full-disclosure - Google Talk cleartext credentials in process memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <438C33FC.6080208@parareal.net>
Date: Tue Nov 29 10:56:40 2005
From: sloik at parareal.net (Jaroslaw Sajko)
Subject: Google Talk cleartext credentials in process
	memory

pagvac wrote:
> Jaroslaw,
> 
> thanks for your post. You're right, the same issue occurs in *many*
> applications. However, any vendor that is serious about security will
> at least attempt to obfuscate the credentials in memory (IMHO).

Thanks for your post too. I think you're right that obfuscation can help
in some cases. Sometimes the plaintext credentials goes to the Microsoft
as the part of the crash report. Then if the cerdentials are obfuscated,
in a correct way, we can prevent Microsoft from collecting our
credentials. To prevent an attacker from reading credentialas from
process memory dump we need more complicated mechanism (the dump
contains all data & code). Therefore cost of implementing the correct
obfuscation might be uncomparable with the risk of the credential lost
in such manner. That's why I think the obfuscation isn't necessary. But
this is of course only my opinion:]

> I published the advisory to let the public know that Google fixed this
> problem, that's all.

You're right and we're thankful for this. Better if the user knows how
the application deals with his credentials.

> However I respect your opinion and appreciate your post.

As I respect your :]

regards,
js