Full Disclosure mailing list archives
Re: Filezilla's silent caching of user's credentials
From: Shirish Padalkar <shirish.padalkar () tcs com>
Date: Fri, 8 Oct 2010 11:28:25 +0530
http://www.google.com/#sclient=psy&hl=en&site=&source=hp&q=inurl:recentservers.xml&oq=inurl:recentservers.xml :) From: Ryan Sears <rdsears () mtu edu> To: full-disclosure <full-disclosure () lists grok org uk> Date: 10/08/2010 08:52 AM Subject: [Full-disclosure] Filezilla's silent caching of user's credentials Sent by: full-disclosure-bounces () lists grok org uk Hi all, As some of you may or may not be aware, the popular (and IMHO one of the best) FTP/SCP program Filezilla caches your credentials for every host you connect to, without either warning or ability to change this without editing an XML file. There have been quite a few bug and features requests filed, and they all get closed or rejected within a week or so. I also posted something in the developer forum inquiring about this, and received this response: "I do not see any harm in storing credentials as long as the rest of your system is properly secure as it should be." Source:(http://forum.filezilla-project.org/viewtopic.php?f=3&t=17932) To me this is not only concerning, but also completely un-acceptable. The passwords all get stored in PLAIN TEXT within your %appdata% directory in an XML file. This is particularly dangerous in multi-user environments with local profiles, because as we all know physical access to a computer means it's elementary at best to acquire information off it. Permissions only work if your operating system chooses to respect them, not to mention how simple it is *even today* to maliciously get around windows networks using pass-the-hash along with network token manipulation techniques. There has even been a bug filed that draws out great ways to psudo-mitigate this using built-in windows API calls, but it doesn't seem to really be going anywhere. This really concerns me because a number of my coworkers and friends were un-aware of this behavior, and I didn't even know about it until I'd been using it for a year or so. All I really want to see is at the very least just some warning that Filezilla does this. Filezilla bug report:(http://trac.filezilla-project.org/ticket/5530) My feelings have been said a lot more eloquently than I could ever hope to in that bug report: "Whoever keeps closing this issue and/or dismissing its importance understands neither security nor logical argument. I apologize for the slam, but it is undeniably true. Making the same mistake over and over does not make it any less of a mistake. The fact that a critical deficiency has existed for years does not make it any less critical a deficiency. Similarly, the fact that there are others (pidgin) who indulge in the same faulty reasoning does not make the reasoning any more sound." ~btrower While it's true you can mitigate this behavior, why should it even be enabled by default? The total lapse in security for such a feature-rich, robust piece of software is quite disturbing, and I don't understand how the developers don't think this is an issue. I just wanted to gauge the FD community on this issue, because with enough backing and explanation from the security community as to why this is a problem, this issue may finally be resolved (it's been doing this for years now). Regards, Ryan Sears _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Filezilla's silent caching of user's credentials, (continued)
- Re: Filezilla's silent caching of user's credentials Michael Wood (Oct 07)
- Re: Filezilla's silent caching of user's credentials Jeffrey Walton (Oct 07)
- Re: Filezilla's silent caching of user's credentials Hurgel Bumpf (Oct 08)
- Re: Filezilla's silent caching of user's credentials Jeffrey Walton (Oct 08)
- Re: Filezilla's silent caching of user's credentials Jeffrey Walton (Oct 16)
- Re: Filezilla's silent caching of user's credentials dave b (Oct 16)
- Re: Filezilla's silent caching of user's credentials coderman (Oct 21)
- Re: Filezilla's silent caching of user's credentials Christian Sciberras (Oct 26)
- Re: Filezilla's silent caching of user's credentials Jeffrey Walton (Oct 16)
- Re: Filezilla's silent caching of user's credentials Vipul Agarwal (Oct 09)
- Re: Filezilla's silent caching of user's credentials Brandon McGinty (Oct 11)
- Re: Filezilla's silent caching of user's credentials rdsears (Oct 11)
- Re: Filezilla's silent caching of user's credentials Mutiny (Oct 13)
- Re: Filezilla's silent caching of user's credentials Chris Evans (Oct 13)
- Re: Filezilla's silent caching of user's credentials Ryan Sears (Oct 13)
- Re: Filezilla's silent caching of user's credentials Valdis . Kletnieks (Oct 13)