Flaw in Trillian Security

13,719
United States
Indiana
ViperManiac
It is possible to retrieve MSN/Yahoo/AIM usernames & passwords from the popular 'all-in-one' messenger software Trillian, to gain access to their account.

For each service the software connects to (MSN, Yahoo, AIM), Trillian creates a simple .ini file, for example msn.ini. In these files are details Trillian needs to connect to the service, including the password - in encrypted format.

Although the password is encrypted, the encryption is not machine-specific. In other words, just copy the appropriate .ini file into another Trillian system, and hey-presto, you've got access to the victim's account.
 
Ok... so have you tried this? Many appear to work that way, but sometimes those ini files just relate back to the original program and access their databank.

If what you say is really correct, contact the makers of the software and let them know...
 
Ok... so have you tried this? Many appear to work that way, but sometimes those ini files just relate back to the original program and access their databank.

If what you say is really correct, contact the makers of the software and let them know...
 
Originally posted by F2002
I only stopped using it, because a simple scroll over an ICQ nickname would give you their IP...

What's the big deal with that? Using it doesn't give out your IP address, someone else using it does. You can still dissable it in your preferances and anyone using the Mirabilis ICQ client still won't be able to see your IP.

~LoudMusic
 
Originally posted by viper_maniac
It is possible to retrieve MSN/Yahoo/AIM usernames & passwords from the popular 'all-in-one' messenger software Trillian, to gain access to their account.

For each service the software connects to (MSN, Yahoo, AIM), Trillian creates a simple .ini file, for example msn.ini. In these files are details Trillian needs to connect to the service, including the password - in encrypted format.

Although the password is encrypted, the encryption is not machine-specific. In other words, just copy the appropriate .ini file into another Trillian system, and hey-presto, you've got access to the victim's account.

A lot of programs are like that (as Deathhawk pointed out). That information has to be stored somewhere though. Sometimes it's in the registry, sometimes in an ini file, and sometimes the excecutable is rewritten with the password in it. Anywhere you put it, it's transferable ... unless it is encrypted machine spacific. An easy way to do that is to use something about the computer as a piece of the algorythm ... like the MAC address of the network card. Those are all spacific ... yet they can be spoofed.

Now lets get to the real importance of this. What are you doing letting people get to files on your computer? Secure your computer, then you don't have to worry about people coping an ini from it. I even lock my workstation when I'm not using it. The only other people to ever sit in my chair are members of my own family.

~LoudMusic
 
Originally posted by LoudMusic


A lot of programs are like that (as Deathhawk pointed out). That information has to be stored somewhere though. Sometimes it's in the registry, sometimes in an ini file, and sometimes the excecutable is rewritten with the password in it. Anywhere you put it, it's transferable ... unless it is encrypted machine spacific. An easy way to do that is to use something about the computer as a piece of the algorythm ... like the MAC address of the network card. Those are all spacific ... yet they can be spoofed.

Now lets get to the real importance of this. What are you doing letting people get to files on your computer? Secure your computer, then you don't have to worry about people coping an ini from it. I even lock my workstation when I'm not using it. The only other people to ever sit in my chair are members of my own family.

~LoudMusic

Well in terms of workstation and network security, it's now the bum-on-seat intrusion that is the most pressing. I'm pushing hard to have divulgence of username/password combinations made into a disciplinary offence at my company, but a lot of the directors (who themselves give their details to their PAs :mad: ) don't get the issue. So, then they look surprised when we tell them that a 36 year old woman they know to be on maternity leave yesterday downloaded 40Mb of teen porn, and they look all surprised! They don't understand that it's the temp, who has been given the woman's password. These people want internet access derestricted!

Oh, it gets me so mad. If I see a username/password combo written down at/near someone's desk, I rip it up, and deposit it in at least two different bins. I flipped through a girl's rolodex once and found the usernames and passwords for four directors written along with their contact details. I reported her and got no support, so I set all the accounts to "User must change password at next logon".

In our company we spend far longer protecting the network from the damn-fool actions of cretinous users than we do from the malcious attacks of internet-based n'er'dowells.
 
