Trillian Ver 3.1 saves password's in plain Text

[Suramya Tomar]

Hi Everyone,

I was playing around with Trillian Pro 3.1 Build 121 and noticed a very
disturbing behavior when using it to check my yahoo mail.

When you choose the option to check your yahoo email from Trillian (The
little connection ball -> Check Yahoo Mail) it creates a temp file in
the <Install Directory>\users\default\cache with a random name that
contains the yahoo password in *clear text* and this file is world
readable. This would be somewhat ok if the file was deleted as soon as
the login was done but the file just sits there till you exit out of
trillian. Logging out doesn't erase the file. I have watched the file
exist on my system for over two weeks.

Now I shouldn't have to tell you why having a file like this will a
password in clear text is such a bad idea. All anyone needs is 2 mins
unsupervised on a computer that uses trillian and they will have the
user's password and since a lot of people use the same password for
various sites this will compromise a lot of other accounts too.

In my opinion the file shouldn't contain the password in the first place
but even if it *has* to have the password it should be deleted as soon
as the login is done and not sit there for over two weeks.

I have duplicated this with Trillian 3.0 Basic and Pro also. Tested on
Windows XP Pro and Windows 2000.

I have attempted to contact Cerulean Studios multiple times before
releasing this using their webform, email and forums over the past month
but havn't heard anything back from them. My last attempt to contact
them was on 06/13/2005. Since I havn't heard anything from them I am
sending this to Bugtraq.

If you have any questions/comments about this let me know.

Thanks,
Suramya

--
----------------------------------------------------------
Mountain Dew and doughnuts... because breakfast is the
most important meal of the day
----------------------------------------------------------
Name : Suramya Tomar
Homepage URL: http://www.suramya.com
-------------------------------------------------

************************************************** **********
Disclaimer:
Any errors in spelling, tact, or fact are transmission errors.
************************************************** **********

[security curmudgeon]

Hi Suramya,

: I was playing around with Trillian Pro 3.1 Build 121 and noticed a very
: disturbing behavior when using it to check my yahoo mail.
:
: When you choose the option to check your yahoo email from Trillian (The
: little connection ball -> Check Yahoo Mail) it creates a temp file in
: the <Install Directory>\users\default\cache with a random name that
: contains the yahoo password in *clear text* and this file is world
: readable. This would be somewhat ok if the file was deleted as soon as
: the login was done but the file just sits there till you exit out of
: trillian. Logging out doesn't erase the file. I have watched the file
: exist on my system for over two weeks.
:
: I have duplicated this with Trillian 3.0 Basic and Pro also. Tested on
: Windows XP Pro and Windows 2000.

I have Trillian Pro 3.1 Build 121 on Windows XP and can't duplicate this
behavior. I have a YIM, ICQ, AIM and several Jabber accounts. My cache
directory has several files in it; buddy type icon files for various
AIM/YIM users, graphics for plugins, etc. In fact, every single file in
there is JPEG, GIF or PNG.

Doing a case insensitive grep through all the files, I can't find any
trace of any of my passwords in any file in this directory. All of the
files are dated 08/01/2005 shortly after I started Trillian up after
returning from out of town.

Could this occur the first time you set up a specific protocol/account,
and that cache file is erased upon Trillian restart? If so, that would
still be an issue, although considerably less severe. If not that, is
there anything else being done differently here?

: I have attempted to contact Cerulean Studios multiple times before
: releasing this using their webform, email and forums over the past month
: but havn't heard anything back from them. My last attempt to contact
: them was on 06/13/2005. Since I havn't heard anything from them I am
: sending this to Bugtraq.

Before 3.x (i think), Trillian had a way to submit bugs/feedback from
within the program, and all of my reports were responded to within 24
hours. Since 3.x I believe that feature is gone. Doesn't help you, just a
side comment =) Would be nice to see Cerulean bring this back.

[Suramya Tomar]

Hi Bond,
Thanks for confirming this on your end. The login does work, but if
you are already logged in to your yahoo account when you try to use the
html file to login it doesn't work. I guess it has something to do with
the recent change in yahoo's authentication check as it used to work
earlier.

I am scared to even look at how it stores other passwords. Personally
I prefer using gaim. Atleast that is a lot more secure and its
developers seem to take security a lot more seriously.

