GAPING HOLE in Access User Level Security??? (Access 2000 SR-1A)

Topic

New Reply

I think I have stumbled on a gaping hole in the supposed user level security of Access 2000.
I have split my database into Front end and Back end and correctly set up User accounts and passwords using the Access Security wizard. You need to log on correctly or you can’t read or modify records in the back end database. I noticed that when you re-installed Office components from the CD it changes the registry to refer to the default WIF “system.mdb”. You can then open the database Front end but you can’t access or change any records. But if you fix up the registry entry to point to the correct WIF (in my case “secured.mdb”) you are back in business.
Today, I was messing around with the ODBC applet in Windows 2000 and somehow deleted the MS Access default data source under the tab ‘USER DSN”
Next time I tried to open my Access database I was prompted to re-insert my Office CD number 2 to replace this deleted entry in the ODBC applet.
Lo and behold. The database base was now fully accessible as if I had never secured it!
It still was after rebooting and all references under security> User and Group accounts that I had created apart from the default ones had disappeared.
The database is now fully transparent to anyone who cares to view it.
Any comments on this?
PS
I have just put a cloned copy of my system disc in and the users have all re-appeared according to the WIF “secured.mdb” in my database and it is once more “secure”.
If I can find one way around the security how many other ways yet undiscovered might exist?
Is SQL any better?

Reply | Quote

Replies

If by SQL you mean SQL Server, there is no comparison. SQL Server is a database *server*, with the levels of security that a server provides. Of course, you can leave it wide open too, and you need to secure the sa and administrator accounts to restrict access to them.

With Access, you have to take additional steps in your code to insure that the database can’t be opened by the Admin user or at least that they have no permissions. You’re mixing problems here, as well. I’m not sure what you did to your ODBC drivers, but your security lives in the workgroup file and your permissions live in the database file.

Reply | Quote

Listen to Charlotte and go to http://support.microsoft.com/support/acces…tent/secfaq.asp

Download http://download.microsoft.com/download/acc…N-US/Secfaq.exe

I’m guessing you didn’t change the owner of the database from Admin to another User. I’m guessing that doing so would have stopped you from being able to open the database when you replaced the built-in workgroup file.

I would read the Security FAQ carefully before claiming to find a gaping security hole. I’m assuming you’ve also got the database in a secure location. Don’t forget Access is a PC database not as Charlotte said, a database server like SQL Server.

Reply | Quote

Dear Tom and Charlotte,
I followed the steps in an article posted about Access security very closely and I believe I did it correctly.
However, your posts indicate that I might, at some subtle and crucial point, have left out some small but vital step. So I will look into the references and suggestions you have given to see what this missing step might have been.
However I really want to say the following: if, in spite of my best efforts I have failed to adequately secure my database, which contains some personal and vital information, and I have laboured under the delusion that it was secure, what hope is there that even a small percentage of others will get it right with software so unfriendly as this?
It ought to be nearly IMPOSSIBLE to fail , not nearly impossible to succeed in an area deemed important by the suspicious minds of this world!
Sure, security is important, but if we were all brought up to do the right thing then it would be a boring subject indeed.
Thanks for your suggestions, I shall follow them up to see if they make a difference.

Reply | Quote

Actually I did all that (including moving the Admin user to the Users group) but in looking up the reference you gave at http://support.microsoft.com/support/acces…tent/secfaq.asp I came accross this passage which I acted on and that appears to have fixed it.
>>>>>>>>>>>>>>>>>
The Access 2000 Security Wizard removes permissions to the point where they are not visible on the security menus, but testing has revealed that in Access 2000 it is possible to open a database by using the default workgroup information file regardless of the menu settings. The cure for both versions of Access is to create a new, empty database while logged on as a member of the Admins group and import all of the objects from the secured database. You should take this step before spending too much time securing objects because Access considers imported objects to be “new” and loses the permission information that was stored in the source database.
>>>>>>>>>>>>>>>>>>>>>>>>>>>>
So all appears well now but I still maintain that many people would overlook some subtle exceptional step in securing their databases and not know that their ostensibly secure database was not secure at all.
I am not sure what you mean by “got the database in a secure location” Could you please let me know as this may be another one of these fatal ommissions!
Thank you for your guidance – it sure is a minefield!

Reply | Quote

I didn’t mean any harsh tone in my post, as I re-read it I hope I didn’t come across that way.

I never use the Security Wizard. The Form and Report wizards do most of the work for me with forms and reports, but then I tweak them. When it comes to security I learn how to do it from scratch. Wizards are nice, but it’s almost silly to have something like that for security. A wizard in my opinion, gives the impression something is easier than it really is, and I avoid them whenever possible. I even manually change my switchboards by modifying the switchboard items table. Plus I can add all sorts of code the Switchboard Manager couldn’t handle.

I do in fact create a blank database logged on as whatever User I create for the owner of the database, and I import every object from my un-secured Access “development” database, into the newly created shell. This changes the owner to that account. That is one item often overlooked by folks new to Access Security.

I do know there are hacks out there you can download to get into a secured Access database. Depending on where you store the database, also, seriously don’t overlook a locked door, etc.

Nothing is totally “Secure” if someone wants to break in bad enough.

FWIW

Reply | Quote

Thanks, I will review my security all over again – I thought I had it right but clearly haven’t.
I agree about the wizards (silly name anyway)
Instead of all these Wizards for security, why doesn’t microsoft just create a utility “Wizard” to check for security holes and alert you to them?

Reply | Quote