Date: Thu, 27 Sep 2018 13:08:10 +0530 From: Dhiraj Mishra <mishra.dhiraj95@...il.com> To: oss-security@...ts.openwall.com Subject: Telegram uses SOCKS5 to share user/creds Telegram is supposedly is a secure messaging application but it uses SOCKS5 to transmit user credential's, neither traffic nor credentials are encrypted in the SOCKS5 protocol, but this is how the SOCKS protocol works (see https://tools.ietf.org/html/rfc1929). SOCKS5 carries passwords in cleartext. Product affected: tdesktop 1.3.16 alpha Browser Info: Firefox 62.0 (64 bit) Tested on: Ubuntu 18.04 LTS x64 Steps to reproduce the issue: 1. Open tdesktop 2. Go to Settings > Advanced Settings > Connection type 3. Open "Proxy Settings" check "Use proxy" 4. Put some random Hostname, Port, Username and Password 5. tdesktop tries to connect it, while it connects click on that line which is made of 3 small spots (On right hand side) 6. Click share, the link gets copied. Example Link: https://t.me/socks?server=inputzero.io&port=22&user=dhiraj&pass=MystrongPassw0rd The link which gets generated have the password in plaintext, SOCKS5 is a transport protocol and by itself it is not encrypted. Requests transmit the credentials in plain text which is considered a bad security practice. URI producers should not provide a URI that contains a username or password that is intended to be secret. URIs are frequently displayed by browsers, stored in clear text bookmarks, and logged by user agent history and intermediary applications (proxies). Since the request carries the password in cleartext, this subnegotiation is not recommended for environments where "sniffing" is possible and practical. Thank you -- Regards *Dhiraj Mishra.*GPG ID : 51720F56 | Finger Print : 1F6A FC7B 05AA CF29 8C1C ED65 3233 4D18 5172 0F56
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.