Thanks,
Suramya

> Hi Suramya,
>
> You are correct. It looks like Trillian creates an HTML page that tries to
> accomplish the login but it doesn't work anyway. Yahoo's login mechanism
> isn't a simple form submit.
>
> Yet again, another poorly designed application. Now I wonder how it stores
> acct passwords in general. However, it does remove the file when Trillian is
> closed.
>
> -Bond
>
> -----Original Message-----
> From: Suramya Tomar [mailto:security@suramya.com]
> Sent: Saturday, July 30, 2005 9:49 PM
> To: bond.masuda@jlbond.com
> Subject: Re: Trillian Ver 3.1 saves password's in plain Text
>
> Hi,
> I tested it on a new install with no changes made to the default config.
>
> The steps I followed were as follows:
>
> 1. Install Trillian Pro Trial
> 2. Click on Trillian -> Manage My Connections
> 3. Click on the 'Add new Connection' button
> 4. Choose Yahoo from the list that pops up
> 5. Enter your yahoo username and password
> 6. Click on connect
> 7. Click on Close
> 8. Click on the Little red ball in Trillian
> 9. Choose 'Check Yahoo Mail'
>
> Now a browser window should open up with your yahoo email account open.
> If you are quick enough you will see that the browser opens a local html
> file before transfering to the yahoo account. This is the file you are
> looking for.
>
> It is created under the default user directory. On my system it was
> created in the C:\Program Files\Trillian\users\default\cache directory.
> and has my username/password in plain text in it.
>
> Try it out and let me know if you still have problems duplicating it.
>
> Thanks,
> Suramya
>
>
>
>>HI Suramya,
>>
>>I tried to verify this on 3.0 b121 too, but I cannot duplicate. The only
>>files I find in the cache directory are png images and some html files
>
> that
>
>>are simply links to the yahoo SSL login page. There must be some other
>>setting that is different from yours than mines. Perhaps we can figure
>
> this
>
>>out together? Going on your word that this vulnerability exists, I'm
>>thinking the conditions to replicate it are more specific.
>>
>>Sincerely,
>>-Bond Masuda
>>Security Consultant, CISSP
>>-------------------------------------
>>JL Bond Consulting / www.JLBond.com
>>Tel: 619.890.7360
>>Email: bond.masuda@JLBond.com
>>
>
>
>


--
----------------------------------------------------------
Some days you're the dog; some days you're the hydrant.
----------------------------------------------------------
Name : Suramya Tomar
Homepage URL: http://www.suramya.com
-------------------------------------------------

************************************************** **********
Disclaimer:
Any errors in spelling, tact, or fact are transmission errors.
************************************************** **********

[Keith Phillips]

The issue arises when you click the link to your Yahoo mail under "My
Mail Accounts". This creates an html file in the directory discussed
below which contains user name and clear text password.

KP=20

-----Original Message-----
From: security curmudgeon [mailto:jericho@attrition.org]=20
Sent: Tuesday, August 02, 2005 3:51 AM
To: bugtraq@securityfocus.com
Cc: Suramya Tomar
Subject: Re: Trillian Ver 3.1 saves password's in plain Text


Hi Suramya,

: I was playing around with Trillian Pro 3.1 Build 121 and noticed a
very
: disturbing behavior when using it to check my yahoo mail.
:=20
: When you choose the option to check your yahoo email from Trillian
(The
: little connection ball -> Check Yahoo Mail) it creates a temp file in
: the <Install Directory>\users\default\cache with a random name that
: contains the yahoo password in *clear text* and this file is world
: readable. This would be somewhat ok if the file was deleted as soon as
: the login was done but the file just sits there till you exit out of
: trillian. Logging out doesn't erase the file. I have watched the file
: exist on my system for over two weeks.
:=20
: I have duplicated this with Trillian 3.0 Basic and Pro also. Tested on
: Windows XP Pro and Windows 2000.

I have Trillian Pro 3.1 Build 121 on Windows XP and can't duplicate this
behavior. I have a YIM, ICQ, AIM and several Jabber accounts. My cache
directory has several files in it; buddy type icon files for various
AIM/YIM users, graphics for plugins, etc. In fact, every single file in
there is JPEG, GIF or PNG.

Doing a case insensitive grep through all the files, I can't find any
trace of any of my passwords in any file in this directory. All of the
files are dated 08/01/2005 shortly after I started Trillian up after
returning from out of town.

