Full Disclosure mailing list archives
Re: pidgin OTR information leakage
From: Jann Horn <jannhorn () googlemail com>
Date: Mon, 27 Feb 2012 18:27:14 +0100
2012/2/25 Dimitris Glynos <dimitris () census-labs com>:
Pidgin transmits OTR (off-the-record) conversations over DBUS in plaintext. This makes it possible for attackers that have gained user-level access on a host, to listen in on private conversations associated with the victim account.
Basically, you're saying that if I have the rights of a user on a machine, I can access the private conversations of that user? Ooooh no. Well, I can also copy his keyfiles, no? And I can alter his settings. And spawn fake "Update didn't work, please enter root password to proceed" windows. I could alter his ~/.bashrc so that whenever he launches "sudo" or "su", a script is launched instead that grabs his password. So, please, what's the point? _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- pidgin OTR information leakage Dimitris Glynos (Feb 27)
- Re: pidgin OTR information leakage Dimitris Glynos (Feb 27)
- Re: pidgin OTR information leakage Jann Horn (Feb 27)
- Re: pidgin OTR information leakage Michele Orru (Feb 27)
- Re: pidgin OTR information leakage Rich Pieri (Feb 28)
- Re: pidgin OTR information leakage Jeffrey Walton (Feb 27)
- Re: pidgin OTR information leakage Ferenc Kovacs (Feb 27)
- Message not available
- Re: pidgin OTR information leakage Dimitris Glynos (Feb 28)
- Re: pidgin OTR information leakage Michele Orru (Feb 27)
- <Possible follow-ups>
- Re: pidgin OTR information leakage Dimitris Glynos (Feb 28)