Bugtraq mailing list archives
Re: Pidgin IM Client Password Disclosure Vulnerability.
From: Steve Shockley <steve.shockley () shockley net>
Date: Thu, 18 Sep 2008 22:15:37 -0400
Memisyazici, Aras wrote:
whereby they take a hash of the password, with a non-std. hashing mechanism. The idea being that in today's world where there are so many scr1pt-kiddi3 toolz out there allowing the avg. Joe Schmoe the capability of analyzing one's memory processes i.e. Tsearch, memhack etc... It only makes it non-trivial for them to extract the info needed. This way you are making it a tad more annoying and adding another buffer they need to bypass :)
Okay, let's pretend you somehow prevent a local Administrator from reading the password out of memory... I'm already running code, so I install a key logger, and then crash/exit the process so you have to log in again. Once the attacker can run code on your system, it's game over. All you do by storing the password encoded is to make the attacker read the source to see how to decode it, and then write a k-rad 31337 script to automate it.
Current thread:
- Pidgin IM Client Password Disclosure Vulnerability. Aditya K Sood (Sep 17)
- RE: Pidgin IM Client Password Disclosure Vulnerability. Quark IT - Hilton Travis (Sep 18)
- Re: Pidgin IM Client Password Disclosure Vulnerability. Aditya K Sood (Sep 18)
- RE: Pidgin IM Client Password Disclosure Vulnerability. Quark IT - Hilton Travis (Sep 19)
- Re: Pidgin IM Client Password Disclosure Vulnerability. Aditya K Sood (Sep 18)
- <Possible follow-ups>
- RE: Pidgin IM Client Password Disclosure Vulnerability. Memisyazici, Aras (Sep 18)
- Re: Pidgin IM Client Password Disclosure Vulnerability. John Bailey (Sep 19)
- RE: Pidgin IM Client Password Disclosure Vulnerability. Memisyazici, Aras (Sep 19)
- Re: Pidgin IM Client Password Disclosure Vulnerability. John Bailey (Sep 19)
- Re: Pidgin IM Client Password Disclosure Vulnerability. John Bailey (Sep 19)
- Re: Pidgin IM Client Password Disclosure Vulnerability. Steve Shockley (Sep 19)
- RE: Pidgin IM Client Password Disclosure Vulnerability. Quark IT - Hilton Travis (Sep 18)