full-disclosure - Re: pidgin OTR information leakage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAK9i0=qnqUgEGkgmCoT-+mJQWB9gE-tDFv+KJKJQ4r+pVBRU4A@mail.gmail.com>
Date: Mon, 27 Feb 2012 18:27:14 +0100
From: Jann Horn <jannhorn@...glemail.com>
To: Dimitris Glynos <dimitris@...sus-labs.com>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Re: pidgin OTR information leakage

2012/2/25 Dimitris Glynos <dimitris@...sus-labs.com>:
> Pidgin transmits OTR (off-the-record) conversations over DBUS in
> plaintext. This makes it possible for attackers that have gained
> user-level access on a host, to listen in on private conversations
> associated with the victim account.

Basically, you're saying that if I have the rights of a user on a
machine, I can access the private conversations of that user? Ooooh
no. Well, I can also copy his keyfiles, no? And I can alter his
settings. And spawn fake "Update didn't work, please enter root
password to proceed" windows. I could alter his ~/.bashrc so that
whenever he launches "sudo" or "su", a script is launched instead that
grabs his password. So, please, what's the point?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/