Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Full-disclosure] Putty Proxy login/password discolsure....

from [mflaschen3] Network Security [Permanent Link]
Subject: Re: [Full-disclosure] Putty Proxy login/password discolsure....
Date: Wed, 25 Oct 2006 10:24:11 -0400 
Windows offers no security against local users.  It is trivial to boot to a
program like ERD Commander and replace admin passwords.  On the other hand,
PuTTy is meant to protect against everyone; that's why it doesn't allow saved
passwords.  Thus, this seems like a vulnerability to me.

Matt Flaschen

Quoting "Dave \"No, not that one\" Korn" <davek_throwaway@hotmail.com>:


"Antoine SANTO" <Antoine.SANTO@maaf.fr> wrote in message
021001c6f822$94e12f40$595ce60a@maafprod.ecorail.com">news:021001c6f822$94e12f40$595ce60a@maafprod.ecorail.com...


Hi,

I come to report a little strange discolsure discovered by my
co-worker Fx0day.

When you save session informations under putty and you need proxy
for a session,
We can find in plain clear text the login and password proxy auth in
the windows
database register.

Strange to see a good ssh client storing plain clear text « hot »
informations !!


   The HKCU key is protected by an ACL; it is only accessible to the
 user, or to someone with admin rights.  So it's not best practice,
 agreed, but it isn't a major vulnerability.


     cheers,
       DaveK
--
Can't think of a witty .sigline today....









_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: [Full-disclosure] RE : Putty Proxy login/password discolsure....(Answer from PUTTY Staff), Matthew Flaschen
Next by Date:  [Full-disclosure] Cisco Security Advisory: Cisco Security Agent for Linux Port Scan Denial of Service, Cisco Systems Product Security Incident Response Team
Previous by Thread:  Re: [Full-disclosure] RE : Putty Proxy login/password discolsure....(Answer from PUTTY Staff), Simon Tatham
Next by Thread:  Re: [Full-disclosure] Putty Proxy login/password discolsure...., Paul Schmehl
Indexes:  [Date] [Thread] [Top] [All Lists]