Cracking Trillian Passwords

--------------------------------------
DISCLAIMER

Everything found in this tutorial is to be used for educational purposes only and to shed light on the security risks of using trillian as your chat client. I do not advocate the stealing of login information for any purposes whatsoever. If you do something illegal, i accept no responsibility for anything you may damage and hold no accountability for the things you learned. If you do not agree to adhere to the above-mentioned terms, do not read this tutorial.

---------------------------------------

Trillian, a popular multi-network chat client, has been around for quite some time. Unfortunately, the security for it is horrible. I've emailed them once or twice regarding this problem and have not gotten a response from them. I started cracking trillian's password security probably a few months ago and just looked up some stuff on the HD today and found the old project plus my password finding table. Well, i wrote a program in euphoria that helped to speed up the process of cracking trillian. It uses a modified form of sendkeys.ew (email me for a copy).

Some background:
First let's talk a little bit about how trillian encodes passwords. It stores the encrypted form in hex digits (it's in an ini file). From what i've gathered, the only things that are processed are the character and its location. Note that the encoded string is twice as long as your password. By observation, every two encoded digits represent a single character in the password.

Well, now, how do we get at these encrypted passwords? They're stored in the appropriate ini files. The password for a trillian profile is stored in your trillian folder in the file \users\global\profiles.ini. In that file, you are presented with some information about the profiles including their encrypted password, profile name, and other things like autologin. Well, if you want to hijack a trillian account using that computer, all you need to do is simply set the Automatic Login variable to 1. You bypass the login altogether.

Now, if they don't auto-login to anything else, you can tweak the entries in \users\%profile% in the aim.ini, yahoo.ini, and msn.ini. Now, say you didn't want to just access the account from the cheap autologin method, but want to get the password for it. Well, it's frighteningly easy to do.

Steps for cracking:
1) Create a blank account
2) Give it a password of a single character repeated however many times you want
3) Login and then record the encrypted password that's in profiles.ini
4) Exit trillian
5) Reload trillian, enter the old repeated character and click Edit
6) Now, push the Clear button and enter another repeated character for your password
7) Click the save button and type in the repeated character again to verify
8) Repeat steps 3 through 7 until you've collected lists of all the characters you want

Well, that was awful easy wasn't it? A bit time consuming if you don't make a program to help you with it, but still, very easy. So, let's say we wanted to crack a password using this list (i recommend using an editor like PFE or Emacs when doing this because they'll stay in the column they're in as you move down). We'd look at the first two digits in the encoded string and try to match them against the first two digits in one of the above strings. If you find a match, the character to the left of the string is the character that was encoded. Do this with the next two digits of your string and match them against the 3rd and 4th digits of the above strings of digits. Do this until you have processed every pair of digits and you'll have the password.

Wow, that was really easy wasn't it? Kinda scary, huh?

Problems:
Well, poor security is always a problem, but, trillian, being the multi-network chat client that it is, stores passwords for all sorts of other services. Because of this, if a user was using trillian, someone could install a program to leech all of the login information stored in the computer and then relay it back to whoever wanted it. Accounts could be hijacked left and right. That's bad, very bad. So, if you love your privacy then either lock down trillian while you're not using it, or just don't use trillian at all. Trillian can be found at http://www.trillian.cc for anyone that is interested in checking this out for themselves.

All tests were done on Trillian Basic and i am not aware of this vulnerability in Trillian Pro, but it's likely that it exists there as well. If anyone could verify this for me, mail me at [email protected]

[EDIT] Removed the character lists as they really gave no informative value compared to the rest of the article. One could regenerate the list using the steps above, but, after rethinking the post, I feel that generally the pre-made list would never be used by anyone with good intentions and that it was somewhat irresponsible to post it. In the future, i will refrain from writing actual solution tables in the post as they will generally tend more towards misuse than education.[/EDIT]

Well. Interesting tutorial. I am sure I already read the Trillian info somewhere else (and in many different places), but it is always interesting to develop the steps used to reach a target, and it's exactly what you have done.

very informative but unfortunately very un-antionlinistic

hey flamingRain.
thanx! i thought trill was pretty secure, guess not. so do you know of any IM that is more secure?

phsphate, sry, but trillian is the only IM i've tried breaking into. Back when i was first getting into pulling stuff apart on computers and making my own little crypto programs, i wanted to put my skills to the test. I decided trillian would be good because it looked like something easy and worthwhile. So, i started working my way through it until i had compiled some password parts lists. I still don't claim to have really "broken" the system as i cannot generate a trillian-compliant password with a program that i write as of now, but i'm looking into designing one just for a good cryptanalysis excercise.

