Onderwerp: Google Talk cleartext proxy credentials vulnerability

Title: Google Talk cleartext proxy credentials vulnerability
Risk: Low/Medium
Versions affected: <= 1.0.0.72
Credits: pagvac (Adrian Pastor)
Date found: 12th Oct, 2005
Homepage: www.ikwt.com (In Knowledge We Trust)
www.adrianpv.com
E-mail: m123303 [ - a t - ] richmond.ac.uk


[Background]

Google Talk is a messenger client for Windows based on Jabber and can be downloaded from http://www.google.com/talk/



[Vulnerability Description]

Google Talk seems to do a good job at storing the gmail login credentials in the Registry. These are the
credentials needed to establish a connection to talk.google.com and are located under

HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts\[username]@gmail.com\pw

In this case the password seems to be encrypted (or at least obsfucated). It should also be noted that Google Talk
stores the user settings under the correct hive (HKEY_CURRENT_USER rather than HKEY_LOCAL_MACHINE).
That way only the currently logged user will have access to his/her Google Talk settings.

*However*, the developers behind Google Talk seem to have forgotten to use any mechanism of encryption/obsfucation
when it comes to saving the credentials for the proxy connection. In this case, all user credentials (username
and password) are stored as *cleartext* (human readable) in the Windows Registry.

Such credentials are located under

HKEY_CURRENT_USER\Software\Google\Google Talk\Options\auth_user
HKEY_CURRENT_USER\Software\Google\Google Talk\Options\auth_pass



[Feasibility of exploitation]

In order to exploit this vulnerability 3 requirements must be met:

1. The victim connects through a proxy when using Google Talk
2. Such proxy requires login credentials (username/password)
3. The attacker has compromised the account of the victim user
(see PoC exploit for an example)



[Solution]

Do not use Google Talk behind a proxy which requires authentication
or wait until vendor releases a patched version.



[PoC]
Advisory along with fully working PoC exploit code available at www.ikwt.com



Regards,

pagvac (Adrian Pastor)
Earth, SOLAR SYSTEM

[EOF]

Dear m123303@richmond.ac.uk,

Again and again. HKEY_CURENT_USER is accessible for user only. If one
can access user's account he can recover _any_ stored password, because
he can do everything user can.

The only additional reason, storing password in registry is not good, is
password can be easily recovered by someone with physical access to hard
drive. It's only attack vector comparing with different password store,
for example protected storage.

--Friday, October 14, 2005, 3:06:55 PM, you wrote to bugtraq@securityfocu=
s.com:

mrau> talk.google.com and are located under

mrau> HKEY_CURRENT_USER\Software\Google\Google
mrau> Talk\Accounts\[username]@gmail.com\pw



--=20
~/ZARAZA
=C8=F2=E0=EA, =FF =E1=F3=E4=F3 =EA=F0=E0=F2=EE=EA. (=D2=E2=E5=ED)