Re: Google Talk cleartext credentials in process memory

[Jaroslaw Sajko <sloik () parareal net>]

pagvac wrote:
> Jaroslaw,
>
> thanks for your post. You're right, the same issue occurs in *many*
> applications. However, any vendor that is serious about security will
> at least attempt to obfuscate the credentials in memory (IMHO).

Thanks for your post too. I think you're right that obfuscation can help
in some cases. Sometimes the plaintext credentials goes to the Microsoft
as the part of the crash report. Then if the cerdentials are obfuscated,
in a correct way, we can prevent Microsoft from collecting our
credentials. To prevent an attacker from reading credentialas from
process memory dump we need more complicated mechanism (the dump
contains all data & code). Therefore cost of implementing the correct
obfuscation might be uncomparable with the risk of the credential lost
in such manner. That's why I think the obfuscation isn't necessary. But
this is of course only my opinion:]

> I published the advisory to let the public know that Google fixed this
> problem, that's all.

You're right and we're thankful for this. Better if the user knows how
the application deals with his credentials.

> However I respect your opinion and appreciate your post.

As I respect your :]

regards,
js
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/