In Librem Een dienst wordt gevonden kritieke kwetsbaarheid recht van de dag waarop het werd gelanceerd

In Librem Een dienst die bedoeld voor gebruik in Librem 5 smartphone, net na de release verhoogde kritische veiligheidskwestie.

This issue can compromise project that Purism company promotes as protected platform for ensuring privacy.

“We zijn super enthousiast over onze Librem One lancering, als je niet kunt vertellen, maar om de zaken nog spannender te maken, we also have hit a different milestone with the service: our first security bug!”, – wrote Kyle Rankin chief security officer of Purism company.

Vulnerability is found in Librem Chat and allows entering chat under name of any user without knowing authentication parameters.

In the used backend authorization code through LDAP (matrix-appservice-ldap3) for Matrix network was made an error that was later transited in code of working Librem One service.

Instead of the lineResultaat, _ = yield self._ldap_simple_bindwas writtenresult = yield self._ldap_simple_bind“, that enabled any user enter chat without authentication.

Developers from Matrix project that were responsible for the error argue, that issue raised only in master-branchmatrix-appservice-ldap3but not in releases, but in repository problematic line was present since 2016 (conditions for its exploitation were created only with some recent changes).

Pursim company that is famous for development of Librem line of devices with Linux-distributive PureOS, only few days ago launched united subscription Librem One that opens access to all company’s services, similarly to Google and Amazone Prime. As consider in Purism, users pay for popular free services (as Google and Facebook) with their personal data.

Librem 5 Linux Smartphone
Librem 5 Linux Smartphone

Company also offers monthly or weekly payment plans for its services – naturally, client’s confidentiality is guaranteed. On all services, except for Librem Social, is used end-to-end coding.

Company’s services also include Librem Chat messenger, Librem Social, created on the base of Mastodon social network, VPN-service Librem Tunnel and mailing box Librem Mail. Later Purism will pen to subscribers cloud storages Librem Files En Librem Backup, service of contacts’ synchronization Librem Contacts enz.

Users can have free access to Librem Chat and Librem Social. Monthly subscription on all services costs $7,99 and annual$71,91. There is option of family subscription for five person: $14,99 per month and $134,91 per year.

Van nature, after finding critical vulnerability in Librem One service right at the day it was launched that endangers all usersdata, there are big doubts about the project.

niettemin, Kyle Rankin, chief security officer of Purism argues that:

Kyle Rankin Purism
Kyle Rankin, Purism

“First it’s important to discuss what this bug didn’t impact. All other Librem One services including Tunnel, Mail, and Social were not impacted by this bug. It was an authentication bug specifically with the Librem Chat service. Fortunately this bug occurred early in the service launch before too many customers were using chat. We shut down chat immediately upon confirming the bug and the overall outage lasted about 30 minutes while we investigated and patched.”

Only time will should if Librem One is worth trust of its customers.

Bron: https://puri.sm/posts/

Over Trojan Killer

Carry Trojan Killer Portable op je memory stick. Zorg ervoor dat u in staat om uw pc te weerstaan ​​elke cyberdreigingen overal mee naar toe bent.

Controleer ook

MageCart op de Heroku Cloud Platform

Onderzoekers vonden verschillende MageCart Web Skimmers Op Heroku Cloud Platform

Onderzoekers van Malwarebytes rapporteerde over het vinden van een aantal MageCart web skimmers op de Heroku cloud-platform …

Android Spyware CallerSpy

CallerSpy spyware maskers als een Android-chat-applicatie

Trend Micro deskundigen ontdekte de malware CallerSpy, waarachter een Android chat-toepassing en, …

Laat een antwoord achter