353122 - Password stored in clear text in Memory

Status: RESOLVED DUPLICATE of bug 298539

(Thunderbird :: Security, defect)

Description

[Nikhil]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7

I am using latest version of ThunderBird (version 1.5.0.7 (20060909)). If I dump the memory (using tools like pmdump or userdump) & extract cleartext out of it, I still get to see my gmail, yahoo & hotmail passwords clearly (in clear text)

REFERENCE : Bug ID 286703

Reproducible: Always

Steps to Reproduce:
1.Dump the memory contents using tool "pmdump" or Microsoft "userdump"
2.Open this dump file in Hex viewers like "WinHex"
3.Search for your password & you will see it in the WinHex in cleartext

Actual Results:  
1. Open ThunderBird & access all your accounts atleast once by providing corresponding password.
2. Open command prompt where PMDUMP is stored & type there : "pmdump -list" to find pid of Thunderbird
3. Then type "pmdump <pid of thunderbird> <filename to dump>"
4. Open WinHex & open the dump file created by above step.
5. Search for your password.

Expected Results:  
You get to see all passwords in clear Text !!

This software should encrypt the stored password using a proprietary encryption algorithm or atleast should store the password using encryption algorithms like DES or SHA or MD5crypt.

Comment 1

[timeless]

edit>preferences or tools>options
privacy>passwords
view saved password

why waste time using a hex dump?

if you don't like this. click that other buttom "set master password"

Comment 2

[Nikhil]

I am not saving any password in my Thunderbird Password Manager. Everytime I open my ThunderBird it asks for password which is temporarily stored in memory (RAM) until I close my ThunderBird. I am talking about this password.

Comment 3

[timeless]

this is pointless. passwords are strings, we don't know that they're passwords, there's no provision in our js world to magically destroy these things.

if your computer has an untrusted process, it can just as easily install a keylogger, or js event listener, or dump memory before we get around to whiping it out. don't get your system infected. 

if you really care, buy a pkcs system where the pkcs system lives on a physical token, and configure thunderbird to use it, then you'll *never* send a password to your computer, just a challenge/response.

lastly, this is a duplicate

Comment 4

[Nikhil]

(In reply to comment #3)
> this is pointless. passwords are strings, we don't know that they're passwords,
> there's no provision in our js world to magically destroy these things.

 You are absolutely true that passwords are just strings, but why to store them in plain text? Can't we encrypt those strings? Does your JS world have this facility to encrypt the temporarily saved passwords? Surely it has!! Moreover it isn't neccesary to encrypt the password using JS!! Use of encryption algorithms like DES, SHA or MD5 or even your proprietary encryption algorithm will also do.  By encrypting the passwords, we are trying to make the password stealer's life more hard inorder to crack it, instead of displaying it in just plain text !!

  Moreover, majority of passwords are understandable & are legitimate words. Hence a experienced cracker (which generally is the case) can easily find the odd man out & could learn your password.

> 
> if your computer has an untrusted process, it can just as easily install a
> keylogger, or js event listener, or dump memory before we get around to whiping
> it out. don't get your system infected. 

   Sir Keyloggers are a totally different concept. What I actually meant is that, if a machine using ThunderBird gets compromised & the attacker/hacker gets a command shell, then by just dumping the memory & extracting ASCII characters out of the dump, he/she could easily learn the password since they are displayed in plain text !!!
> 
> if you really care, buy a pkcs system where the pkcs system lives on a physical
> token, and configure thunderbird to use it, then you'll *never* send a password
> to your computer, just a challenge/response.

  Even this solution would have worked sir, but isn't it reasonable to just encrypt the password stored in the memory (just like Yahoo & GMail does) instead of buying a pkcs system. This could be benificial for everyone using ThunderBird as their EMail client. Otherwise just to use ThunderBird it would become mandatory to buy the pkcs system, which is not at all justifyable!! I hope you got my point.

> 
> lastly, this is a duplicate

  100% Sir, this is a duplicate, but someone had posted it for ThunderBird just in Linux. I have reposted it since this problem is not solved as yet which is against Bugzilla's claim "Resolved" !!
> 

Comment 5

[Gonzalo HIGUERA DÍAZ]

Can I ask what reasonable alternatives are there to not storing the password in memory in clear text?

