Sourcesafe Hackability

Peace be upon you,
Today I am going to hence about something that is critically dangerous, it's SourceSafe, I recommend to read the coming paragraph it will save lot of explanation

"Quoted" - http://keir.net/vsscrack.html

Visual SourceSafe (VSS) has a very weak password management system. There is one file stored within the VSS directory structure on the VSS server called um.dat (usually in the data sub-directory). This file contains all user names together with a hash of their passwords. The hashing process is poorly designed and insecure, not just due to the size of the resultant hash (2 bytes!) but also due to the extremely simple algorithm used to generate it. Such is the weak nature of the hashing algorithm that there are literally hundreds of easily obtained passwords that result in the same hash as the real password. In other words, the hashing algorithm used is extremely prone to collisions. So just bear in mind -- the passwords that this program produces are not necessarily (and in fact are probably NOT) the actual passwords initially created by the user, but will still give you the same level of access to VSS as if you had used the same original password. As an example, using a largish word list, my own password hash produced nearly 600 equivalent matching passwords, none of which was the true original but any of them could have been used in place of it.

Now after you read that, it is matter of minutes to crack the toughest password in SourceSafe, I just want to draw your attention that there is lots of other tools that work as source control with more safety and flexibility also it's open source which means you can develop your own version of source control with custom security you made or install from anywhere as plug-in, By the way, threre is HELL of tools that crack SourceSafe Password, also there is no way to secure it, as long as user has access to the Password file, it is done, anyways here is some recommendation for source control application that can be used to protect our code,

http://en.wikipedia.org/wiki/Concurrent_Versions_System
http://svnbook.red-bean.com/

Personal recommendation for client tools
CVS - http://www.tortoisecvs.org/
SVC - http://tortoisesvn.tigris.org/

Hope this article informative and helpful

P.S: there is many tools around I didn't want put any of it, to avoid anything that may cause trubles

BR
Ahmed Essam