full-disclosure - Re: TrueCaller Vulnerability Allows Changing Users Details

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAFMAuHrVCiSjVGX47rFQbUmkeES=inPr8eMJtp6siwBikk0mAw@mail.gmail.com>
Date: Wed, 6 Jun 2012 22:36:49 +0200
From: doc mombasa <doc.mombasa@...il.com>
To: Kuwait WhiteHat <q8whitehat@...il.com>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>,
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: Re: TrueCaller Vulnerability Allows Changing
	Users Details

Yes and how would you mitigate that?
Its not possible to validate the data as they donthave any pre existing
knowledge about your address book

2012/6/5 Kuwait WhiteHat <q8whitehat@...il.com>

> Well, using SSL will solve the privacy issues which involves having a 3rd
> party sniff the traffic and reconstruct a database of users address books
> as outlined here
> http://q8whitehat.org/truecaller-vulnerability-allows-changing-users-name/
> However, it doesnt solve other problems such as the ability to change
> database entries or submitting fake data.
> On Jun 5, 2012 5:16 PM, "doc mombasa" <doc.mombasa@...il.com> wrote:
>
>> the only "vulnerability" here is not using https?
>> .
>>
>> 2012/6/4 Григорий Братислава <musntlive@...il.com>
>>
>>> Paranoia. Thor I is always publicly share contacts:
>>>
>>> Adrian Lamo
>>> c/o DMH Vacavill Psychiatric Hospital
>>> Vacavill, CA
>>> (707) 449-6504
>>>
>>> Hector Monsegur
>>> (480) 948-6377
>>> ADDRESS IS WITHOLD
>>>
>>> John Paul (JP)
>>> 594 3rd St
>>> Beaver PA
>>> www.inspirosity.com (is Out of business moved into is Gay porn)
>>>
>>> Jesse Tuttle
>>> (http://enquirer.com/editions/2003/07/28/hacker_zoom.jpg)
>>> (480) 948-6377
>>> ADDRESS IS WITHOLD
>>>
>>> Gary McKinnon
>>> PSC 1005
>>> Box 25 FPO AE / Cellblock 42
>>> Guantanamo Bay 09593
>>>
>>> AS (is in case I am too arrested)
>>> 4340 East West Hwt Suite 350
>>> Bethesda MD
>>>
>>> Has nothing to hid.
>>>
>>> _______________________________________________
>>> Full-Disclosure - We believe in it.
>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>> Hosted and sponsored by Secunia - http://secunia.com/
>>>
>>
>>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/