Potentially a MAJOR security hole in latest upgrade!

[j1sjeep]

So, I was perusing my dumpfile learning more about the upgrade. (Lots of clues in there BTW) When I stumbled upon my usernames and passwords a web-based utility I use at WORK and MY ONLINE BANKING information.

I'm certain that neither of these would be stored in a clear text manner anywhere on my system. I'm going to dig some more and make sure this info isn't stored in the clear. This could turn into a media worthy story... People need to know this.

So, boys and girls... Don't go posting dump files. And DO think about using your dongle on a dedicated PC\ThinClient\VM.

[angel-78]

That has always been visible when you dump, its because more than just mj gets dumped. This is old news.

[j1sjeep]

I've never seen passwords for OTHER web services in dumpfiles before. MJ and pmdump are the only user processes that i ran... The PW's aren't in any cookies that I've found.

Domingo, thanks for the input... But not what I'm talking about. I'm saying in the MagicJack.exe memory space are uids and pws for other web based services. Part of the MJ plan was to deliver target advertising based on your browsing habits. They're collecting alot more than your browsing habits. They appear to be harvesting accounts for other services.

On your final note, check out the tigerjet hardware sdk...

[angel-78]

Thanks for the bones Domingo, I figure its going to take me a little while to figure this out. I have been reading up on the certs and keys. I tried generating, but still no go. Thanks for your clues.

Manny

[dan]

dont waste your time Certificates do not work for Authentication or anythibng else.. this is a farse not sure who started it but it has grown here like wildfire.. I chased this down for 1 day obtained the Certifcate it simply does not work!