full-disclosure - Re: TrueCaller Vulnerability Allows Changing Users Details

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHCFq4-SCUYA-qbMCTDu8pLbOSGE+m8-PzpGG3DnxPH-fd57Kw@mail.gmail.com>
Date: Tue, 5 Jun 2012 17:44:14 +0300
From: Kuwait WhiteHat <q8whitehat@...il.com>
To: doc mombasa <doc.mombasa@...il.com>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>,
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: Re: TrueCaller Vulnerability Allows Changing
	Users Details

Well, using SSL will solve the privacy issues which involves having a 3rd
party sniff the traffic and reconstruct a database of users address books
as outlined here
http://q8whitehat.org/truecaller-vulnerability-allows-changing-users-name/
However, it doesnt solve other problems such as the ability to change
database entries or submitting fake data.
On Jun 5, 2012 5:16 PM, "doc mombasa" <doc.mombasa@...il.com> wrote:

> the only "vulnerability" here is not using https?
> .
>
> 2012/6/4 Григорий Братислава <musntlive@...il.com>
>
>> Paranoia. Thor I is always publicly share contacts:
>>
>> Adrian Lamo
>> c/o DMH Vacavill Psychiatric Hospital
>> Vacavill, CA
>> (707) 449-6504
>>
>> Hector Monsegur
>> (480) 948-6377
>> ADDRESS IS WITHOLD
>>
>> John Paul (JP)
>> 594 3rd St
>> Beaver PA
>> www.inspirosity.com (is Out of business moved into is Gay porn)
>>
>> Jesse Tuttle
>> (http://enquirer.com/editions/2003/07/28/hacker_zoom.jpg)
>> (480) 948-6377
>> ADDRESS IS WITHOLD
>>
>> Gary McKinnon
>> PSC 1005
>> Box 25 FPO AE / Cellblock 42
>> Guantanamo Bay 09593
>>
>> AS (is in case I am too arrested)
>> 4340 East West Hwt Suite 350
>> Bethesda MD
>>
>> Has nothing to hid.
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/