Originally posted by GilesGuthrie


Well in terms of workstation and network security, it's now the bum-on-seat intrusion that is the most pressing. I'm pushing hard to have divulgence of username/password combinations made into a disciplinary offence at my company, but a lot of the directors (who themselves give their details to their PAs :mad: ) don't get the issue. So, then they look surprised when we tell them that a 36 year old woman they know to be on maternity leave yesterday downloaded 40Mb of teen porn, and they look all surprised! They don't understand that it's the temp, who has been given the woman's password. These people want internet access derestricted!

Oh, it gets me so mad. If I see a username/password combo written down at/near someone's desk, I rip it up, and deposit it in at least two different bins. I flipped through a girl's rolodex once and found the usernames and passwords for four directors written along with their contact details. I reported her and got no support, so I set all the accounts to "User must change password at next logon".

In our company we spend far longer protecting the network from the damn-fool actions of cretinous users than we do from the malcious attacks of internet-based n'er'dowells.

I hate our jobs. There is nothing more to say ...

~LoudMusic
 
Originally posted by GilesGuthrie


I'm trying to get as far away from dealing with users as possible!

My job revolves around the users. Oddly enough, I have received no phone calls or emails this morning. I think, after 3 years, I've got them pretty well whipped into shape.

I'm going to lunch, back in an hour or so (:

~LoudMusic
 
Originally posted by LoudMusic


My job revolves around the users. Oddly enough, I have received no phone calls or emails this morning. I think, after 3 years, I've got them pretty well whipped into shape.

I'm going to lunch, back in an hour or so (:

~LoudMusic

Heh heh! You're doing well then. I used to work in support, and I had a good relationship with the users. Now I work in Projects, which is more 3rd line stuff, and it's a total nightmare. The people in Support are grumpy muppets being poorly managed, and so the users are coming to us for help. We politely tell them that it's not for us to help them, but the manager of the whole IT department is so ineffectual that he want sus to fix everything just to get a result, and as a result of that all our projects are delayed. In spite of the fact that our projects will, when implemented, resolve a lot of the issues! :mad:

Still, that's the end of the day. My field engineer has rebuilt the server and it's running again, so, 1.5hrs late, I'm leaving.

You'll probably see me back on my home pc in about 2hrs though!

Enjoy your lunch!
G
 
Originally posted by GilesGuthrie


Heh heh! You're doing well then. I used to work in support, and I had a good relationship with the users. Now I work in Projects, which is more 3rd line stuff, and it's a total nightmare. The people in Support are grumpy muppets being poorly managed, and so the users are coming to us for help. We politely tell them that it's not for us to help them, but the manager of the whole IT department is so ineffectual that he want sus to fix everything just to get a result, and as a result of that all our projects are delayed. In spite of the fact that our projects will, when implemented, resolve a lot of the issues! :mad:

Still, that's the end of the day. My field engineer has rebuilt the server and it's running again, so, 1.5hrs late, I'm leaving.

You'll probably see me back on my home pc in about 2hrs though!

Enjoy your lunch!
G

That sounds pretty familiar. I'm actually "The buck stops here" at my company. 'If it's more complicated than a toaster and it plugs into the wall, it's my business' - I need to get that put on my business cards. Support consumes the majority of my time, mostly because the projects I can finish in a couple days and there aren't a whole lot of those.

A few of my friends have worked together at a couple different large organizations. They say the same things ... the support department is lazy and nearly half the support requests get escalated with little intervention. One guy, a senior level engineer (and I don't use that term loosely), is such a nice guy that he'll stop in the middle of a massive server project to help a little old lady configure her Outlook Express client.

I wonder how long it took the automotive industry to fix these kinds of management/organizational problems. I'd kind of like to put together a "Geeks' request for proper management" website where we can all come together and build a set of guidelines for our bosses. Sort of form a union (:

~LoudMusic
 
Originally posted by LoudMusic


That sounds pretty familiar. I'm actually "The buck stops here" at my company. 'If it's more complicated than a toaster and it plugs into the wall, it's my business' - I need to get that put on my business cards. Support consumes the majority of my time, mostly because the projects I can finish in a couple days and there aren't a whole lot of those.

