bugtraq - QuickAuth - Google Authenticator Pebble app vulnerable to MITM attack when configuring TOTP keys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201601201032.u0KAWHns026088@sf01web1.securityfocus.com>
Date: Wed, 20 Jan 2016 10:32:17 GMT
From: issues@...hub.com
To: bugtraq@...urityfocus.com
Subject: QuickAuth - Google Authenticator Pebble app vulnerable to MITM
 attack when configuring TOTP keys

QuickAuth Pebble application loads the configuration page via HTTP. As such it is possible for an attacker to setup and use a MITM proxy to inject Javascript which posts the key to an external site to steal the TOTP keys as they are being updated on the Pebble app.

Original GitHub issue : https://github.com/JumpMaster/QuickAuth/issues/25