Re: Pidgin IM Client Password Disclosure Vulnerability.

[Steve Shockley <steve.shockley () shockley net>]

Memisyazici, Aras wrote:
> whereby they take a hash of the password, with a non-std. hashing
> mechanism. The idea being that in today's world where there are so
> many scr1pt-kiddi3 toolz out there allowing the avg. Joe Schmoe the
> capability of analyzing one's memory processes i.e. Tsearch, memhack
> etc... It only makes it non-trivial for them to extract the info
> needed. This way you are making it a tad more annoying and adding
> another buffer they need to bypass :)

Okay, let's pretend you somehow prevent a local Administrator from 
reading the password out of memory... I'm already running code, so I 
install a key logger, and then crash/exit the process so you have to log 
in again.  Once the attacker can run code on your system, it's game 
over.  All you do by storing the password encoded is to make the 
attacker read the source to see how to decode it, and then write a k-rad 
31337 script to automate it.