bugtraq - Re: Pidgin IM Client Password Disclosure Vulnerability.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <48D30B49.4070107@shockley.net>
Date: Thu, 18 Sep 2008 22:15:37 -0400
From: Steve Shockley <steve.shockley@...ckley.net>
To: bugtraq@...urityfocus.com
Subject: Re: Pidgin IM Client Password Disclosure Vulnerability.

Memisyazici, Aras wrote:
> whereby they take a hash of the password, with a non-std. hashing
> mechanism. The idea being that in today's world where there are so
> many scr1pt-kiddi3 toolz out there allowing the avg. Joe Schmoe the
> capability of analyzing one's memory processes i.e. Tsearch, memhack
> etc... It only makes it non-trivial for them to extract the info
> needed. This way you are making it a tad more annoying and adding
> another buffer they need to bypass :)

Okay, let's pretend you somehow prevent a local Administrator from 
reading the password out of memory... I'm already running code, so I 
install a key logger, and then crash/exit the process so you have to log 
in again.  Once the attacker can run code on your system, it's game 
over.  All you do by storing the password encoded is to make the 
attacker read the source to see how to decode it, and then write a k-rad 
31337 script to automate it.