<<< Date Index >>>     <<< Thread Index >>>

Re: Pidgin IM Client Password Disclosure Vulnerability.



Memisyazici, Aras wrote:
whereby they take a hash of the password, with a non-std. hashing
mechanism. The idea being that in today's world where there are so
many scr1pt-kiddi3 toolz out there allowing the avg. Joe Schmoe the
capability of analyzing one's memory processes i.e. Tsearch, memhack
etc... It only makes it non-trivial for them to extract the info
needed. This way you are making it a tad more annoying and adding
another buffer they need to bypass :)

Okay, let's pretend you somehow prevent a local Administrator from reading the password out of memory... I'm already running code, so I install a key logger, and then crash/exit the process so you have to log in again. Once the attacker can run code on your system, it's game over. All you do by storing the password encoded is to make the attacker read the source to see how to decode it, and then write a k-rad 31337 script to automate it.