A few of my friends have worked together at a couple different large organizations. They say the same things ... the support department is lazy and nearly half the support requests get escalated with little intervention. One guy, a senior level engineer (and I don't use that term loosely), is such a nice guy that he'll stop in the middle of a massive server project to help a little old lady configure her Outlook Express client.

I wonder how long it took the automotive industry to fix these kinds of management/organizational problems. I'd kind of like to put together a "Geeks' request for proper management" website where we can all come together and build a set of guidelines for our bosses. Sort of form a union (:

~LoudMusic

Definitely on the Union thing!

To give you an idea of the projects: I am one of a team of three Project Analysts for a company with 1800 employees spread over 78 sites, of which 76 are in the UK. We currenly run a Novell File/Print system with Novell GroupWise e-mail, and Office 97 running on 9x desktops. We have the following projects underway:
Replace GroupWise with Exchange 2000
Replace Novell with Windows 2000/Active Directory
Delete thick client applications and deliver all apps over Citrix Metaframe
Upgrade to Office 2000
Remove Novell BorderManager firewall and replace with hardware/software solution
Replace all antivirus products with new common platform
Build new datacentre to house all the above
Individually inspect traffic on all WAN links with a view to upgrading/installing cacheing systems
Rationalise the 1700-strong printer fleet.
Bring management of company intranet back in-house.
Knock 17 days and £5000 off the installation of document management into new construction projects.
Create and implement new DR strategy.

And all this with no support from above or below!

I love my job.

Actually, the sad thing is I do love my job, it's just that sometimes it makes me :mad: !

G
 
The hardest type of security is keeping people from the inside from making attacks on the system. Take a high-school or College. How would you like to be their MIS/IT Director, or the person in charge of System Security.... Man it hurts just thinking about it. Ghosting seems to be a popular solution to this, as well as locking everything down.. ;) Using ACL's (access controll lists) programmed into the routers can really help too, as well as VLan's in this area, however, ACL's are only as good as the person writing the ACL. :D

I'm pretty fortunate with only 60 employee's that I have to keep happy on the system, however, only 12 of them are on the actual network. None of them are computer literate, so all security issues are from the outside, which let's face it, as long as your connected to the outside world through some kind of WAN link, anyone (with the proper knowlege and skills) can get into your system, no matter how secure it is.

I've setup several firewalls and broken physicals links that arn't necessary and feel confident enough that I can sleep at night.

My point is, I'm thankful that the people on the LAN are trust worthy and don't have enough Computer skills to really mess with me too bad.

Sorry for just poping in with my 2-cents on this off-topic tangent, but I found it interesting... :D

~peace~
 
Pako:

Hey man, pop-ins are always welcome (:

I actually worked on the web team at a local university. The IT department (LAN Nazis) were pretty much clueless, and there were talks of rolling out laptops and wireless networking for freshmen next semester. I bailed out before they started asking ME questions.

GilesGuthrie:

Right on man. I'm not an avid supporter of the Evil Empire, but they sure do have their software headed in the right direction. Windows 2000/XP across the board will make your life a lot simpler. And how in the world do you manage that many printers? That's nearly a printer at every desktop! I've only got about 55 workstations, but our printers handle 5 to 8 users each. That would make a drastic change in your support costs. You have to watch your print queing though, because it can get nasty. A friend of mine has a great story about configuring a network printer on a corporate campus of 5,000+. He watched his print job go through a que to a printer that was just down the hall from him. It took about fifteen minutes for it to print. Then he walked over to the printer and had it print its configuration. He reconfigured his printer to print directly to the IP of the printer. Now his print jobs take less than 30 seconds (:

If there is anyone more evil than Microsoft, it would be Novell. Choose the lesser of the two evils.


A side note - network security, deny all, allow http and pop3. End of discussion. Everything else will only cause you headaches. That's where most universities are headed, due to peer to peer sharing software.

~LoudMusic
 
With ACL's, Deny Any is Implied at the end of your statement.

