[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 27 Sep 2018 13:08:10 +0530
From: Dhiraj Mishra <mishra.dhiraj95@...il.com>
To: oss-security@...ts.openwall.com
Subject: Telegram uses SOCKS5 to share user/creds
Telegram is supposedly is a secure messaging application but it uses SOCKS5
to transmit user credential's, neither traffic nor credentials are
encrypted in the SOCKS5 protocol, but this is how the SOCKS protocol works
(see https://tools.ietf.org/html/rfc1929). SOCKS5 carries passwords in
cleartext.
Product affected: tdesktop 1.3.16 alpha
Browser Info: Firefox 62.0 (64 bit)
Tested on: Ubuntu 18.04 LTS x64
Steps to reproduce the issue:
1. Open tdesktop
2. Go to Settings > Advanced Settings > Connection type
3. Open "Proxy Settings" check "Use proxy"
4. Put some random Hostname, Port, Username and Password
5. tdesktop tries to connect it, while it connects click on that line which
is made of 3 small spots (On right hand side)
6. Click share, the link gets copied.
Example Link:
https://t.me/socks?server=inputzero.io&port=22&user=dhiraj&pass=MystrongPassw0rd
The link which gets generated have the password in plaintext, SOCKS5 is a
transport protocol and by itself it is not encrypted. Requests transmit the
credentials in plain text which is considered a bad security practice.
URI producers should not provide a URI that contains a username or password
that is intended to be secret. URIs are frequently displayed by browsers,
stored in clear text bookmarks, and logged by user agent history and
intermediary applications (proxies).
Since the request carries the password in cleartext, this subnegotiation is
not recommended for environments where "sniffing" is possible and practical.
Thank you
--
Regards
*Dhiraj Mishra.*GPG ID : 51720F56 | Finger Print : 1F6A FC7B 05AA CF29
8C1C ED65 3233 4D18 5172 0F56
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
