Re: [Full-disclosure] pidgin OTR information leakage

[Dimitris Glynos <dimitris () census gr>]

On 02/28/2012 12:14 AM, Dimitris Glynos wrote:
> On 02/27/2012 11:23 PM, devnull () vonage com wrote:
> > I believe that clarification is in order.
>
> Indeed it is. The original post mentions a same-user attack
> vector which is very misleading as to what the real problem here is.
>
> And it boils down to this:
>
> Once a process sends private info over DBUS there is no way
> to control where this ends up (which apps are the qualified receivers)
> or what the receivers do with it.

This should be:

Once a process *broadcasts* private info over DBUS there is no way
to control where this ends up (which apps are the qualified receivers)
or what the receivers do with it.

> So, if for example the user
> selects not to log OTR plaintext (so that this sensitive information
> doesn't touch the hard drive) another application on the other end
> of DBUS might choose to do something different (and not by malicious
> intent). There is no way to enforce the same security policy on the
> sender and the receivers.
>
> How this could be exploited by attackers or what forensic evidence
> DBUS snooping leaves are of much less importance than the above
> privacy issue.
>
> There is a very good discussion on the pidgin ticket page:
> http://developer.pidgin.im/ticket/14830
>
> Also, I've made some updates to our post, to make it clearer
> as to what this issue is about:
>
> http://census-labs.com/news/2012/02/25/libpurple-otr-info-leak/
>
> If there are still questions, I'll be happy to answer them.
>
> Hope this clarifies things a bit,
>
> Dimitris