I haven't tried breaking into others, but here are a few things to check for in terms of security:

1) Does it automatically store login data?
2) Does it verify the information with stuff on the disk (real easy to test. If it returns false very fast, then it likely does. If it returns false slow, then it may not.)
3) Does it encrypt outgoing traffic? (gotta protect against sniffers)

Try cryptanalyzing anything you find. If you find distinct patterns, follow through and see for yourself how strong it is. After doing the work, i set trillian up in a lockdown mode (file is encrypted. when trillian loads, it's decrypted for trill to access. after loading, it's re-encrypted).

Hopefully someone else can point to a more secure IM client.

jetherson i could see how you got this idea. lately the group that have been vocal here would rather flame posts like this and then move on to take surveys of important things like...whats your favorite color underware.

speaking for myself, the only person resonsible for network security in my company, this is exactly the stuff i want to see.

thank you FlamingRain!! nice job.

How would this be un-AntiOnline-ish?

You remember the old saying: Hackers Know the Weaknesses in your system, shouldnt you?

Well, shouldnt we? The people that flame this kind of stuff usually havent a clue what they are on about and just post because they think other people will possie them for flaming a the evil hax0r's...

Anyway, thats interesting, I'm going to have a look for myself now.

In order for them to get your password do they have to have access to your computer.

Or is it possible for them to obtain the passwords remotly.

Mr.Fatal, if they can gain access to files on your computer then it can be done remotely. Generally, if i were to pick a way to get the passwords, i'd get into their computer and install a program that either:

a) Is a leech and sucks out all the login information and realys it
b) Transfers all the files to my computer so i can take my time from there.

But hey, both those can be accomplished by trojans, why bother even having to gain access when you can get them to download a cheesy game :/.

This is completely un-antionline-ish and most un-antionline-ish stuff is usually tutorials on specifically how to hack someones computer, yes it is a vunerability, but is it a good one hell no and they author didnt even find it out for himself. me being more of a hacker (white hat) than a security expert (though id love to be one) think this is the worst post i have ever seen. If u want to post a vunerability 1. make sure its yours 2. make sure it can comprimise security or at least you think it might with some work. dont just post some trillian/hotmail/whatever vunerability i speak for a lot of people saying that we dont need this.

p.s. congrats to the guy who found the vunerability (next time hack something else)

Modderfokker, i found the password security problems before i was ever aware of any other information regarding trillian vuln's online. Since this post, i have looked around and done a few googles and haven't seen articles with password security. Trillian has lots of vuln's regarding the way it handles data but i didn't find enything specifically on defeating the password protection mechanism. So, addressing your first point, i did find it myself, indepently of any other information that may or may not have been available at that time. And, addressing your second point, it can compromise security rather easily. If you were to write a leech program and someone was to download it (unsuspectingly), you could compromise their IM handles.

I agree that IM handle stealing really isn't a big issue, it doesn't cause loss of data, it doesn't cause computer downtime, it doesn't damage any equipment, but still, it can be a problem because of identity theft (not in the sense of taking someone's full identity). So, i feel my post has enough reason to justify its being here.

Quote:

---

This is completely un-antionline-ish and most un-antionline-ish stuff is usually tutorials on specifically how to hack someones computer, yes it is a vunerability, but is it a good one hell no and they author didnt even find it out for himself. me being more of a hacker (white hat) than a security expert (though id love to be one) think this is the worst post i have ever seen. If u want to post a vunerability 1. make sure its yours 2. make sure it can comprimise security or at least you think it might with some work. dont just post some trillian/hotmail/whatever vunerability i speak for a lot of people saying that we dont need this.

p.s. congrats to the guy who found the vunerability (next time hack something else)

---

How would this be un-AntiOnline-ish?

You remember the old saying: Hackers Know the Weaknesses in your system, shouldnt you?

Well, shouldnt we? The people that flame this kind of stuff usually havent a clue what they are on about and just post because they think other people will possie them for flaming a the evil hax0r's...

Anyway, thats interesting, I'm going to have a look for myself now.


Sometimes people have to repeat themselves.

I have found out that that the author of this post did find the vunerability and the feeling of finding one by yourself is second to none.
But in response i will still defend saaying that even if a hacker did know this vunerability they have to get past your firewall (that u should have running) with a trojan sent to them (which they should have searched) and then still they have to have your ip (if not sent by trojan) and the average user (above noob) will be able to defend easily this attack.

Cheers flaimingrain at the vunerability, keep at finding more!