You would write a ACL to permit like such:

Student Filter:

Code:
router# access-list 1 permit 172.16.47.0 0.0.0.255
router# access-list 1 deny any
router# config t
router(config)# int e0
router(config-if)# ip access-group 1 out

WAN Filter:

Code:
router# access-list 101 permit tcp any any eq http
router# access-list 101 permit tcp any any eq smtp
router# access-list 101 permit tcp any any eq DNS
router# access-list 101 permit udp any any eq DNS
router# access-list 101 deny tcp any any
router# access-list 101 deny udp any any
router# access-list 101 deny ip any any
router# config t
router(config)# int s0
router(config-if)# ip access-group 101 in

When using extended ACL's you can even specify which direction you would like to filter.

Well, time to go home....

~later~
 
Originally posted by Pako
With ACL's, Deny Any is Implied at the end of your statement.

You would write a ACL to permit like such:

Student Filter:

Code:
router# access-list 1 permit 172.16.47.0 0.0.0.255
router# access-list 1 deny any
router# config t
router(config)# int e0
router(config-if)# ip access-group 1 out

WAN Filter:

Code:
router# access-list 101 permit tcp any any eq http
router# access-list 101 permit tcp any any eq smtp
router# access-list 101 permit tcp any any eq DNS
router# access-list 101 permit udp any any eq DNS
router# access-list 101 deny tcp any any
router# access-list 101 deny udp any any
router# access-list 101 deny ip any any
router# config t
router(config)# int s0
router(config-if)# ip access-group 101 in

When using extended ACL's you can even specify which direction you would like to filter.

Well, time to go home....

~later~

I've got my firewall set to block all incoming, and all outgoing except web and mail. It's the big "screw off, we don't want to talk to you" sign (:

~LoudMusic
 
Whew, I'm glad I just manage my small bussines's local small network! I still am trying to get linux servers intregrated into my Win2k network efficienlty.

The onlything I let it is port 80, and email. everything is walled down by both a harware router/firewall and BlackICE software firewalls.

And since my guys can fix their own problems usually it is quite simple...

That is untill I have to go on tech support for the extended family....
 
Originally posted by LoudMusic


I feel your pain ...

~LoudMusic

Mmm. Me too. This is why I have PC Duo installed on my Dad's PC. I can dial into it and control it! MUHAHAHAHAHA
 
Originally posted by LoudMusic
Pako:

Hey man, pop-ins are always welcome (:

I actually worked on the web team at a local university. The IT department (LAN Nazis) were pretty much clueless, and there were talks of rolling out laptops and wireless networking for freshmen next semester. I bailed out before they started asking ME questions.

GilesGuthrie:

Right on man. I'm not an avid supporter of the Evil Empire, but they sure do have their software headed in the right direction. Windows 2000/XP across the board will make your life a lot simpler. And how in the world do you manage that many printers? That's nearly a printer at every desktop! I've only got about 55 workstations, but our printers handle 5 to 8 users each. That would make a drastic change in your support costs. You have to watch your print queing though, because it can get nasty. A friend of mine has a great story about configuring a network printer on a corporate campus of 5,000+. He watched his print job go through a que to a printer that was just down the hall from him. It took about fifteen minutes for it to print. Then he walked over to the printer and had it print its configuration. He reconfigured his printer to print directly to the IP of the printer. Now his print jobs take less than 30 seconds (:

If there is anyone more evil than Microsoft, it would be Novell. Choose the lesser of the two evils.


A side note - network security, deny all, allow http and pop3. End of discussion. Everything else will only cause you headaches. That's where most universities are headed, due to peer to peer sharing software.

~LoudMusic

~LoudMusic:
The problem we have is a cumbersome procurement system, so people go down to PC World and buy themselves a little natty deskjet. If they're being really considerate, they'll choose an HP one! It all comes down to management not understanding the TCO issue. You tell them that they can throw out their working printer, spend a grand on a new one, and in three years they'll be in profit, and you get the rabbit-in-headlights stare. Also, we're a lot of small offices, and so it's not well received when we try to make someone walk down a corridor to get a print. It's tragic, I know. I like to walk down the corridor to get a print, but that's probably more to do with the pretty girl sitting next to the printer!

On MS v Novell - I understand what Novell are trying to do, but MS are so far ahead of them it's scary. OK, so you need big boxes to run MS software, but when you can get a twin PIII/1000 with 2GB RAM and 3x18GB disks for £3k, who really cares?