Could this occur the first time you set up a specific protocol/account,
and that cache file is erased upon Trillian restart? If so, that would
still be an issue, although considerably less severe. If not that, is
there anything else being done differently here?

: I have attempted to contact Cerulean Studios multiple times before
: releasing this using their webform, email and forums over the past
month
: but havn't heard anything back from them. My last attempt to contact
: them was on 06/13/2005. Since I havn't heard anything from them I am
: sending this to Bugtraq.

Before 3.x (i think), Trillian had a way to submit bugs/feedback from
within the program, and all of my reports were responded to within 24
hours. Since 3.x I believe that feature is gone. Doesn't help you, just
a side comment =3D) Would be nice to see Cerulean bring this back.

[Darren Pilgrim]

From: security curmudgeon [mailto:jericho@attrition.org]=20
> : I was playing around with Trillian Pro 3.1 Build 121 and noticed
> : a very disturbing behavior when using it to check my yahoo mail.
> :=20
> : When you choose the option to check your yahoo email from
> : Trillian (The little connection ball -> Check Yahoo Mail) it
> : creates a temp file in the <Install
> : Directory>\users\default\cache with a random name that contains
> : the yahoo password in *clear text* and this file is world=20
> : readable. This would be somewhat ok if the file was deleted as
> : soon as the login was done but the file just sits there till you
> : exit out of trillian. Logging out doesn't erase the file. I have
> : watched the file exist on my system for over two weeks.
> :=20
> : I have duplicated this with Trillian 3.0 Basic and Pro also.
> : Tested on Windows XP Pro and Windows 2000.
>=20
> I have Trillian Pro 3.1 Build 121 on Windows XP and can't
> duplicate this behavior.

Did you use the "Check Yahoo! Mail..." function?

I'm running v3.1 Basic, Build 121, running on Windows XP Pro SP2. When
I started Trillian, there were just image files in the cache directory
as you describe. When I used the "Check Yahoo! Mail" function as
described by the OP, an HTML file was created in the cache folder. The
contents of the file is a form containing, among other information,
these lines:

username=3D'<my Yahoo! username in plaintext>';
password=3D'<my Yahoo! password in plaintext>';

The filename used is insufficiently random to provide any real benefit.
The file names used (in order used) were:

sfd27.html
sfd67.html
sfd96.html
sfd82.html
sfd36.html
sfd3.html

I also checked this behavior with MSN and AIM:

With the "Check Hotmail..." function, a temporary HTML form file is also
created but the Passport login uses a hash-based authentication
mechanism. The temp file is similarly long-lived, but the hash is
different each time a new temp file is created.

AIM's "Check AOL Mail" function didn't result in the creation of a temp
file like those used for Yahoo! and MSN. I don't have an AOL mail
account and that may have been a factor.

I do agree that the temp files are poor implementation. There's no
reason to store such single-use information on disk. But then I suppose
this is fairly moot, since all of the passwords are stored as a
reversible hash in static files in the user's directory.

[Technica Forensis]

Forwarded description of this over to Cerulean - got this reply within hour=
s:


From Scott Werndorfer Wed Aug 3 06:31:04 2005=20
Return-Path: <smw@ceruleanstudios.com>=20
Date: Wed, 3 Aug 2005 08:31:04 -0500 (CDT)=20
From: "Scott Werndorfer" <smw@ceruleanstudios.com> Add to Address Book=20
Subject: Re: TRILLIANSUGGESTION: passwords in cache=20
=20

I'll jot this down for the next release. Thanks!

- Scott

[Technica Forensis]

> I have Trillian Pro 3.1 Build 121 on Windows XP and can't duplicate this

I can, with that exact same build. My system is never shutdown so
Trillian is always on. There are files in there that are several
weeks old that contain my yahoo! username and password. The files are
all named /sfd\d\d\.html/ and contain the lines:
<html>
<head>
<script>
<!-- var username; username=3D'########'; var password;
password=3D'########'; function submit () {
document.getElementById('login').value=3Dusername;
document.getElementById('passwd').value=3Dpassword ;
document.getElementById('login_form').submit(); }; //--> </script>
</head> <body onLoad=3D'submit();'> <form method=3Dpost
action=3D"https://login.yahoo.com/config/login"
and so on, and so on...

It's seems to me this file should be deleted as soon as the connection
is made instead of on exit. Definately something that needs to be
fixed.

