[Full-disclosure] Filezilla's silent caching of user's credentials

[Ryan Sears <rdsears@xxxxxxx>]

Hi all,

As some of you may or may not be aware, the popular (and IMHO one of the best) 
FTP/SCP program Filezilla caches your credentials for every host you connect 
to, without either warning or ability to change this without editing an XML 
file. There have been quite a few bug and features requests filed, and they all 
get closed or rejected within a week or so. I also posted something in the 
developer forum inquiring about this, and received this response:

"I do not see any harm in storing credentials as long as the rest of your 
system is properly secure as it should be."

Source:(http://forum.filezilla-project.org/viewtopic.php?f=3&t=17932)

To me this is not only concerning, but also completely un-acceptable. The 
passwords all get stored in PLAIN TEXT within your %appdata% directory in an 
XML file. This is particularly dangerous in multi-user environments with local 
profiles, because as we all know physical access to a computer means it's 
elementary at best to acquire information off it. Permissions only work if your 
operating system chooses to respect them, not to mention how simple it is *even 
today* to maliciously get around windows networks using pass-the-hash along 
with network token manipulation techniques.

There has even been a bug filed that draws out great ways to psudo-mitigate 
this using built-in windows API calls, but it doesn't seem to really be going 
anywhere. This really concerns me because a number of my coworkers and friends 
were un-aware of this behavior, and I didn't even know about it until I'd been 
using it for a year or so. All I really want to see is at the very least just 
some warning that Filezilla does this. 

Filezilla bug report:(http://trac.filezilla-project.org/ticket/5530)

My feelings have been said a lot more eloquently than I could ever hope to in 
that bug report:

"Whoever keeps closing this issue and/or dismissing its importance understands 
neither security nor logical argument. I apologize for the slam, but it is 
undeniably true. Making the same mistake over and over does not make it any 
less of a mistake. The fact that a critical deficiency has existed for years 
does not make it any less critical a deficiency. Similarly, the fact that there 
are others (pidgin) who indulge in the same faulty reasoning does not make the 
reasoning any more sound." ~btrower

While it's true you can mitigate this behavior, why should it even be enabled 
by default? The total lapse in security for such a feature-rich, robust piece 
of software is quite disturbing, and I don't understand how the developers 
don't think this is an issue. 

I just wanted to gauge the FD community on this issue, because with enough 
backing and explanation from the security community as to why this is a 
problem, this issue may finally be resolved (it's been doing this for years 
now). 

Regards,
Ryan Sears

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/