On the printing side, we use JetDirect, and it rocks, especially with WebJetAdmin, which I only discovered last week!

Pako:
Hiya, you're welcome to join in!

We're going to be setting up the internal WAN routers to only allow ICA (Citrix) and Print traffic, so that will help. Externally, it's a bit more complicated since we have C/S apps running over the internet, so our ACL will be a bit more cluttered. But I see what you're saying, and we'll keep it as comprehensive as possible. At the moment, our firewall just sits there calmly whistling as all the attacks come rolling in. It's quite nice!

Deathhawk:
If the family get too much, just point out that they are askingyou to do unpaid overtime, and that, whilst you don't mind helping them, it is work to you. If you're nice and calm when you say it, they should respect your free time a lot more. Worked for me.
 
It's interesting.... I recently just pulled our Novel 4.11 box out of the network. Originally, it was our Print/File server exclusively. Since I came aboard, I've added a NT box which serves all our mission critical apps, using the Novell box for just Print services. About a month ago, I pulled the Novell box and now the NT box is running everything.

Talk about easy management!!! Normally I would say, "MS is a spawn of the devil"....but after setting the entire network in one afternoon, I have a little more (actually a lot more) appreciation for MS's NOS.

GilesGuthrie:

I understand the frustrations of other departments going out and buying "Home Computing" printers. I used to monitor and order all Computer Harware/software/supplies...but over the last year or so I've become too busy to monitor every purchase. Now we HP deskjets of every model series. I have to stock 7 different color cartriges and 5 different black cartriges just for the deskjets. I have, since then, taken back the responsibilities of ordering all hardware/software/supplies for the 11 different locations here. Live and learn, live and learn.

-------------------------------------------------------------------------------

I did mention 11 different locations. What I'm proposing to do in the next 5 months is to setup WAN links over VPN's to network all of our remote sites to my office here which would be VLan'ed to our parent company in St. Paul, MN (which is in a different state). It should be a piece of cake (or pie) except not all the software currently being used is network friendly, so that seems to be my biggest obsticle at this point.

I told them that all I need is a just a few more routers, switches, and a little budget for some Cisco hardware. :D
 
Originally posted by Pako
It's interesting.... I recently just pulled our Novel 4.11 box out of the network. Originally, it was our Print/File server exclusively. Since I came aboard, I've added a NT box which serves all our mission critical apps, using the Novell box for just Print services. About a month ago, I pulled the Novell box and now the NT box is running everything.

Talk about easy management!!! Normally I would say, "MS is a spawn of the devil"....but after setting the entire network in one afternoon, I have a little more (actually a lot more) appreciation for MS's NOS.

It is a lot easier than Novell, principally because of the apparent similarities between the server and desktop operating systems. The support guys in our company aren't very good at coping with the unfamiliar. That said, they do have a pathological fear of NT! :rolleyes:

Only problem with NT as a print server is the Spooler service can die quite often! We're looking at some Linux-based web-managed print servers.

Originally posted by Pako
I understand the frustrations of other departments going out and buying "Home Computing" printers. I used to monitor and order all Computer Harware/software/supplies...but over the last year or so I've become too busy to monitor every purchase. Now we HP deskjets of every model series. I have to stock 7 different color cartriges and 5 different black cartriges just for the deskjets. I have, since then, taken back the responsibilities of ordering all hardware/software/supplies for the 11 different locations here. Live and learn, live and learn.

It's not that, it's that after about 3 days they want to network the b*****d things!!

Originally posted by Pako

I did mention 11 different locations. What I proposing to do in the next 5 months is to setup WAN links over VPN's to network all of our remote sites to my office here which would be VLan'ed to our parent company in St. Paul, MN (which is in a different state). It should be a piece of cake (or pie) except not all the software currently being used is network friendly, so that seems to be my biggest obsticle at this point.

I told them that all I need is a just a few more routers, switches, and a little budget for some Cisco hardware. :D

That's a nice little project for you!
 
I am still waiting for the dual athalon boards to drop in price... I can pick one up here for around $1000US then buy 2 Ghz processors for around 250 each...

However, that is all through a wholesaler :)
 
Back