[patrick]

Keith Phillips wrote:

>The issue arises when you click the link to your Yahoo mail under "My
>Mail Accounts". This creates an html file in the directory discussed
>below which contains user name and clear text password.
>
>KP
>
>-----Original Message-----
>From: security curmudgeon [mailto:jericho@attrition.org]
>Sent: Tuesday, August 02, 2005 3:51 AM
>To: bugtraq@securityfocus.com
>Cc: Suramya Tomar
>Subject: Re: Trillian Ver 3.1 saves password's in plain Text
>
>
>Hi Suramya,
>
>: I was playing around with Trillian Pro 3.1 Build 121 and noticed a
>very
>: disturbing behavior when using it to check my yahoo mail.
>:
>: When you choose the option to check your yahoo email from Trillian
>(The
>: little connection ball -> Check Yahoo Mail) it creates a temp file in
>: the <Install Directory>\users\default\cache with a random name that
>: contains the yahoo password in *clear text* and this file is world
>: readable. This would be somewhat ok if the file was deleted as soon as
>: the login was done but the file just sits there till you exit out of
>: trillian. Logging out doesn't erase the file. I have watched the file
>: exist on my system for over two weeks.
>:
>: I have duplicated this with Trillian 3.0 Basic and Pro also. Tested on
>: Windows XP Pro and Windows 2000.
>
>I have Trillian Pro 3.1 Build 121 on Windows XP and can't duplicate this
>behavior. I have a YIM, ICQ, AIM and several Jabber accounts. My cache
>directory has several files in it; buddy type icon files for various
>AIM/YIM users, graphics for plugins, etc. In fact, every single file in
>there is JPEG, GIF or PNG.
>
>Doing a case insensitive grep through all the files, I can't find any
>trace of any of my passwords in any file in this directory. All of the
>files are dated 08/01/2005 shortly after I started Trillian up after
>returning from out of town.
>
>Could this occur the first time you set up a specific protocol/account,
>and that cache file is erased upon Trillian restart? If so, that would
>still be an issue, although considerably less severe. If not that, is
>there anything else being done differently here?
>
>: I have attempted to contact Cerulean Studios multiple times before
>: releasing this using their webform, email and forums over the past
>month
>: but havn't heard anything back from them. My last attempt to contact
>: them was on 06/13/2005. Since I havn't heard anything from them I am
>: sending this to Bugtraq.
>
>Before 3.x (i think), Trillian had a way to submit bugs/feedback from
>within the program, and all of my reports were responded to within 24
>hours. Since 3.x I believe that feature is gone. Doesn't help you, just
>a side comment =) Would be nice to see Cerulean bring this back.
>
>
>
>
I'd just like to add that, while it may not be relevant, but Gaim does
the same thing (in Window$). It stores the passwords in plain text, in
the User accounts directory (ie. c:\documents and settings\user123).
More on that here. <http://gaim.sourceforge.net/plaintextpasswords.php>

--
Patrick M.
/* EOF */

[Suramya Tomar]

Hi Patrick,

> I'd just like to add that, while it may not be relevant, but Gaim does
> the same thing (in Window$). It stores the passwords in plain text, in
> the User accounts directory (ie. c:\documents and settings\user123).
> More on that here. <http://gaim.sourceforge.net/plaintextpasswords.php>

I agree with you that gaim stores the password in plain text also but
there are following differences that make gaim more secure than Trillian:

* Gaim by default doesn't save any password's, you have to tell it to
save it. Trillian on the other hand saves the all password's without any
prompting at all. (These include the AOL/Yahoo/MSN passwords)

* Trillian stores the password in the <Install
Directory>/users/default/cache directory which is a world readable
directory. gaim on the other hand stores it in c:\documents and
settings\<Username>\Application Data\.gaim which is only readable by
<username>. This somewhat limits the potential damage in gaim. (Not
completely, but a little bit)

* The gaim developers actually tell people about this and warn the users
about the potential dangers of saving the password's. Trillian on the
other hand doesn't say a word about this on their site (I looked)

* You can disable the saving of password's in gaim. You can't disable
trillian from creating the file with the password unless you stop using
the check email function.

Thanks,
Suramya


----------------------------------------------------------
Name : Suramya Tomar
Homepage URL: http://www.suramya.com
-------------------------------------------------

************************************************** **********
Disclaimer:
Any errors in spelling, tact, or fact are transmission errors.
************************************************** **********