bugtraq - Re: Trillian Ver 3.1 saves password's in plain Text

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <42F2F6DA.4050302@gmail.com>
Date: Fri, 05 Aug 2005 00:19:22 -0500
From: patrick <mccpat@...il.com>
To: Keith Phillips <kphillips@...rdreamcorp.com>,
	bugtraq@...urityfocus.com
Subject: Re: Trillian Ver 3.1 saves password's in plain Text


Keith Phillips wrote:

>The issue arises when you click the link to your Yahoo mail under "My
>Mail Accounts". This creates an html file in the directory discussed
>below which contains user name and clear text password.
>
>KP 
>
>-----Original Message-----
>From: security curmudgeon [mailto:jericho@...rition.org] 
>Sent: Tuesday, August 02, 2005 3:51 AM
>To: bugtraq@...urityfocus.com
>Cc: Suramya Tomar
>Subject: Re: Trillian Ver 3.1 saves password's in plain Text
>
>
>Hi Suramya,
>
>: I was playing around with Trillian Pro 3.1 Build 121 and noticed a
>very
>: disturbing behavior when using it to check my yahoo mail.
>: 
>: When you choose the option to check your yahoo email from Trillian
>(The
>: little connection ball -> Check Yahoo Mail) it creates a temp file in
>: the <Install Directory>\users\default\cache with a random name that
>: contains the yahoo password in *clear text* and this file is world
>: readable. This would be somewhat ok if the file was deleted as soon as
>: the login was done but the file just sits there till you exit out of
>: trillian. Logging out doesn't erase the file. I have watched the file
>: exist on my system for over two weeks.
>: 
>: I have duplicated this with Trillian 3.0 Basic and Pro also. Tested on
>: Windows XP Pro and Windows 2000.
>
>I have Trillian Pro 3.1 Build 121 on Windows XP and can't duplicate this
>behavior. I have a YIM, ICQ, AIM and several Jabber accounts. My cache
>directory has several files in it; buddy type icon files for various
>AIM/YIM users, graphics for plugins, etc. In fact, every single file in
>there is JPEG, GIF or PNG.
>
>Doing a case insensitive grep through all the files, I can't find any
>trace of any of my passwords in any file in this directory. All of the
>files are dated 08/01/2005 shortly after I started Trillian up after
>returning from out of town.
>
>Could this occur the first time you set up a specific protocol/account,
>and that cache file is erased upon Trillian restart? If so, that would
>still be an issue, although considerably less severe. If not that, is
>there anything else being done differently here?
>
>: I have attempted to contact Cerulean Studios multiple times before
>: releasing this using their webform, email and forums over the past
>month
>: but havn't heard anything back from them. My last attempt to contact
>: them was on 06/13/2005. Since I havn't heard anything from them I am
>: sending this to Bugtraq.
>
>Before 3.x (i think), Trillian had a way to submit bugs/feedback from
>within the program, and all of my reports were responded to within 24
>hours. Since 3.x I believe that feature is gone. Doesn't help you, just
>a side comment =) Would be nice to see Cerulean bring this back.
>
>
>  
>
I'd just like to add that, while it may not be relevant, but Gaim does
the same thing (in Window$). It stores the passwords in plain text, in
the User accounts directory (ie. c:\documents and settings\user123).
More on that here. <http://gaim.sourceforge.net/plaintextpasswords.php>

-- 
Patrick M.
/* EOF */