in a way that passwords cannot be extracted.

           

          Best wishes - Alan Stirling , London UK.

          • 3. Re: Is the data in a .fmp12 encrypted?
            comment

            AlanStirling wrote:

             

            I have found that user data IS encrypted in a FileMaker database, but not to an extent that would stop a hacker (for long) from finding a way to decode it once they had gained physical access to the file.

             

            I wonder how you reached this conclusion. I don't know the answer myself (at least not definitively, and I wouldn't accept an answer as definitive unless it came directly from FMI). However, I see that the document that Lyndsay has pointed to explains how to encrypt the data while it's being transferred between server and client. The same document advises us to use an encryption plug-in if "encryption at rest" is needed (on page 25). Perhaps you haven't read that part - to me, it suggest very strongly that the data in file is not encrypted.

             

             

             

            AlanStirling wrote:

             

            Perhaps you actually haven't read the document?

             

            I have my own views on the format in which FileMaker stores data in its files and I'm keen to learn more, but your advice has wasted my time in this respect.

             

            That's an awfully rude thing to say to another forum member, don't you think?

            • 4. Re: Is the data in a .fmp12 encrypted?
              steve_ssh

              Michael Horak wrote:

               

              That's an awfully rude thing to say to another forum member, don't you think?

              +1

              • 5. Re: Is the data in a .fmp12 encrypted?
                AlanStirling

                Hi Michael and Steve

                 

                I'm sorry that you both think that my comment was 'awfully rude', but after 20 minutes scanning through the 'FileMaker Security Guide' this Sunday afternoon, to find that it contained no answers to the original question: 'Is the data in a .fmp12 encrypted', I felt that I had been sent on a 'Wild Goose Chase'!

                 

                If the 'FileMaker Security Guide' had contained some further details about the form/extent of data encryption used in a FileMaker 12 file, then I wouldn't have made the comment.

                 

                (It's very unlikely that FileMaker would want to publish these details anyway.)

                 

                So if you are both still unsure about whether the data is encrypted in a FileMaker 12 file, I suggest that you make a small test database in FileMaker Pro 12 with a few fields containing identifiable data in one record and then open that file in BBEdit (or any other hex editor).

                 

                You will not be able to see your data.  As I explained previously, it is not heavily encrypted, but nether is it stored as plain text.

                 

                There was a previous question in August 2012 entitled: 'I need help with a date formatting issue..' from Norman Cole.

                 

                https://fmdev.filemaker.com/message/92463#92463

                 

                In my answer I explained that I could read the data in a FileMaker 12 file and gave some examples of how certain data is actually stored in the file. But you can't read that data without decoding it.

                 

                Best wishes - Alan Stirling, London UK.

                • 6. Re: Is the data in a .fmp12 encrypted?
                  comment

                  It seems like we don't  agree on the definition of "encryption". I am glad you pointed to the other thread, because it too shows that the data is not encrypted. Translation from binary to hex and then to ASCII is not "decryption" - it's just another way to view the actual contents of the file. Anyone with a text editor can do that, in no time at all.

                   

                  AlanStirling wrote:

                   

                   

                  (It's very unlikely that FileMaker would want to publish these details anyway.)

                   

                  IMHO, the opposite is true.

                   

                   

                  AlanStirling wrote:

                   

                  after 20 minutes scanning through the 'FileMaker Security Guide' this Sunday afternoon, to find that it contained no answers to the original question: 'Is the data in a .fmp12 encrypted',

                   

                  That's your opinion, not mine. Also, the OP asked for "any additional information about this matter". Given that the document contains 22 occurrences of "encrypt", it can hardly be totally irrelevant to the question. But if you still feel you have been cheated, ask for your money back.

                  • 7. Re: Is the data in a .fmp12 encrypted?
                    AlanStirling

                    Hi Michael

                     

                    We can agree to differ on many things, but if you're so certain that you'll be able to read the user data in a FileMaker 12 file with a text editor - then I suggest that you go ahead and try it!

                     

                    Since I have actually tested this myself many times, there is no doubt in my mind as to the result - you will find that the user data cannot be viewed in a text editor.

                     

                    All the user data stored in a FileMaker database has been encoded since version 7 was released in 2004.

                     

                    Best wishes - Alan Stirling, London UK.

                     

                    (FileMaker FBA Member, Certified FileMaker Developer for versions 7,8,9,10,11 & 12, FileMaker Excellence Award Winner 2003, Annual FileMaker Devcon Attendee: 1997 to 2012)

                    • 8. Re: Is the data in a .fmp12 encrypted?
                      comment

                      AlanStirling wrote:

                       

                      you will find that the user data cannot be viewed in a text editor.

                       

                      That is correct. I did not mean to imply otherwise (I can see my previous post was rather clumsily worded). However, "coded" is not necessarily the same thing as "encrypted". Why don't you post your decoding algorithm, so we can make that decision for ourselves?

                      • 9. Re: Is the data in a .fmp12 encrypted?
                        AlanStirling

                        Hi Michael - Sorry, but No.

                         

                        Best wishes - Alan Stirling, London UK.

                        • 10. Re: Is the data in a .fmp12 encrypted?
                          comment

                          Then it would be futile of me to continue this discussion. I'll just say that I find the claim that data is encrypted "but not to an extent that would stop a hacker (for long) from finding a way to decode it" to be rather meaningless. The strength of encryption is a function of the algorithm and the length of the key used. Without knowing either, I'll keep on presuming that the data is not encrypted.

                          • 11. Re: Is the data in a .fmp12 encrypted?
                            mark_scott

                            Hi James,

                             

                            Excellent question!  In addition to the document that Lyndsay kindly linked (which should be considered essential reading ;-), I remembered long ago reading something that addressed file encryption (or not) very explicitly.  A bit of Googling and I found the exact document I was thinking of.  It is a 2004 white paper on FileMaker security, written for FMI by Robert W. Baldwin.  Although entitled "FileMaker 7 Security," to the best of my knowledge the following statement from that document is still correct*:

                             

                             

                            "The database file is not encrypted, but the data is obscured via a proprietary Unicode compression algorithm. This will help prevent casual attackers from extracting data from copies of the application files using a text-editor. … The compressed data in the cache file is further obscured to protect the data and metadata with a fast proprietary encryption algorithm. Customers who require better file-level security can use file and folder encryption features built into the operating system (e.g.,WinNT

                            and WinXP Pro) or with third party tools."

                             

                             

                            The sentence I truncated out ("…") was regarding passwords.  You can download and read the whole document, and find the passage in its original context (p. 8), at:

                             

                            http://www.filemaker.com/downloads/pdf/whitepaper_fm7_security.pdf

                             

                            Hope this helps!

                             

                            Best,

                             

                            Mark

                             

                            (*Do note, however, FileMaker's disclamer on the last page that "FILEMAKER MAKES NO COMMITMENT TO UPDATE THIS INFORMATION.")

                            1 of 1 people found this helpful
                            • 12. Re: Is the data in a .fmp12 encrypted?
                              james.gould

                              Thanks for the replies - this is very useful. Particularly the "unicode compression algorithm" to prevent "casual attackers"*... Sounds like it's almost a side effect of their compression techniques rather than a security feature to be depended on.

                               

                              This will help me answer some questions for the client and also some interesting information/knowledge for myself.

                               

                              I will make sure that the client is aware that if somebody gains direct access to the data file itself (I might not even be able todo once it's uploaded to their server) there is only a low level of protection built into the file (which shouldn't be depended on).

                               

                               

                               

                              *casual attackers: sounds like a 'get out of jail free card' for FMI's lawyers!

                              • 13. Re: Is the data in a .fmp12 encrypted?
                                LyndsayHowarth

                                Hi Alan,

                                 

                                I may have grabbed a link to the wrong document... apologies if I did. Something I read in resources had stuff about encryption. I must have too much on my plate at the 'mo ;-)

                                 

                                I seem to remember additional security credentials were discussed with reference to v12 on this or another forum (there are so many!). During the discussion I remember being told that FM had achieved some further compliance....  (memory like a seive!)

                                 

                                - Lyndsay

                                • 14. Re: Is the data in a .fmp12 encrypted?
                                  Vaughan

                                  AlanStirling wrote:

                                   

                                  As regards the actual question, I have found that user data IS encrypted in a FileMaker database, but not to an extent that would stop a hacker (for long) from finding a way to decode it once they had gained physical access to the file.

                                   

                                  Stopping a hacker "for long"... you forgot to define "long". The computing resources available to anybody today are making "long" shorter and shorter.

                                   

                                  Take this article on cryptographic keys:

                                   

                                  http://www.wired.com/threatlevel/2012/10/dkim-vulnerability-widespread/all/

                                   

                                  “A 384-bit key I can factor on my laptop in 24 hours,” [Zachary Harris] says. “The 512-bit keys I can factor in about 72 hours using Amazon Web Services for $75. And I did do a number of those. Then there are the 768-bit keys. Those are not factorable by a normal person like me with my resources alone. But the government of Iran probably could, or a large group with sufficient computing resources could pull it off.”

                                   

                                  Physical access to the database files, including backups both on-site and off-site, is as important as any other database security consideration. Steven H. Blackwell et al have been saying this for years.

                                  1 2 Previous Next