If the passwords are encrypted in memory, for most authentication schemes they somehow have to be decrypted each time a new access to the server is performed. If so, the encryption key must be kept somewhere: in memory (contrary to this bug report), on disk (which seems equally problematic) or elsewhere (where and to what advantage?).

It therefore seems to me that unless one wants to be prompted for the password each time there is a new access to the server, this bug cannot be addressed. As far as I can see, the most that can be done is secure the way that sensitive information is stored in memory (making it stale after some time, erasing it securely, avoiding swapping to disk, etc.).

Comment 6

[Nikhil]

As far as I know, Microsoft Outlook 2003 and 2007 doesn't store password in clear text in Memory. If somehow (due to some vulnerability in some service or due to weak computer (PC) password), you machine got hacked remotely, then the hacker can  go ahead and compromise our Email accounts too due to this vulnerability. 

See, I understand its difficult to achieve 100% password security, but at-least we can make it difficult for the hacker to get hold of our Email passwords easily by encrypting them. Moreover dumping Memory contents doesn't require high level of skills. Sophisticated tools like WinHex can dump memory within few clicks, which even a layman can do, so can the hacker.

We can even take example of GMAIL, which stores password in memory in encrypted format. So if we access GMAIL emails through ThunderBird, and this vulnerability exists, then users will think, why to not go for Web-based email access rather than using through ThunderBird, since its (Web-based access) more secured than ThunderBird?

This is just an example, and not comparison. 

Comment 7

[Sorin Adrian Savu]

One option I can see here is add a "do not cache my passwords at all" (or something similar) default off (just to put overly zealous security consultants at ease)

> See, I understand its difficult to achieve 100% password security, but at-least
> we can make it difficult for the hacker to get hold of our Email passwords
> easily by encrypting them. Moreover dumping Memory contents doesn't require
> high level of skills. Sophisticated tools like WinHex can dump memory within
> few clicks, which even a layman can do, so can the hacker.

A small correction here, it's not difficult, it's impossible.There are many other ways you can get a hold of a password.May I say that this one you are suggesting is not the most creative or efficient, as it requires the hacker/cracker to have at least one of your passwords there to begin searching or relies on choosing weak and obvious passwords. Real hackers, that have already compromised your machine, would chose a different path (like using a scalpel instead of chainsaw), a sniffer on pop3/imap protocol, patching the executable to log the password before authenticating to a server via a secure protocol, etc. 

> We can even take example of GMAIL, which stores password in memory in encrypted
> format. So if we access GMAIL emails through ThunderBird, and this
> vulnerability exists, then users will think, why to not go for Web-based email
> access rather than using through ThunderBird, since its (Web-based access) more
> secured than ThunderBird?
> 
Yet another correction is needed here. I believe GMAIL is storing a one way encrypted password, and that is because they own both ends of the protocol and can do that. I haven't analyzed the hash, but I believe that getting a hold on that hash has the same security implications as getting a hold on the password (except if you don't follow the security  101 rules, and have the same password as your vault code). The web interface is not more secure, just different. 

> 100% Sir, this is a duplicate, but someone had posted it for ThunderBird just
> in Linux. I have reposted it since this problem is not solved as yet which is
> against Bugzilla's claim "Resolved" !!

This kind of behavior makes it difficult for the developers to track the bugs and work out the best solution for the issue, if it's a issue. 


As pointed out in the other bug, there are far more important security issues that need to be addressed when a hacker has access to your machine, than the fact that tbird has your clear text passwords in memory. 

my 2 cents

Comment 8

[Brett Leber]

Seems to be a duplicate of 298539.

Comment 9

[Ludovic Hirlimann [:Usul]]

(In reply to comment #8)
> Seems to be a duplicate of 298539.

Indeed.

Comment 10

[[:Aureliano Buendía]]

Cleanup *dupeme* whiteboard flag from bugs that are marked as Resolved Duplicate!