Finally, a note of sanity in this thread. On Tue, Oct 12, 2010 at 8:33 PM, Mutiny <[email protected]> wrote:
> The issue is that someone gained access to that file. You sharing your > drives over the internet with read privileges? You have other > vulnerable software being leveraged to read that file? Would you prefer > they MD5'd it? It sounds like your issue is that your password is > stored. I mean, they moved your encrypted password from passwd to > shadow for a reason, but that doesn't change the fact that it's stored > and if someone doesn't need access to shadow or passwd, they shouldn't > have it. > > Stop logging into your FTP server from a public terminal with Filezilla. > > > On 10/9/2010 11:00 AM, Vipul Agarwal wrote: > > That's a live and good example. I hope that now they'll understand the > > importance of the issue. > > > > On Fri, Oct 8, 2010 at 11:28 AM, Shirish Padalkar > > <[email protected]>wrote: > > > >> > >> > >> > http://www.google.com/#sclient=psy&hl=en&site=&source=hp&q=inurl:recentservers.xml&oq=inurl:recentservers.xml > >> > >> :) > >> > >> > >> From: > >> Ryan Sears <[email protected]> > >> To: > >> full-disclosure <[email protected]> > >> Date: 10/08/2010 08:52 AM Subject: > >> [Full-disclosure] Filezilla's silent caching of user's credentials > >> Sent by: [email protected] > >> ------------------------------ > >> > >> > >> > >> Hi all, > >> > >> As some of you may or may not be aware, the popular (and IMHO one of the > >> best) FTP/SCP program Filezilla caches your credentials for every host > you > >> connect to, without either warning or ability to change this without > editing > >> an XML file. There have been quite a few bug and features requests > filed, > >> and they all get closed or rejected within a week or so. I also posted > >> something in the developer forum inquiring about this, and received this > >> response: > >> > >> "I do not see any harm in storing credentials as long as the rest of > your > >> system is properly secure as it should be." > >> > >> Source:(http://forum.filezilla-project.org/viewtopic.php?f=3&t=17932) > >> > >> To me this is not only concerning, but also completely un-acceptable. > The > >> passwords all get stored in PLAIN TEXT within your %appdata% directory > in an > >> XML file. This is particularly dangerous in multi-user environments with > >> local profiles, because as we all know physical access to a computer > means > >> it's elementary at best to acquire information off it. Permissions only > work > >> if your operating system chooses to respect them, not to mention how > simple > >> it is *even today* to maliciously get around windows networks using > >> pass-the-hash along with network token manipulation techniques. > >> > >> There has even been a bug filed that draws out great ways to > psudo-mitigate > >> this using built-in windows API calls, but it doesn't seem to really be > >> going anywhere. This really concerns me because a number of my coworkers > and > >> friends were un-aware of this behavior, and I didn't even know about it > >> until I'd been using it for a year or so. All I really want to see is at > the > >> very least just some warning that Filezilla does this. > >> > >> Filezilla bug report:(http://trac.filezilla-project.org/ticket/5530) > >> > >> My feelings have been said a lot more eloquently than I could ever hope > to > >> in that bug report: > >> > >> "Whoever keeps closing this issue and/or dismissing its importance > >> understands neither security nor logical argument. I apologize for the > slam, > >> but it is undeniably true. Making the same mistake over and over does > not > >> make it any less of a mistake. The fact that a critical deficiency has > >> existed for years does not make it any less critical a deficiency. > >> Similarly, the fact that there are others (pidgin) who indulge in the > same > >> faulty reasoning does not make the reasoning any more sound." ~btrower > >> > >> While it's true you can mitigate this behavior, why should it even be > >> enabled by default? The total lapse in security for such a feature-rich, > >> robust piece of software is quite disturbing, and I don't understand how > the > >> developers don't think this is an issue. > >> > >> I just wanted to gauge the FD community on this issue, because with > enough > >> backing and explanation from the security community as to why this is a > >> problem, this issue may finally be resolved (it's been doing this for > years > >> now). > >> > >> Regards, > >> Ryan Sears > >> > >> _______________________________________________ > >> Full-Disclosure - We believe in it. > >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html > >> Hosted and sponsored by Secunia - http://secunia.com/ > >> > >> > >> =====-----=====-----===== > >> Notice: The information contained in this e-mail > >> message and/or attachments to it may contain > >> confidential or privileged information. If you are > >> not the intended recipient, any dissemination, use, > >> review, distribution, printing or copying of the > >> information contained in this e-mail message > >> and/or attachments to it are strictly prohibited. If > >> you have received this communication in error, > >> please notify us by reply e-mail or telephone and > >> immediately and permanently delete the message > >> and any attachments. Thank you > >> > >> > >> > >> _______________________________________________ > >> Full-Disclosure - We believe in it. > >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html > >> Hosted and sponsored by Secunia - http://secunia.com/ > >> > > > > > > > > > > > > _______________________________________________ > > Full-Disclosure - We believe in it. > > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > > Hosted and sponsored by Secunia - http://secunia.com/ > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ >
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
