Private Messages Enhancements - PMCrypt - Private Message Encryption

Keywords: Private, Message, PM, Encrypt, Encode, Security

Description:
Encrypts Private Messages within the MySQL database. Allows for on-the-fly decryption without the need for a shared key.


Details:
This hack will encrypt sent messages within your MySQL database. No longer will they be viewable in plaintext, thus affording your members a little more security with their private correspondance.

Please be aware that this is not a total security solution. This was devised with simplicity as well as security in mind -- such as that the encryption method used is NOT to be assumed "unbreakable" by any stretch of the imagination.

The messages are encrypted using a method developed and credited to AITOR SOLOZABAL MERIN by where text is encrypted/decrypted using a simple but powerful XOR method without a known key. Implicitly, the key is defined by the string itself in a character by character way. There are 4 items to compose the unknown key for the character in the algorithim:

1. The ascii code of every character of the string itself
2. The position in the string of the character to encrypt
3. The length of the string that include the character
4. Any special formula added by the programmer to the algorithm to calculate the key to use

This product does not explicitly rely on any vBulletin functions, thus there should not be any problems with future upgrades, etc.

This product was developed by request of FGENETICS and DOOGIE88.


Installation:
1. Download and import the product-pmcrypt1.1.0.xml file via the Product Manager.

2. Enable the product via the AdminCP (vBulletin Options > Private Message Encryption)

3. ???

4. Profit


Version History:
v1.0.0 - Initial Release
v1.0.1 - Fixed bug when replying to an encrypted message.
v1.1.0 - Fixed issue with reply and preview. Encapsulated encryption within base64_encode(); for storage. Smilies no longer run risk of breaking encryption.

* Once enabled, all PM's sent thereafter will be encrypted. This means that should you choose to disable and/or uninstall the product, said PM's will remain encrypted -- rendering them unreadable.

* Please note that this modification was developed on a forum with a userbase of 1 (myself). I've tested it for basic functionality but I cannot guarantee functionality or behavior on your forum. So, please -- make backups before installing this product!

[badham]

I would love to have this back f0r 3.8.x, it does not work with it for sure.... I looked at the code but have not had time to hash out where the rub is, shame as this was a great security feature and would love to see the same for 3.8

badham

[badham]

To add i got it working with 3.8 by simply uninstalling it and reinstalling it. Of course it did not help with those who had pm's which became encrypted and could not be read by the system, but all new pms are encrypted and decrypting as they should.... this is a good hack... would love to see someone do this for the entire vbulletin forum. Would be great for us who are security minded.

badham

[pete838]

I am interested in encrypting PM's inside the database to prevent something like this from exposing my members private messages. Is there any plan to update this mod for vB4?

[wIrEs]

please update to vb4.0.3 !

[gameplanets]

Great mod, can you pdate at least to vB 3.8?

[cclaerhout]

Here is a fix working for me on vB 3.8.6.

Better to say it again : UPDATE your previous version with this one. DO NOT uninstall your previous version !




If someone finds a way to DECRYPT ALL the PM database, then it will be a pleasure for me to UNINSTALL this hack.

[gameplanets]

Thank you cclaerhout! Works on 3.8.6!

[cclaerhout]

Here is a PHP script to "decrypt" all the encrypted pm in the database.

Before using it, YOU HAVE TO SAVE YOUR "pmtext" TABLE.
To do it, go to PHPMYADMIN

If the script doesn't work for you, you will be able to restore your table

Then open "decrypt_pm.php", and add information to connect to your server. Save the file. Upload it to your server. Launch it with your browser.

You can now upgrade to vB 4 or whatever.

This script is not supported

[mandrinvborg]

Does this mod work with VB 3.8.4?

[cclaerhout]

Yes but do not install this hack. For explanation, just read the thread.