cyrozap / python-vipaccess

A free software implementation of Symantec's VIP Access application and protocol

Deprecation Notice

This repository is no longer maintained. Please use the fork by @dlenski: https://github.com/dlenski/python-vipaccess

python-vipaccess

python-vipaccess is a free and open source software (FOSS) implementation of Symantec's VIP Access client. It is able to generate OATH URIs and their corresponding QR codes so any TOTP-generating application can be used as a VIP OTP token.

Right now, it only supports the bare minimum number of features of the VIP Access provisioning protocol to work, but I might add support for the other features at some point in the future.

You can see my original blog post here, in which I describe how I reverse-engineered the VIP Access application.

Dependencies

• Python 2.6, 2.7, 3.3, 3.4, 3.5
• image
• lxml
• oath
• PyCrypto
• qrcode
• requests

If you have pip installed on your system, you can install them with pip install image lxml oath PyCrypto qrcode requests.

Installation

Via pip (recommended)

pip install python-vipaccess

Manual

1. Check out this repository by running git clone https://github.com/cyrozap/python-vipaccess.git
2. Switch to the python-vipaccess directory by running cd python-vipaccess
3. Install the vipaccess module
   • With pip: pip install .
   • Without pip: python setup.py install

Usage

Execute vipaccess (it should be in your PATH).

python-vipaccess's Issues

Install instructions incorrect, doesn't work anyway

This version of this tool doesn't work as far as I can tell.

Firstly, I could only install at all using the Python3 version of pip. Then the executable isn't on the path unless you install with sudo. Then running it gives Something went wrong--the token is invalid..

This version appears to be unmaintained.

I will try this version:

https://github.com/dlenski/python-vipaccess

I have documented the whole process end-to-end on my blog. That post also contains the history and gives a way of using an app that doesn't require any of the messing around that this application does.

https://it.knightnet.org.uk/blog/use-an-authenticator-app-to-login-to-paypal/

TypeError: cannot make memory view because object does not have the buffer interface

After having installed it via PIP, this is what happens:

fale@x250:~ $ vipaccess 
Traceback (most recent call last):
  File "/usr/bin/vipaccess", line 9, in <module>
    load_entry_point('python-vipaccess==0.3.0', 'console_scripts', 'vipaccess')()
  File "/usr/lib/python2.7/site-packages/vipaccess/utils.py", line 273, in main
    response = get_provisioning_response(request)
  File "/usr/lib/python2.7/site-packages/vipaccess/utils.py", line 147, in get_provisioning_response
    return requests.post(PROVISIONING_URL, data=request)
  File "/usr/lib/python2.7/site-packages/requests-2.8.1-py2.7.egg/requests/api.py", line 109, in post
    return request('post', url, data=data, json=json, **kwargs)
  File "/usr/lib/python2.7/site-packages/requests-2.8.1-py2.7.egg/requests/api.py", line 50, in request
    response = session.request(method=method, url=url, **kwargs)
  File "/usr/lib/python2.7/site-packages/requests-2.8.1-py2.7.egg/requests/sessions.py", line 468, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python2.7/site-packages/requests-2.8.1-py2.7.egg/requests/sessions.py", line 576, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python2.7/site-packages/requests-2.8.1-py2.7.egg/requests/adapters.py", line 370, in send
    timeout=timeout
  File "/usr/lib/python2.7/site-packages/requests-2.8.1-py2.7.egg/requests/packages/urllib3/connectionpool.py", line 559, in urlopen
    body=body, headers=headers)
  File "/usr/lib/python2.7/site-packages/requests-2.8.1-py2.7.egg/requests/packages/urllib3/connectionpool.py", line 353, in _make_request
    conn.request(method, url, **httplib_request_kw)
  File "/usr/lib64/python2.7/httplib.py", line 1053, in request
    self._send_request(method, url, body, headers)
  File "/usr/lib64/python2.7/httplib.py", line 1093, in _send_request
    self.endheaders(body)
  File "/usr/lib64/python2.7/httplib.py", line 1049, in endheaders
    self._send_output(message_body)
  File "/usr/lib64/python2.7/httplib.py", line 897, in _send_output
    self.send(message_body)
  File "/usr/lib64/python2.7/httplib.py", line 869, in send
    self.sock.sendall(data)
  File "/usr/lib/python2.7/site-packages/requests-2.8.1-py2.7.egg/requests/packages/urllib3/contrib/pyopenssl.py", line 216, in sendall
    data = memoryview(data)
TypeError: cannot make memory view because object does not have the buffer interface

fedora 27 and ubuntu 17.1 issue

Hi, I installed everything but when I try to star vipaccess from terminal it gives me error

• Something went wrong--the token is invalid.-
  I already tried stuff written in others comments but nothing to do. What could be the problem_

Invalid Tokens

Code generated by the python app seems to be invalid. Anyone else having issues?

I'm using this URL to verify: https://idprotect.vip.symantec.com/otpCheck

Also, when I try the command vipaccess provision. I get Something went wrong--the token is invalid.

Could the OTP be invalid?

vipaccess errors with "Something went wrong--the token is invalid."

Hi there,
I'm eager to be able to use your script, but after I installed python-vipaccess from pip and ran the program I got the following cryptic error:
"Something went wrong--the token is invalid."

Any idea how it can be fixed?

How about this?

When you use vip access, you tell the bank the vip access id (VSSxxxxx) so they can have your keys to authenticate you. How can we do the same?
A utility like yours that query Symantec server with a vip access I'd and returns the data needed for authenticating that ID. ..

Emulate Mobile VIP app

In your blog post, you mentioned you might one day add the capability to emulate the mobile version of VIP Access. Any chance you've looked into that at all?

HOTP vs TOTP

Hello.
Thank you for a cool program. I was reading your blog post and in it you show a response with a HOTP keyword from Symantec, but in your code it seems to be TOTP, as I would imagine it should be.
Are they mislabeling it in their response as HOTP when actually it's TOTP, or is one able to get a credential either way and you happened to implement the TOTP style?
Could you make your app correctly also get a HOTP key from them instead (so that we can use it with Yubikey for example...) Or is that not how it works. (My understanding is they Symantec should support both.. in some fashion.)
Or is my understanding of TOTP vs HOTP not correct. :)

Thanks!
-zach

Link to blog is insecure

The SSL cert used for blog link is expired.

https://www.cyrozap.com/2014/09/29/reversing-the-symantec-vip-access-provisioning-protocol/

Working w/ latest VIP Access app changes?

Is this coincidence, or does the latest update to Symantec's app break things?

Re-syncing the token allowed things to work; p.sure it's coincidence.

Rewrite module to be less monolithic

Currently, the python-vipaccess module does too many things. Ideally, it should just be a simple wrapper around Symantec's API with a command-line example program to generate an OTP URL, but as of the current version it also requires Pillow (and Django, which Pillow depends on) to be installed.

• Remove QR code-generation functionality
• Direct messages to STDERR and reserve STDOUT for the OTP URI

windows install script

The attached command file will download everything possible and create a portable install of vipaccess.exe.

open a windows command prompt and run
mkdir e:\ProgramFiles\python-installer\gitbash

copy these three files from your git bash install to e:\ProgramFiles\python-installer\gitbash
curl.exe libcrypto.dll libssl.dll

cd /d e:\ProgramFiles\python-installer
unzip the attached install.cmd to the current path and run:
install.cmd

Follow the prompts.

Good luck. Tested on Windows 7 without admin rights

Edit install.cmd PYTHONHOME setting to change the default install path
install.zip

https://forum.yubico.com/viewtopic.php?f=26&t=1617&start=10