I can't remember who asked about gaim, but it's less secure when it comes to passwords. If you choose for it to remember your password (which is default checked (grrr)) it stores it IN THE CLEAR. Under XP, the path is c:\Documents and Settings\<user>\application data\.gaim\accounts.xml and under 9x, it's under c:\windows\profiles\<user>\applicaiton data\.gaim\accounts.xml. If you don't have it remember your password, it doesn't store it at all.

Credit goes to my friend WingedPanther on one of my other forums for telling me the path in XP. Thanks WP!

Personally, I think that FlamingRain did well here. I used Trillian for awhile. This shows us how to see how unsecure our login information is. Hopefully Trillian authors will actually pick up on info like this from their users and get their heads out of an undisclosed area.


Great job on proving this one out,

Well, I've come up with a way to help solve this problem. I wanted to use trillian again (wingaim seemed unstable on my system. WinME, bleh). I was looking over the plans of my password generator and realized that if I built something that would simply change my password in that file automatically, I could use the autologin and be able to log in with a new password each time. Of course, you'd have to have a way to let the login servers know you were changing your password somehow too. I guess this would really only help programmers though seeing as there's no available software like that.

You can also run it in lock-down mode where you have a lead-in program that decrypts all the files, then loads trillian and after trillian closes, encrypts them all again. You don't need particularly strong encryption, just enough to keep someone from sending some automated bot.

It seems that trillian uses the functions held in crypto.dll perhaps some analysis of this would allow you to create a more secure version with the same function names. If I had the skill to attempt this, I surely would. But, the idea's out there for those who like trillian but want to be a bit safer with logon info. :)

**Modderfokker: But in response i will still defend saaying that even if a hacker did know this vunerability they have to get past your firewall (that u should have running) with a trojan sent to them (which they should have searched) and then still they have to have your ip (if not sent by trojan) and the average user (above noob) will be able to defend easily this attack.

Cheers flaimingrain at the vunerability, keep at finding more!**

Whats the point in talking about vulnerabilities then? Tightning up your firewall will probably prevent a good majority of vulnerabilies. Thats just stupid. The RPC DCOM was a huge vulnerability that is easily exploited that could be blocked by the use of a firewall or a simple patch. You obviously don't operate in the real world where the firewall is more or less a political thing and not really a security measure (Most managers accept the risk of an open port so they can continue to use whatever it is they use that needs every other port open!!) Any vulnerability is worth talking about.....If you really even care about security.

The answer should never be...ah, the firewall will stop it.

Ok, could we stop for the attitude plz? Man...I heard about AntiOnline and there attitudes but geesh..whether it's "Anti-AntiOnline", or a "good hack", whats the point in debating about it? Information is information, you wouldn't know about this unless he said it i'm guessing, so instead of getting into a huge flamewar with the negative attitudes, lets see what we, as hackers, can do with this information....k?
-----------------------------------------------------------------------------

Very interesting, so I guess will rethink my idea's about going to Trillian lol.

I have two questions..does Trillian store the password in some sort of a temporary cache when your logged in?

Very interesting, so the only sort of encryption they perform with this password is converting...lets say....an 'a', to an 'f', and then into hex? Theres nothing else that goes on there? Interesting...

But man thats bad...i'm glad I don't use Trillian lmao.

There might be a way to make trillian more secure by writing your own strong version of crypto.dll and then mod trillian to use it instead. But that's a lot more work than simply not using trillian. As for your first question Tronic, I imagine it does store it somewhere. As for your second question, yes, it looks like that's all that it does. I haven't really gone in depth on cracking the actual password scheme since simply doing a codebook attack against it worked just fine. At some point when I'm not busy, I'll sit down with the tables and figure out how it works and write a program that'll decrypt the passwords or generate new ones without having to have a codebook loaded or provided.

Right now I don't have much time as I'm starting up a computer club at my school and am devoting my energy to getting machines, organizing things, and writing some basic utilities for the machines. But, anyone else is welcome to compile the tables the same way I did ( my site will have to program I made and used up very soon ) and then try cracking it. Right now I have the computer club and 3 coding projects to deal with before I get around to cracking the encryption itself. Maybe if school gets any more boring and teachers get lax, I'll work on cracking during class.

That is an extremely good article and after having read this I'll think twice maybe even three time about using Trillian again!
Thanks!

I think this tutorial is very interesting and informative.
I think that trillian is secure, but now that you think about it, I guess it isn't.
I use to use trill, but it needed to many patches so from that point on I knew for a fact it was'nt that secure.
and then trill pro, costs to much when it does practically the same exact functions as basic does.
Good tutorial Flaming.

woot. Another pissing contest.