Message-ID: <4CB0CAAB.9080600@gmail.com>
Date: Sat, 09 Oct 2010 16:03:55 -0400
From: Brandon McGinty <brandon.mcginty@...il.com>
To: Vipul Agarwal <vipul@...tygeeks.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Filezilla's silent caching of
	user's	credentials

If this is the wrong list for this question, I appologize.
Is there any precedent for notifying those whose results have popped up
for the below referenced google search?
I would be happy to send out an email to the domain owners?, to alert
them of a problem, but I am not sure if this is recommended.

Brandon McGinty


On 10/9/2010 11:00 AM, Vipul Agarwal wrote:
> That's a live and good example. I hope that now they'll understand the
> importance of the issue.
> 
> On Fri, Oct 8, 2010 at 11:28 AM, Shirish Padalkar
> <shirish.padalkar@....com>wrote:
> 
>>
>>
>> http://www.google.com/#sclient=psy&hl=en&site=&source=hp&q=inurl:recentservers.xml&oq=inurl:recentservers.xml
>>
>> :)
>>
>>
>>  From:
>> Ryan Sears <rdsears@....edu>
>> To:
>> full-disclosure <full-disclosure@...ts.grok.org.uk>
>> Date: 10/08/2010 08:52 AM Subject:
>> [Full-disclosure] Filezilla's silent caching of user's credentials
>> Sent by: full-disclosure-bounces@...ts.grok.org.uk
>> ------------------------------
>>
>>
>>
>> Hi all,
>>
>> As some of you may or may not be aware, the popular (and IMHO one of the
>> best) FTP/SCP program Filezilla caches your credentials for every host you
>> connect to, without either warning or ability to change this without editing
>> an XML file. There have been quite a few bug and features requests filed,
>> and they all get closed or rejected within a week or so. I also posted
>> something in the developer forum inquiring about this, and received this
>> response:
>>
>> "I do not see any harm in storing credentials as long as the rest of your
>> system is properly secure as it should be."
>>
>> Source:(http://forum.filezilla-project.org/viewtopic.php?f=3&t=17932)
>>
>> To me this is not only concerning, but also completely un-acceptable. The
>> passwords all get stored in PLAIN TEXT within your %appdata% directory in an
>> XML file. This is particularly dangerous in multi-user environments with
>> local profiles, because as we all know physical access to a computer means
>> it's elementary at best to acquire information off it. Permissions only work
>> if your operating system chooses to respect them, not to mention how simple
>> it is *even today* to maliciously get around windows networks using
>> pass-the-hash along with network token manipulation techniques.
>>
>> There has even been a bug filed that draws out great ways to psudo-mitigate
>> this using built-in windows API calls, but it doesn't seem to really be
>> going anywhere. This really concerns me because a number of my coworkers and
>> friends were un-aware of this behavior, and I didn't even know about it
>> until I'd been using it for a year or so. All I really want to see is at the
>> very least just some warning that Filezilla does this.
>>
>> Filezilla bug report:(http://trac.filezilla-project.org/ticket/5530)
>>
>> My feelings have been said a lot more eloquently than I could ever hope to
>> in that bug report:
>>
>> "Whoever keeps closing this issue and/or dismissing its importance
>> understands neither security nor logical argument. I apologize for the slam,
>> but it is undeniably true. Making the same mistake over and over does not
>> make it any less of a mistake. The fact that a critical deficiency has
>> existed for years does not make it any less critical a deficiency.
>> Similarly, the fact that there are others (pidgin) who indulge in the same
>> faulty reasoning does not make the reasoning any more sound." ~btrower
>>
>> While it's true you can mitigate this behavior, why should it even be
>> enabled by default? The total lapse in security for such a feature-rich,
>> robust piece of software is quite disturbing, and I don't understand how the
>> developers don't think this is an issue.
>>
>> I just wanted to gauge the FD community on this issue, because with enough
>> backing and explanation from the security community as to why this is a
>> problem, this issue may finally be resolved (it's been doing this for years
>> now).
>>
>> Regards,
>> Ryan Sears
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>>
>> =====-----=====-----=====
>> Notice: The information contained in this e-mail
>> message and/or attachments to it may contain
>> confidential or privileged information. If you are
>> not the intended recipient, any dissemination, use,
>> review, distribution, printing or copying of the
>> information contained in this e-mail message
>> and/or attachments to it are strictly prohibited. If
>> you have received this communication in error,
>> please notify us by reply e-mail or telephone and
>> immediately and permanently delete the message
>> and any attachments. Thank you
>>
>>
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
> 
> 
> 
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists