En Librem Un servicio se encuentra vulnerabilidad crítica derecha el día en que se puso en marcha

En Librem Un servicio que apuntado para el uso en Librem 5 teléfono inteligente, justo después de la liberación elevó problema crítico de seguridad.

This issue can compromise project that Purism company promotes as protected platform for ensuring privacy.

“Estamos muy entusiasmados con nuestra Librem Uno de lanzamiento, Si no se puede decir, pero para hacer las cosas aún más emocionante, we also have hit a different milestone with the service: our first security bug!”, – wrote Kyle Rankin chief security officer of Purism company.

Vulnerability is found in Librem Chat and allows entering chat under name of any user without knowing authentication parameters.

In the used backend authorization code through LDAP (matrix-appservice-ldap3) for Matrix network was made an error that was later transited in code of working Librem One service.

Instead of the lineResultado, _ = yield self._ldap_simple_bindwas writtenresult = yield self._ldap_simple_bind“, that enabled any user enter chat without authentication.

Developers from Matrix project that were responsible for the error argue, that issue raised only in master-branchmatrix-appservice-ldap3but not in releases, but in repository problematic line was present since 2016 (conditions for its exploitation were created only with some recent changes).

Pursim company that is famous for development of Librem line of devices with Linux-distributive PureOS, only few days ago launched united subscription Librem One that opens access to all company’s services, similarly to Google and Amazone Prime. As consider in Purism, users pay for popular free services (as Google and Facebook) with their personal data.

Librem 5 Linux Smartphone
Librem 5 Linux Smartphone

Company also offers monthly or weekly payment plans for its services – naturally, client’s confidentiality is guaranteed. On all services, except for Librem Social, is used end-to-end coding.

Company’s services also include Librem Chat messenger, Librem Social, created on the base of Mastodon social network, VPN-service Librem Tunnel and mailing box Librem Mail. Later Purism will pen to subscribers cloud storages Librem Files y Librem Backup, service of contacts’ synchronization Librem Contacts etc..

Users can have free access to Librem Chat and Librem Social. Monthly subscription on all services costs $7,99 and annual$71,91. There is option of family subscription for five person: $14,99 per month and $134,91 per year.

Naturalmente, after finding critical vulnerability in Librem One service right at the day it was launched that endangers all usersdata, there are big doubts about the project.

sin embargo, Kyle Rankin, chief security officer of Purism argues that:

Kyle Rankin Purism
Kyle Rankin, Purism

“First it’s important to discuss what this bug didn’t impact. All other Librem One services including Tunnel, Mail, and Social were not impacted by this bug. It was an authentication bug specifically with the Librem Chat service. Fortunately this bug occurred early in the service launch before too many customers were using chat. We shut down chat immediately upon confirming the bug and the overall outage lasted about 30 minutes while we investigated and patched.”

Only time will should if Librem One is worth trust of its customers.

Fuente: https://puri.sm/posts/

Acerca de Trojan Killer

Trojan Killer llevar portátil en su dispositivo de memoria. Asegúrese de que usted es capaz de ayudar a su PC resistir cualquier amenaza cibernética donde quiera que vaya.

también puedes ver

MageCart en la plataforma de nube Heroku

Los investigadores encontraron Varios MageCart Web skimmers En Heroku Cloud Platform

Investigadores de Malwarebytes informaron sobre la búsqueda de varios skimmers MageCart web en la plataforma de nube Heroku …

Android Spyware CallerSpy

máscaras spyware CallerSpy como una aplicación de chat Android

expertos de Trend Micro descubrieron que el malware CallerSpy, que enmascara como una aplicación de chat y Android, …

Deja una respuesta