That's a live and good example. I hope that now they'll understand the importance of the issue.
On Fri, Oct 8, 2010 at 11:28 AM, Shirish Padalkar <[email protected]>wrote: > > > http://www.google.com/#sclient=psy&hl=en&site=&source=hp&q=inurl:recentservers.xml&oq=inurl:recentservers.xml > > :) > > > From: > Ryan Sears <[email protected]> > To: > full-disclosure <[email protected]> > Date: 10/08/2010 08:52 AM Subject: > [Full-disclosure] Filezilla's silent caching of user's credentials > Sent by: [email protected] > ------------------------------ > > > > Hi all, > > As some of you may or may not be aware, the popular (and IMHO one of the > best) FTP/SCP program Filezilla caches your credentials for every host you > connect to, without either warning or ability to change this without editing > an XML file. There have been quite a few bug and features requests filed, > and they all get closed or rejected within a week or so. I also posted > something in the developer forum inquiring about this, and received this > response: > > "I do not see any harm in storing credentials as long as the rest of your > system is properly secure as it should be." > > Source:(http://forum.filezilla-project.org/viewtopic.php?f=3&t=17932) > > To me this is not only concerning, but also completely un-acceptable. The > passwords all get stored in PLAIN TEXT within your %appdata% directory in an > XML file. This is particularly dangerous in multi-user environments with > local profiles, because as we all know physical access to a computer means > it's elementary at best to acquire information off it. Permissions only work > if your operating system chooses to respect them, not to mention how simple > it is *even today* to maliciously get around windows networks using > pass-the-hash along with network token manipulation techniques. > > There has even been a bug filed that draws out great ways to psudo-mitigate > this using built-in windows API calls, but it doesn't seem to really be > going anywhere. This really concerns me because a number of my coworkers and > friends were un-aware of this behavior, and I didn't even know about it > until I'd been using it for a year or so. All I really want to see is at the > very least just some warning that Filezilla does this. > > Filezilla bug report:(http://trac.filezilla-project.org/ticket/5530) > > My feelings have been said a lot more eloquently than I could ever hope to > in that bug report: > > "Whoever keeps closing this issue and/or dismissing its importance > understands neither security nor logical argument. I apologize for the slam, > but it is undeniably true. Making the same mistake over and over does not > make it any less of a mistake. The fact that a critical deficiency has > existed for years does not make it any less critical a deficiency. > Similarly, the fact that there are others (pidgin) who indulge in the same > faulty reasoning does not make the reasoning any more sound." ~btrower > > While it's true you can mitigate this behavior, why should it even be > enabled by default? The total lapse in security for such a feature-rich, > robust piece of software is quite disturbing, and I don't understand how the > developers don't think this is an issue. > > I just wanted to gauge the FD community on this issue, because with enough > backing and explanation from the security community as to why this is a > problem, this issue may finally be resolved (it's been doing this for years > now). > > Regards, > Ryan Sears > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > > > =====-----=====-----===== > Notice: The information contained in this e-mail > message and/or attachments to it may contain > confidential or privileged information. If you are > not the intended recipient, any dissemination, use, > review, distribution, printing or copying of the > information contained in this e-mail message > and/or attachments to it are strictly prohibited. If > you have received this communication in error, > please notify us by reply e-mail or telephone and > immediately and permanently delete the message > and any attachments. Thank you > > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > -- Thanks and Regards, Vipul Agarwal
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
