Security: DB logs from Chrome not encrypted
Reported by
conrj...@gmail.com,
Sep 20 2017
|
|
Issue descriptionThis template is ONLY for reporting security bugs. If you are reporting a Download Protection Bypass bug, please use the "Security - Download Protection" template. For all other reports, please use a different template. Please READ THIS FAQ before filing a bug: https://chromium.googlesource.com /chromium/src/+/master/docs/security/faq.md Please see the following link for instructions on filing security bugs: https://www.chromium.org/Home/chromium-security/reporting-security-bugs NOTE: Security bugs are normally made public once a fix has been widely deployed. VULNERABILITY DETAILS 1.I went to %User Profile%\AppData\Local\Google\Chrome\User Data\Default\Login Data 2.Opened the file in TextPad and notepad 3.I opened up my Login Data in TextPad and all of my passwords were encrypted, but certain things like my security questions for my password recovery from https://netsecure.adp.com were in plain text as seen below. It shows the full question and the answers as well as my user ID. It is not encrypted like all of my other information. VERSION Chrome Version: 61.0.3163.91 Official Build 64-bit Operating System: Windows 7 Enterprise SP1] REPRODUCTION CASE: Below is the non-encrypted log I have pulled from my computer. W W ‚| c};/ ‚@ 3 L https://my.adp.com/static/redbox/login.htmlhttps://agateway.adp.com/siteminderagent/forms/login.fccregistrationForm:userIdjconrad@xifin.com ÐŒß Ñ Œz ÀO—ë áùá’ ‘³M¿'õpƒ›È f À ¸ _PÄžÖV$´.L4J € Î<<^¨xÚïyx €»ýÜ× çKäÉ1gͪ×Nsä"Š§ Úá~ò(µ¤˜ A„V ¯S‰?ε https://my.adp.com/ .·1€”ÖW ‡~ ;/ ‚@ A L ‰Dhttps://netsecure.adp.com/pages/sms/ess/v2/pub/ssr/theme.faceshttps://netsecure.adp.com/pages/sms/ess/v2/pub/ssr/registration.facesregistrationForm:userIdjconrad@xifin.com ÐŒß Ñ Œz ÀO—ë áùá’ ‘³M¿'õpƒ›È f À ùé…>æ ´X äÒÔÝÏ» € ×˻ϺóåÑ”f—#¬Bî ƒ¬Ã Óçq©%½1n ä‚# y½‹xô ä ÇøNÂu :IÅ 1https://netsecure.adp.com/ .·1x§r X Auburn r e g i s t r a t i o n F o r m : a n s w e r 2 A I n w h a t c i t y w a s y o u r m o t h e r b o r n ? ( E n t e r f u l l n a m e o f c i t y o n l y ) s e c Q u e s t i o n 2 Meg r e g i s t r a t i o n F o r m : a n s w e r 1 N s y n c r e g i s t r a t i o n F o r m : a n s w e r 3 ( W h a t w a s t h e f i r s t c o n c e r t y o u a t t e n d e d ? s e c Q u e s t i o n 3 $ W h a t w a s t h e n a m e o f y o u r f i r s t p e t ? s e c Q u e s t i o n 1 ¼% ) ‡D qu ‚P k ‰, https://performancemanager4.successfactors.com/kbahttps://performancemanager4.successfactors.com/loginusernamejconradpassword ÐŒß Ñ Œz ÀO—ë áùá’ ‘³M¿'õpƒ›È f À ƒ·cú·žxº@ +ì` € U¥êWc±© ¼ÿë‰9ÿœ XaÁ8ú~ò Ì /U¾%,© “˜Ÿ JàŸ Ëhí O¥› Wc\_¤H7#CéBhttps://performancemanager4.successfactors.com/ .·03Q a L l o g i n F o r m 2 https://performancemanager4.successfactors.com/kba 4 https://performancemanager4.successfactors.com/login U s e r n a m e u s e r n a m e j c o n r a d text ÿÿÿ U s e r n a m e s a p M I n p u t B a s e I n n e r _ _ i n p u t 1 - i n n e r E n t e r P a s s w o r d p a s s w o r d password ÿÿÿ E n t e r P a s s w o r d s a p M I n p u t B a s e I n n e r _ _ i n p u t 2 - i n n e r ò ò ‚&* ; ‚P Q L https://a3proxy01:8082/jconrad ÐŒß Ñ Œz ÀO—ë áùá’ ‘³M¿'õpƒ›È f À hÑ ´2Á y–Í嬥{ € £/Ä€LÜ +,FO`ÍØ®j M²‰‹ï¨§î5zN‰%–‡’ *½p‘sŧ _¬†ŸZ«F4Ú „6N`¿fúhttps://a3proxy01:8082/172.20.1.23 .·#«gGœ ‰b& ]]! !‚P K Ž, https://portal.solutionary.com/login.jsfhttps://portal.solutionary.com/login.jsfj_usernameJconradj_password ÐŒß Ñ Œz ÀO—ë áùá’ ‘³M¿'õpƒ›È f À ÏhbƒtuS—l ÍH‡ô- € .,šTæ.b4¦¸—eG¶^š Ô•ÍÑ®ë±Ú#˜ D Ó°]ûJƒ& Ũ (q¨Ž_bLøžçâq?ÈD€ fQhttps://portal.solutionary.com/ .·Dæ²Î Œ l o g i n F o r m ( https://portal.solutionary.com/login.jsf( https://portal.solutionary.com/login.jsf C l i e n t I D : j _ c l i e n t I d text ÿÿÿ C u i - i n p u t f i e l d u i - i n p u t t e x t u i - w i d g e t u i - s t a t e - d e f a u l t u i - c o r n e r - a l l U s e r I D : j _ u s e r n a m e text ÿÿÿ C u i - i n p u t f i e l d u i - i n p u t t e x t u i - w i d g e t u i - s t a t e - d e f a u l t u i - c o r n e r - a l l P a s s w o r d : j _ p a s s w o r d password off ÿÿÿ B u i - i n p u t f i e l d u i - p a s s w o r d u i - w i d g e t u i - s t a t e - d e f a u l t u i - c o r n e r - a l l p p p ‡ SW# #‚P ; ‰4 http://confluence:8090/login.actionhttp://confluence:8090/dologin.actionos_username_password ÐŒß Ñ Œz ÀO—ë áùá’ ‘³M¿'õpƒ›È f À ó… ú£ $nÔjqA³ï € ^°j ÀÙ žŸ¶\! 5´¯H M@ØGFóW ô( è8"dNì Q2úûfî`Cãª0’”QÓìŽØ:http://confluence:8090/ .·3eq°ÁP l o g i n f o r m # http://confluence:8090/login.action % http://confluence:8090/dologin.action U s e r n a m e o s _ u s e r n a m e text ÿÿÿ U s e r n a m e t e x t P a s s w o r d o s _ p a s s w o r d password ÿÿÿ P a s s w o r d p a s s w o r d R e m e m b e r m e o s _ c o o k i e checkbox c h e c k b o x
,
Sep 20 2017
Got it, thanks for clarification. |
|
►
Sign in to add a comment |
|
Comment 1 by palmer@chromium.org
, Sep 20 2017Status: WontFix (was: Unconfirmed)