3
$\begingroup$

Based on How does SafeNet MobilePASS generate passwords?, I'm not sure if the MobilePASS token can be extracted for use in another TOTP app such as andOTP or KeePassXC. (I guess it depends whether the MobilePASS algorithm is a standard one.) Is this possible? If so, how? Can I use the activation URL (so I don't even have to install MobilePASS), or do I need to extract it from the MobilePASS configuration?

The self-enrolment URL has these parameters:

  • code is a 25 character ASCII alnum string.
  • data is a pipe-separated string with a bunch of properties:
    1. Two zero-padded digits
    2. Two zero-padded digits
    3. My email address
    4. A 16-bit hex-encoded number
    5. A 16-bit hex-encoded number
    6. The string 0
    7. The string 0
    8. An 18-digit number
    9. The string Unknown
    10. A base-64 encoded string which decodes as Mailflow|{"V":"0.0.0000","P":"Win32","AN":"Mail","WT":2}
    11. The string 3000
    12. Empty string
    13. Empty string
    14. Empty string
  • sdata is a base-64 encoded string which decodes as 32 bytes of binary gibberish - no idea what the format is here, but it seems like a good candidate for the secret
  • reserved=0

After going to the enrolment URL I get a base64-encoded string with the following decoded value:

EnrollmentURL=https://[redacted]?sc=[redacted 8-character ASCII alnum string]
UserID=[my username]

Is the sc value the relevant secret, encoded in some way? If I try to use the code directly as a TOTP secret the application (two separate ones) uppercase the string, and generate different codes from MobilePASS.

$\endgroup$
2
  • $\begingroup$ Did you get anywhere with this? I believe the algo has changed again as the QR code contains the following payload... I cannot seem to get a response out of the URL but the MobilePass+ app does accept it so I think we just need to figure out the actual request that is sent from the app. EnrollmentURL=se.safenet-inc.com/selfenrollment/dskpp.aspx?sc=[sc] UserID=[UserID] Passphrase=[Passphrase] $\endgroup$ Commented Jul 4, 2023 at 15:22
  • $\begingroup$ Not really. I gave up after not getting any answers, and instead run this app on its own phone. $\endgroup$
    – l0b0
    Commented Jul 4, 2023 at 22:22

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.