Em Librem Um serviço é encontrado vulnerabilidade crítica certo dia, quando foi lançado

Em Librem Um serviço que Targeted para uso em Librem 5 Smartphone, logo após o lançamento levantou questão de segurança crítica.

This issue can compromise project that Purism company promotes as protected platform for ensuring privacy.

“Estamos super animado sobre a nossa Librem Um lançamento, se você não pode dizer, mas para tornar as coisas ainda mais emocionante, we also have hit a different milestone with the service: our first security bug!”, – wrote Kyle Rankin chief security officer of Purism company.

Vulnerability is found in Librem Chat and allows entering chat under name of any user without knowing authentication parameters.

In the used backend authorization code through LDAP (matrix-appservice-ldap3) for Matrix network was made an error that was later transited in code of working Librem One service.

Instead of the lineResultado, _ = yield self._ldap_simple_bindwas writtenresult = yield self._ldap_simple_bind“, that enabled any user enter chat without authentication.

Developers from Matrix project that were responsible for the error argue, that issue raised only in master-branchmatrix-appservice-ldap3but not in releases, but in repository problematic line was present since 2016 (conditions for its exploitation were created only with some recent changes).

Pursim company that is famous for development of Librem line of devices with Linux-distributive PureOS, only few days ago launched united subscription Librem One that opens access to all company’s services, similarly to Google and Amazone Prime. As consider in Purism, users pay for popular free services (as Google and Facebook) with their personal data.

Librem 5 Linux Smartphone
Librem 5 Linux Smartphone

Company also offers monthly or weekly payment plans for its services – naturally, client’s confidentiality is guaranteed. On all services, except for Librem Social, is used end-to-end coding.

Company’s services also include Librem Chat messenger, Librem Social, created on the base of Mastodon social network, VPN-service Librem Tunnel and mailing box Librem Mail. Later Purism will pen to subscribers cloud storages Librem Files e Librem Backup, service of contacts’ synchronization Librem Contacts etc.

Users can have free access to Librem Chat and Librem Social. Monthly subscription on all services costs $7,99 and annual$71,91. There is option of family subscription for five person: $14,99 per month and $134,91 per year.

Naturalmente, after finding critical vulnerability in Librem One service right at the day it was launched that endangers all usersdata, there are big doubts about the project.

mesmo assim, Kyle Rankin, chief security officer of Purism argues that:

Kyle Rankin Purism
Kyle Rankin, Purism

“First it’s important to discuss what this bug didn’t impact. All other Librem One services including Tunnel, Mail, and Social were not impacted by this bug. It was an authentication bug specifically with the Librem Chat service. Fortunately this bug occurred early in the service launch before too many customers were using chat. We shut down chat immediately upon confirming the bug and the overall outage lasted about 30 minutes while we investigated and patched.”

Only time will should if Librem One is worth trust of its customers.

Fonte: https://puri.sm/posts/

Sobre Trojan Killer

Carry Trojan Killer portátil em seu memory stick. Certifique-se que você é capaz de ajudar o seu PC resistir a quaisquer ameaças cibernéticas onde quer que vá.

Além disso, verifique

MageCart na Cloud Platform Heroku

Os investigadores encontraram vários MageCart Web Skimmers Em Heroku Cloud Platform

Pesquisadores da Malwarebytes informou sobre encontrar vários skimmers MageCart web na plataforma Heroku nuvem …

Android Spyware CallerSpy

máscaras spyware CallerSpy como uma aplicação de chat Android

Trend Micro especialistas descobriram a CallerSpy malwares, que mascara como uma aplicação de chat Android, …

Deixe uma resposta